Homeland Security Section 508 Compliance for Contracting Officer’s Technical Representatives and Program & Project Managers Office of Accessible Systems & Technology Homeland Security Topics Section 508 …………………...…….......................... 3 Roles and Responsibilities ..………………………… 7 – How to comply with Section 508 Section 508 Acquisition Process …………………… 21 DHS Systems Engineering Life Cycle Alignment …. 31 – Section 508 EIT Accessibility Plan Where To Go for Help …….…………………………... 2 64 Improving Access To Secure Our Homeland Homeland Security Section 508 of the Rehabilitation Act Office of Accessible Systems & Technology Homeland Security Section 508 is a Law • Section 508 of the Rehabilitation Act of 1973 as amended 1998 – Ensures people with disabilities have access to and use of Electronic and Information Technology (EIT), including: • Electronic data, Information, and Support services – Encoded in CFR 36:1194 and added to the Federal Acquisition Regulations at Section 39.2 • The U.S. Access Board developed accessibility standards – Applies to: • Federal agencies in support of employees and members of the public with disabilities • All DHS EIT contracts and contract actions • Enforceable as of June 21, 2001 4 Improving Access To Secure Our Homeland Homeland Security The Purpose • Section 508 is intended to provide equal access and use of information for people with disabilities and eliminate barriers to employment • DHS is obligated to: – Require compliance with applicable Section 508 Technical Standards – Perform Market Research and Section 508 Analysis of Alternatives – Procure the most compliant products and services that meet the program business need! – Document compliance • DHS is not obligated to: – Procure anything that DOES NOT meet the business need 5 Improving Access To Secure Our Homeland Homeland Security Key Term: Section 508 Compliant Section 508 compliance requires both a legal and a technical approach to compliance Legal compliance (required by FAR 39.2) includes documenting: • Market research • Which Section 508 technical standards apply • Any applicable Section 508 (legal) exceptions • Which standards cannot be met, if any • Including the documentation in the contract file 6 Improving Access To Secure Our Homeland Homeland Security Technical Compliance Technical compliance includes: • Documenting how the product meets the technical standards that apply • Ensuring that all custom development meets the applicable Section 508 technical standards • Planning for Section 508 compliance in project requirements, design, integration, testing, and acceptance criteria before release 7 Improving Access To Secure Our Homeland Homeland Security Stakeholder Roles & Responsibilities Office of Accessible Systems & Technology Homeland Security Stakeholders • OAST • Component Section 508 Coordinator • Contracting Officers Technical Representative (COTR) • Requiring officials • Project or Program Managers who manage the work on behalf of the customer: – the person with the business requirement – the program owner • Section 508 Subject Matter Experts 9 Improving Access To Secure Our Homeland Homeland Security Section 508 Program Office Roles & Responsibilities Office of Accessible Systems & Technology Homeland Security Office of Accessible Systems & Technology (OAST) • OAST leads the department-wide implementation of Section 508 – Provides strategic direction, technical support, and training to ensure DHS employees and customers with disabilities have equal access to information and data • Office of the Chief Information Officer (OCIO) • Office for Civil Rights & Civil Liberties (CRCL) 11 Improving Access To Secure Our Homeland Homeland Security OAST Program Management • Sets Section 508 policy for all of DHS • Provides DHS governance to ensure Section 508 compliance is part of decision-making activities • Evaluates and reports on DHS compliance with Section 508 • Offers guidance and technical assistance to DHS personnel on reasonable accommodations • Develops and delivers training 12 Improving Access To Secure Our Homeland Homeland Security OAST Program Management • Reviews all acquisitions over 2.5 million • Authorizes all requests for: – National Security Exception – Undue Burden Exception • Provides the DHS Accessibility Requirements Tool (DART) – http://dhsconnect.dhs.gov/org/comp/mgmt/cio/oast/ – http://accessibility.dhs.gov 13 Improving Access To Secure Our Homeland Homeland Security OAST Program Management • Mans the DHS accessibility help desk providing subject matter experts who are available to help you with all aspects of Section 508 compliance, including procurement review, application and document testing, standards and exception analysis, and general information and training. • Evaluates