2009-Q-11225QuestionsAnswers.doc

Questions and Answers – Reference Solicitation No. 2009-Q-11225

Questions:

1. What are the main drivers for rewriting of this system? (i.e. a technology upgrade, performance, etc.)

2. What are the CDC accessibility requirements? Anything beyond Section 508?

3. Is there an online listing of the CDC security requirements available for our review?

4. Are we allowed to use third party components that have developer-based licensing (vs. per user fees or royalties)?

Answers:

1. The main drivers are 1) improved compatibility with new versions of Windows, especially Vista and Windows 7; and 2) Future maintainability by removing reliance on the SwiftSoft OCX libraries.

2. Section 508 covers all of the accessibility requirements

3. CDC follows the NIST vulnerability assessment procedure. The security requirements are available from the NIST website.

4. Developer-based licensing is acceptable as long as there is no special user-based licensing or royalties on the finished product.

Questions:

1. Requirement #2 - "Any other changes must be approved by NIOSH" Does this include migrating away from a 3rd party control, specifically the Infragistics controls? Many of the features provided by that control can be replaced with the latest version of Visual Basic .NET.

2. Requirement #4 - CDC security and accessibility requirements.

Does the current product already support this standard?

Where can we get/reference this standard?

3. Requirement #7 - simulated age range to be increased to the maximum supported by the estimation standard.

Could you please explain why the current application limits the age selection to 70 and what is the maximum age to be supported?

Answers:

1. A change in 3rd party controls does not need to be approved, as long as it meets the functional requirements. The salient requirements are that the controls provide the same functionality as the current version of the program, that the controls install seamlessly with the rest of the application, that they require no additional license or royalty from the user, and that NIOSH will be provided with all libraries and source needed to maintain, update, and re-compile the program. If the functions can per performed in VB .net without the use of third party controls, that would be a desirable simplification and would not need approval.

2. The accessibility requirements are in Section 508 of the Rehabilitation Act (see http://www.section508.gov). The current program is only partially compliant with Section 508. The primary security requirement is that the system contain no vulnerabilities. CDC follows the vulnerability standards provided by the National Institute for Standards and Technology (NIST): http://nvd.nist.gov

3. The current version is limited to 70 years because the initial focus was on working populations and the ISO 7029 standard only goes up to 70 years. However, the formulas are not age-limited, so we would like to support ages to 100 years.