Attachment B - NASA IT Software and Hardware Rider

Attachment B

80TECH27QA003

TheNASA IT Software and Hardware Rider

1. Audit and Compliance Review Notifications

All audit and compliance review notifications, to include anti-piracy violation inquiries, must be submitted via email to the Contracting Officer and Agency Software Manager. NASA will have 30 days to respond to all requests.
2. Use of Software with Automated Reporting Features

Automated reporting by a software firm with whom NASA maintains a licensing agreement must be encrypted through use of a VPN or over an authorized secure port to ensure information about NASA’s users and network is not exposed. Automated reporting from licensed software must not include personally identifiable information about NASA users. Automated reporting via unsecure means will not be allowed and such traffic will be blocked by NASA. NASA will not reconfigure security controls or firewall rules to accommodate automated software reporting. Automated report blocking by NASA will not constitute a violation of Publisher terms and all stated clauses to this effect are void.

3. Geographical Limitations

Use of the license(s) shall not be restricted to specific locations or time zones nor require additional license(s) for use within the US or US territory. License use may transfer to other NASA/government sites as required to perform required work. Publisher may request notification prior to license relocation.

4. License Usage

In performance of NASA business, license(s) may be used by Government personnel and Government contractors. No additional licensing requirements will be applied or enforced for contractor usage in performance of contracting duties or projects.

5. Contract Terms

Additional terms and conditions added to quotes and purchases will not be binding or act as a contract modification.

6. Reporting

Report requests for usage or entitlements must be submitted and approved by the contracting officer, prior to report generation. Reports will not be utilized to generate or compel compliance action(s). Generated reports will not be shared with any 3rd party without prior consent by NASA. All requests to share data with 3rd parties must be submitted in writing and disclose identity of third party, all information to be shared, justification for sharing information, and data retention period. NASA may require additional information depending on security posture.

Attachment B

80TECH27QA003

7. Reserved

8. Artifacts (received from Dept of State)

The Contractor must regularly identify, assess, monitor, and mitigate cybersecurity supply