and reports on DHS compliance with Section 508 • Is available for technical assistance to DHS Components when acquiring EIT 14 Improving Access To Secure Our Homeland Homeland Security Component Section 508 Coordinator • Authorize component requests for: – Back Office Exception – Fundamental Alteration Exception – Incidental to Contract Exceptions • Are required to review component IT acquisitions with dollar value less than $2.5 million • Provide Section 508 technical assistance • Participate in IT governance activities regarding Section 508 compliance. • Report component Section 508 implementation status 15 Improving Access To Secure Our Homeland Homeland Security Contracting Officer’s Technical Representative Roles & Responsibilities Office of Accessible Systems & Technology Homeland Security Contracting Officer’s Technical Representative Has to ensure proper contractual and project activities occur for three areas: • Acquisition Support Responsibilities • Project Management Responsibilities • Ensuring proper documentation – From Requiring Official 17 Improving Access To Secure Our Homeland Homeland Security Acquisition Support Role Acquisition Support Section 508 Activities: • Ensure Section 508 standards and exceptions are identified and included in Contractual language – – – – – Purchase Requests SOO, SOW, IGCE, ARD, RFP, RFI PRISM FirstSource Appendix G EAGLE Task Orders Appendix H • Ensure Section 508 exceptions , if any, are requested and authorized 18 Improving Access To Secure Our Homeland Homeland Security COTR Project Management Role • Ensure DHS SELC Alignment & Project Life-cycle Support – Confirm Acceptance Testing – Confirm Remediation Plan, if needed – Confirm required artifacts (documentation) per the Section 508 EIT Accessibility Plan (CPPM Training) • Ensure that Requiring Officials provide documentation – Description of Market Research performed – If compliant product is not available show which Section 508 standards are not met – Basis for exception decision 19 Improving Access To Secure Our Homeland Homeland Security Requiring Official and Project Manager Roles & Responsibilities Office of Accessible Systems & Technology Homeland Security Requiring Official Role Requiring Official Section 508 Role: • Define functional requirements for their business needs. • Identify applicable Section 508 technical standards and exceptions • Obtain authorization for exceptions or seek advice when needed (DHS Forms #4103, 4105, 4107, 4108, 4109) • Perform market research for items that best meet business needs (DHS Form #4106) – Identify the most compliant that meet business needs • Draft contract Section 508 language using DART 21 Improving Access To Secure Our Homeland Homeland Security Program or Project Manager • Knowledge of DHS SELC Alignment and Project Life Cycle Support activities ensures: – Identification of Section 508 technical standards or exceptions – Authorization for exceptions is obtained – Market research is performed • The most compliant product that meet business needs is chosen (DHS Form #4106) • Section 508 issues are resolved or a remediation plan is approved. • Communication, Communication, Communication – Talk to the right people – Get the right people talking to each other 22 Improving Access To Secure Our Homeland Homeland Security Section 508 Subject Matter Expert • Advise on lifecycle requirements • Test EIT products for Section 508 compliance • Recommend technical development solutions • Review market research/alternative analyses • Train key personnel • Explain Section 508 governance activities Request SME assistance at http://accessibility.dhs.gov 23 Improving Access To Secure Our Homeland Homeland Security Section 508 Acquisition Process Office of Accessible Systems & Technology Homeland Security Acquisition Process: Need, Analyze, Obtain, Deploy • Clearly define your Business Need • Product or service must meet the Business Need – If the product or service does not do what you need it to do then what good is it? – If a product is Section 508 compliant but doesn’t meet the Business Need, you do not have to buy it. • Collect and analyze relevant market information • Identify possible sources for the acquisition • Perform effective market analysis and industry knowledge • Select and document the most 508 compliant product that meets business needs! – DHS FORM # 4106 25 Improving Access To Secure Our Homeland Homeland Security Market Research Form • Compliance requires market research Image fills this entire area – Custom, commercial, or free – Section 508 compliance requires documenting analysis of alternatives – Summarizes additional documentation required (OR originates at the upper left corner of the area outlined and is sized to the full width or height of this