• SWE-033 - Acquisition vs. Development Assessment

3.1.2 The project manager shall assess options for software acquisition versus development.

• 7.3 - Acquisition Guidance -

• SWE-013 - Software Plans

3.1.3 The project manager shall develop, maintain, and execute software plans, including security plans, that cover the entire software life cycle and, as a minimum, address the requirements of this directive with approved tailoring.

• SWE-034 - Acceptance Criteria

3.1.5 The project manager shall define and document the acceptance criteria for the software. 

• SWE-036 - Software Process Determination

3.1.6 The project manager shall establish and maintain the software processes, software documentation plans, list of developed electronic products, deliverables, and list of tasks for the software development that are required for the project’s software developers, as well as the action required (e.g., approval, review) of the Government upon receipt of each of the deliverables.

• SWE-037 - Software Milestones

3.1.7 The project manager shall define and document the milestones at which the software developer(s) progress will be reviewed and audited. 

• SWE-039 - Software Supplier Insight

3.1.8 The project manager shall require the software developer(s) to periodically report status and provide insight into software development and test activities; at a minimum, the software developer(s) will be required to allow the project manager and software assurance personnel to:

1. 1. Monitor product integration.
   2. Review the verification activities to ensure adequacy.
   3. Review trade studies and source data.
   4. Audit the software development processes and practices.
   5. Participate in software reviews and technical interchange meetings.

• SWE-040 - Access to Software Products

3.1.9 The project manager shall require the software developer(s) to provide NASA with software products, traceability, software change tracking information, and non-conformances in electronic format, including software development and management metrics.

• SWE-042 - Source Code Electronic Access

3.1.10 The project manager shall require the software developer(s) to provide NASA with electronic access to the source code developed for the project in a modifiable format.

• SWE-139 - Shall Statements

3.1.11 The project manager shall comply with the requirements in this NPR that are marked with an “X” in Appendix C consistent with their software classification.

• SWE-121 - Document Tailored Requirements

3.1.12 Where approved, the project manager shall document and reflect the tailored requirement in the plans or procedures controlling the development, acquisition, and deployment of the affected software.

• SWE-125 - Requirements Compliance Matrix

3.1.13 Each project manager with software components shall maintain a requirements mapping matrix or multiple requirements mapping matrices against requirements in this NPR, including those delegated to other parties or accomplished by contract vehicles or Space Act Agreements. 

• SWE-027 - Use of Commercial, Government, and Legacy Software

3.1.14 The project manager shall satisfy the following conditions when a COTS, GOTS, MOTS, OSS, or reused software component is acquired or used: 

a. The requirements to be met by the software component are identified.

b. The software component includes documentation to fulfill its intended purpose (e.g., usage instructions).

c. Proprietary rights, usage rights, ownership, warranty, licensing rights, transfer rights, and conditions of use (e.g., required copyright, author, and applicable license notices within the software code, or a requirement to redistribute the licensed software only under the same license (e.g., GNU GPL, ver. 3, license)) have been addressed and coordinated with Center Intellectual Property Counsel. 

d. Future support for the software product is planned and adequate for project needs.

e. The software component is verified and validated to the same level required to accept a similar developed software component for its intended use.

f. The project has a plan to perform periodic assessments of vendor reported defects to ensure the defects do not impact the selected software components.