bounding box.) 26 Improving Access To Secure Our Homeland Homeland Security Most Compliant • If no fully-compliant product is available, the agency must procure the most compliant product that meets the business needs • Commercial products that do NOT fully meet Section 508 Technical Standards require market research documentation – DHS 4106 - Most Compliant Product - Market Research Form • Most compliant product – No COTS product exists that meets ALL the applicable 508 technical requirements OR – Fully compliant products cannot be furnished in time to satisfy the agency’s delivery requirements • With most compliant product the vendor must be given a list of defects and asked for a remediation plan 27 Improving Access To Secure Our Homeland Homeland Security Voluntary Product Accessibility Template (VPAT) • Provided by EIT Product Vendor to Show 508 Compliance • Assists Federal contracting officials and other buyers in making preliminary assessments regarding the availability of commercial Electronic and Information Technology products and services with features that support accessibility. • It is assumed and recommended that offerers will provide additional contact information to facilitate more detailed inquiries. 28 Improving Access To Secure Our Homeland Homeland Security Voluntary Product Accessibility Template (VPAT) Bluebeam PDF Revu version 6.5.4 29 Improving Access To Secure Our Homeland Homeland Security Other Sources • http://accessibility.dhs.gov/PublicAppRepository.aspx. – OAST Section 508 Test results • Test the product – Ask the vendor for a test version – Request Section 508 testing OR – Have your “Trusted Testers” do the testing 30 Improving Access To Secure Our Homeland Homeland Security Section 508 Acquisition Language Office of Accessible Systems & Technology Homeland Security DHS Accessibility Requirements Tool (DART) • Tool generates Section 508 language for acquisition SOW, PWS, RFP, RFQ and SOO • Provides summary of Section 508 requirements • Select applicable Section 508 exceptions and technical standards • Copy Section 508 language from tool • Paste into acquisition documentation DART is available under the DHSConnect, MGMT >> CIO >> OAST >> OAST Component Resources 32 Improving Access To Secure Our Homeland Homeland Security Commercial Vendors • Perform based on standard procurement language: – For any COTS or GOTS procured EIT • Does this acquisition include a requirement for QA or IV&V testing? – Sample DART Tool Contract language • 36 CFR 1194.2(b) – (COTS/GOTS products), When procuring a product, each agency shall procure products which comply with the provisions in this part when such products are available in the commercial marketplace or when such products are developed in response to a Government solicitation. – Custom (developed in response) requires additional contract & lifecycle language 33 Improving Access To Secure Our Homeland Homeland Security Standard Procurement Language Section 508 requirements are applicable to all Federal procurements including… • EAGLE – Task Orders • First Source – Appendix G • Information Technology Acquisition Review (ITAR) – Management Directive 0007.1 34 Improving Access To Secure Our Homeland Homeland Security DHS SELC Alignment Solution Engineering Planning Requirements Definition Office of Accessible Systems & Technology Design Development Integration & Test Implementation Operations & Maintenance Homeland Security DHS SELC • DHS Acquisition Instruction/Guidebook #102-01-001: Appendix B Version 2.0, Sep 2010 – Ensuring that appropriate activities are planned and implemented in each stage of the life cycle to increase the project’s success – DHS Connect > Organization > Components > Management (MGMT) > Chief Information Officer (CIO) > Offices > Enterprise Business Management Office (EBMO) > Systems Engineering Life Cycle – Search for “SELC” • Section 508 compliance relies on common life cycle documents and activities! – MNS, CONOPS, AoA, RTM, SRD, FRD, TRD 36 Improving Access To Secure Our Homeland Homeland Security Section 508 EIT Accessibility Plan 37 Improving Access To Secure Our Homeland Homeland Security Building Accessibility in is Cost Effective • Planning saves money! • It is expensive to retrofit software to meet accessibility standards • The cost of revision is estimated to be - 1.5 to 6 times greater during development than during the design phase - 60 to100 times greater after release [Pressman, 2005] 38 Improving Access To Secure Our Homeland Homeland Security Section 508 EIT Accessibility Plan Solution Requirements Integration Planning – Several steps to the project, it all beginsDesign with an ideaDevelopment and more planning Definition & Test Engineering Implementation Operations & Maintenance Stage 1: Solution Engineering & Planning Stage 2: Requirements Definition Stage 3: Design & Development Stage 4: Integration & Test Stage 5: Implementation & Operations – Project managers and developers might relate to this as a classic waterfall development approach, but it is iterative and can be adapted to rapid application development or other methods 39 Improving Access To Secure Our Homeland Homeland Security Exiting Solutions Engineering and Planning There are 2 ways to fulfill the requirements for this section: 1. Have a documented and authorized exception 2. Complete the preliminary work for requirements definition 40 Improving Access To Secure Our Homeland Homeland Security Before Planning Begins • National Security Exception Request and Authorization Form (DHS Form 4105) – – – 41 Usually known during planning if the project will involve National Security Recognized Section 508 exception Section 508 compliance includes clearly documenting any exceptions Improving Access To Secure Our Homeland Homeland Security Solution Engineering • • • • Planning Solution Engineering & Planning Requirements Definition Design Development Integration & Test Implementation Operations & Maintenance What are you engineering? What are you planning to buy? What are you planning to build? How will you select the best products? What is the business need? 42 Improving Access To Secure Our Homeland Homeland Security Solution Engineering Planning Planning Requirements Definition Design Development Integration & Test Implementation Operations & Maintenance • Considerations – Identify Section 508 Exceptions that might apply • Section 508 Exceptions Worksheet – Identify the applicable Section 508 Technical Standards • Section 508 Applicable Standards Worksheet – Select the most compliant product available • DHS Form 4106: Most Compliant Product Market Research Form and supporting documents 43 Improving Access To Secure Our Homeland Homeland Security Exceptions Worksheet • Assists in Image fills this entire area – (OR originates at the upper left corner of the area outlined and is sized to the full width or height of this bounding box.) – Identifying possible exceptions Asking the right questions • Legal Section 508 compliance requires clearly documenting any exceptions 44 Improving Access To Secure Our Homeland Homeland Security Exceptions • Requires Section 508 Coordinator approval – EIT acquired by a contractor incidental to a contract – Back Office (Maintenance only) Equipment – Fundamental Alteration • Requires OAST Director approval – National Security Systems – Undue Burden 45 Improving Access To Secure Our Homeland Homeland Security Exceptions Worksheet Screenshot 46 Improving Access To Secure Our Homeland Homeland Security Applicable Standards Worksheet • Used as a documentation template Image fills this entire area – Reminder to include Section 508 in other generic project documentation – Possibly unused until later in the life cycle – Copy and paste into your requirements documents – Do not edit or modify standards (OR originates at the upper left corner of the area outlined and is sized to the full width or height of this bounding box.) 47 Improving Access To Secure Our Homeland Homeland Security Functional Performance Criteria • Requires at least one mode of operation and information retrieval for EIT that can be used by persons with the following impairments: – – – – § 1194.31(a & b) Vision (blind and low vision), § 1194.31(c & d) Hearing (Deaf and hard of hearing), § 1194.31(e) Speech & Communication OR § 1194.31(f) Fine Motor Control • Remember § 1194.31 Functional Performance Criteria – Always apply – Are met by complying with the Section 508 technical standards 48 Improving Access To Secure Our Homeland Homeland Security Subpart B – Technical Standards • Your role includes identifying EIT as categorized by the technical standards: – § 1194.21 Software applications and operating systems (Windows, Microsoft Word / Excel) – § 1194.22 Web-based information and applications (Web pages, linked documents, forms, Internet and intranet applications) – § 1194.23 Telecommunications (telephones, voicemail systems) – § 1194.24 Video and multimedia (broadcasts, videotapes, webcasts) – § 1194.25 Self contained, closed products (copiers, plotters, fax machines, kiosks) – § 1194.26 Desktop and portable computers (laptops, desktops, PDAs) 49 Improving Access To Secure Our Homeland Homeland Security Applicable Standards Screenshot 50 Improving Access To Secure Our Homeland Homeland Security Market Research Form • Compliance requires market research Image fills this entire area – Custom, commercial, or free – Section 508 compliance requires documenting analysis of alternatives – Summarizes additional documentation required (OR originates at the upper left corner of the area outlined and is sized to the full width or height of this bounding box.) 51 Improving Access To Secure Our Homeland Homeland Security Solution Engineering Planning Requirements Definition Requirements Definition Design Development Integration & Test Implementation – Initial planning complete, now at requirements definition Operations & Maintenance Stage 1: Solution Engineering & Planning - done Stage 2: Requirements Definition • Project managers typically – – – – Complete their initial research Finish clarifying requirements with stakeholders Have a desired approach Have selected the desired technologies 52 Improving Access To Secure Our Homeland Homeland Security Exiting Requirements Definition To fulfill the Section 508 requirements of this section you need to: 1. Review and, if needed, update the preliminary work you have done for requirements definition. 2. Copy and paste the identified applicable Section 508 standards from the Applicable Standards Worksheet into the project’s requirements documents. 3. Complete market research for procurements. 4. Ensure Section 508 compliance is required in contracts. 53 Improving Access To Secure Our Homeland Homeland Security Solution Engineering Planning Requirements Definition Requirements Definition Design Development Integration & Test Implementation Operations & Maintenance • Considerations – Updated Section 508 EIT Accessibility Plan • Request any Section 508 Exceptions • Identify the applicable Section 508 Technical Standards – Project’s Requirements Documents • Include Section 508 Functional Performance Criteria • Include Section 508 Technical Standards • Requirements Traceability Matrix – Market Research for Most Compliant Products 54 Improving Access To Secure Our Homeland Homeland Security Section 508 Contractual Requirements • DHS Accessibility Requirements Tool (DART) – – – – – Provides required Section 508 contract language Copy and paste into contract “AS IS” Do not modify or simplify. This is legal language! Link on the OAST website under “OAST Component Resources” http://dhsconnect.dhs.gov/org/comp/mgmt/cio/oast/ • Information Technology Acquisition Review (ITAR) • OAST Assistance Available – accessibility@dhs.gov 55 Improving Access To Secure Our Homeland Homeland Security DART Screenshot 56 Improving Access To Secure Our Homeland Homeland Security Design & Development Requirements – requirements defined,Design now atDevelopment design andIntegration development Planning Implementation Definition & Test Solution Engineering Operations & Maintenance Stage 2: Requirements Definition - done Stage 3: Design & Development • All developed or customized EIT must be fully Section 508 compliant • Documents, Plans, Schedules & Rework includes Section 508 – Technology plan might have changed during development – Development bug fixes, defect tracking, testing • Code to the Standards – Standards-based approach is best practice 57 Improving Access To Secure Our Homeland Homeland Security Exiting Design & Development To fulfill the Section 508 requirements of this section you need to: 1. Ensure the Systems Acceptance Test Plan show Section 508 requirements and how they will be tested 2. Have all human interfaces tested for Section 508 3. Have all training and user documentation tested for Section 508 4. Remediate Section 508 issues as identified 5. If you do not have a defect tracking system, you can use the sample Section 508 Remediation Plan for defect tracking 58 Improving Access To Secure Our Homeland Homeland Security Systems Engineering Life Cycle • Developed or Customized IT must be fully compliant – If it doesn’t meet criteria for an exception, must be compliant – Section 508 has technical requirements that must be included with each new version release – Ongoing development testing includes scheduling and fixing defects before release 59 Improving Access To Secure Our Homeland Homeland Security Project Plan Timelines • Project Plans must include Section 508 – Include: • Time for evaluation • Section 508 in customer acceptance tests • Section 508 EIT Accessibility Plan items in planning milestones 60 Improving Access To Secure Our Homeland Homeland Security Ongoing Daily Development • Planned Integration and Software Development Life Cycle – Remediation plan • Tracks defects • Verifies development team notified of defects • Supports development teams that do not have external bug tracking systems for stakeholders • Dates are key information 61 Improving Access To Secure Our Homeland Homeland Security Solution Engineering Planning Requirements Definition About Testing Design Development Integration & Test Implementation Operations & Maintenance • Test using OAST approved testing methodologies • Ensure electronic documentation and electronic trainings, including webinars, meet Section 508 requirements • Code to the Standards 63 Improving Access To Secure Our Homeland Homeland Security CODE TO THE STANDARDS • Code to the standards – Benefits include flexibility, future-proofing, and technology best practices – Do not code to specific Assistive Technologies (AT) e.g., JAWS Screen Reader – Develop and code using standard APIs • Just because it works with JAWS does not mean it is Section 508 compliant – It may not work with other assistive technologies • If AT does not work with EIT that is coded to the standards; the deficit is in the AT Code to the Standards! 64 Improving Access To Secure Our Homeland Homeland Security Solution Requirements – Development Planningalmost done, time to test Engineering Definition • • • • Integration & Test Design Development Integration & Test Implementation Operations & Maintenance Stage 3: Design & Development - done Stage 4: Integration & Test The purpose of the Integration and Test Stage is to demonstrate that the solution developed satisfies all defined requirements (DHS SELC) Short area on plan, but key milestone for any development Section 508 testing and remediation should be completed before Integration Transitioning to operations and support 65 Improving Access To Secure Our Homeland Homeland Security Support for End-Users • Transition to Support Document – Notifies Help Desk of special configurations – Notifies Operations of special permissions or deployment issues – Includes communications to agency and staff To satisfy the requirements of the Integration and Test stage, you need to ensure that user help, administrator instructions and the help desk are aware of any custom configurations or workarounds needed until the vendor remediates the defects. 66 Improving Access To Secure Our Homeland Homeland Security Implementation & Operations Requirements – All aboard! Train is leaving! goes Integration live Planning Design Project Development Solution Engineering Definition & Test Implementation Operations & Maintenance Stage 1: Solution Engineering & Planning Stage 2: Requirements Definition Stage 3: Design & Development Stage 4: Integration & Test Stage 5: Implementation & Operations • Section 508 Remediation Planning • New design and development might still introduce new technologies 67 Improving Access To Secure Our Homeland Homeland Security Exiting Implementation and O&M To fulfill the Section 508 requirements of this section you need to: 1. Have a plan to handle Section 508 defects reported by users. 2. Ensure the help desk knows what to do if an issue is reported by user of assistive technology. 3. Ensure the help desk has TTY capabilities for deaf users. (1194.41c) 4. Use a Section 508 Remediation Plan to track and remediate issues that arise after deployment. 68 Improving Access To Secure Our Homeland Homeland Security Proactively Solving Issues Section 508 Remediation Plan – Tracks “defects” – Verifies development team is notified of defects – Is used to proactively ask vendors for compliant solutions – Must have timelines! 69 Improving Access To Secure Our Homeland Homeland Security Sample Remediation Plan 70 Improving Access To Secure Our Homeland Homeland Security Plan in Plain English • Last page of the 508 plan. • List of what needs to be done. • Helpful for nontechnical customers. • Links to plan stages 71 Improving Access To Secure Our Homeland Homeland Security Plan for Section 508 • Project Managers must have a Section 508 EIT Accessibility Plan that: – Meets DHS SELC requirements and ensures Section 508 compliance – Includes plan information and documentation that must be submitted in order to comply with Section 508 for each phase in a project’s EIT Life Cycle – Identifies points of contact (POC) and assignment of responsibility to specific individuals, as needed • A separate plan and set of artifacts is needed for each individual EIT project or distinct technology 72 Improving Access To Secure Our Homeland Homeland Security Plan Early • Identify your Section 508 Subject Matter Expert (SME) • Document market research • Buy the “Most Accessible” product that meets your business needs • CODE TO THE STANDARDS! • Test using OAST testing process 73 Improving Access To Secure Our Homeland Homeland Security Where To Go For Help Office of Accessible Systems & Technology Homeland Security Help is Available Component Section 508 Coordinator – Current List on OAST Website – DHSConnect / Organization / Components / Management / / Chief Information Office / Offices / Office of Accessible Systems – Or search DHSConnect for “OAST” DHS Accessibility Help Desk – 202-447-0440 (voice) – 202-447-5857 (TTY) – Accessibility@dhs.gov or http://accessibility.dhs.gov 75 Improving Access To Secure Our Homeland