Apply

Information Security Policy Review

Information Security Policy Review (ISPR) procedures provide formal methods for which Information Security Regulations, Standards, and Best Practices are conducted.

Accessibility and Section 508

Section 508 is a federal law that was adopted in California as California Government Code 11135 and further adopted by the California Community College System on January 1, 2003. The law mandates that all information and communication technology developed, procured, maintained, or used by state-supported, operated, funded, or administered programs and activities be accessible to people with disabilities. The law also establishes standards for what is considered accessible for Information and Communications Technology (ICT) (CCC Accessibility Administrator FAQs).

Furthermore, California state-funded agencies are responsible for ensuring that web content, non-web documents, and software comply with the Web Content Accessibility Guidelines (WCAG) 2.0, Level A, and Level AA (CCC Accessibility Policy, Standards, & FAQs).

As a result, the individual or business unit endorsing the ICT (Project Owner) shall attain a completed Voluntary Product Accessibly Template (VPAT) from all vendors being evaluated before ICT is purchased, procured, or otherwise adopted. VPATs must be reviewed and submitted along with their corresponding Jaggaer Requisition before the purchase is approved and a Jaggaer Purchase Order is created.

This standard is divided into the following sections below:

Addressing accessibility is a shared responsibility amongst several parties, including but not limited to, the Chancellor’s Office, California Community Colleges senior administrators, technology professionals, purchasers, human resources, and creators of ICT, including instructional materials. Each college district has the responsibility to comply with Section 508, using the guidance provided by the Chancellor’s Office (CCC Accessibility Administrator FAQs(link is external)).

Each of the following parties has a specific role throughout the Accessibility Assessment Process.

Project Owner

  • Possesses an appropriate level of understanding as to how the product will be used.
  • Requests a completed VPAT from the vendor.
  • Leads the assessment process.
  • Evaluates multiple like products.
  • Selects the most accessible of those products.

Disability Support Programs for Students (DSPS)

  • Assists the Project Owner with identifying potential challenges to accessibility.
  • Develops an Equally Effective Alternate Access Plan (EEAAP) should the product not meet 508 compliance.

Technology Services Compliance Liaison

  • Provides a blank VPAT to the Project Owner as needed.
  • Assists with the evaluation of VPATs.
  • Provides feedback to the Project Owner.
  • Verifies that all necessary ICT documentation is attached to the requisition.

The Accessibility Assessment Process is one of three processes required by the "Request for Information and Communication Technology (ICT)".

The defined process is as follows:

  1. The Project Owner asks a vendor for a completed VPAT.
    Note: If the vendor doesn’t have one, Purchasing can supply one to the Project Owner or the Project Owner can forward one from the Voluntary Product Accessibility Template (VPAT) section below.
  2. The Project Owner forwards a copy of the completed VPAT to Purchasing and their Technology Services Technical Liaison.
  3. The Technology Services Technical Liaison forwards the VPAT to the Technology Services Compliance Liaison.
  4. Upon review, the Technology Services Compliance Liaison returns comments and an overview of the evaluation process to the Project Owner.
  5. The Project Owner reviews the comments provided by Technology Services and assesses Tables 1 and Table 2 in the VPAT.
  6. The Project Owner schedules a remote demo so that the vendor can satisfactorily demonstrate the product’s compliance with Section 508.
    • If a remote demo is not possible, the Project Owner shall provide Technology Services with an appropriate technical contact so demo software can be installed locally.
    • The Project Owner may ask DSPS to attend a demo to assist with identifying potential issues.
  7. After testing is complete and the most accessible product is selected, the Project Owner provides Purchasing with either:
    • An attestation that due diligence has been performed on their part and the ICT is compliant to the best of their knowledge, or
    • An EEAAP from DSPS if the product does not meet Section 508 standards.
  8. The Requisitioner attaches the preferred vendor’s VPAT and the Project Owner’s attestation/ EEAAP to the corresponding requisition.

ICT requests are approved by Technology Services only after:

  1. The accessibility evaluation process defined above is complete.
  2. The Technology Services Technical Liaison has provided and approved a technical assessment, and
  3. The product has completed a Vendor Risk Assessment.

A VPAT is a detailed report that explains how well ICT products meet current 508 standards and is an integral part of the product research and evaluation process. If a vendor does not already have a VPAT prepared, the Project Owner can provide them with the following links:

Once the VPAT is returned from a vendor, it must be reviewed.

The VPAT Assessment Process

WCAG 2.0 Level A and AA compliance reports are contained in Tables 1 and 2 (Success Criteria, Level A and Success Criteria, Level AA respectively). As the Project Owner reads these two tables, they must ask the following question for each, and every criterion listed:

Is the Success Criteria relevant to the functionality required of users (i.e., how they will be using it) and if so, will the answers listed in the Confirmation Level and associated Remarks/ Explanations columns hinder or prevent users from performing the expected task?

 To answer that question effectively, the Project Owner must:

  1. Have an appropriate understanding of how the software will be used (i.e., what the user will be required to do), and 
  2. Ensure that functionality gets tested.

Testing is essential; otherwise, identifying areas that may present challenges, need accommodations or require equitable alternatives are not possible.

If a vendor cannot adequately demonstrate a product’s accessibility features from a remote location, then demo software should be installed to vet it.

To help determine whether accommodations or equitable alternatives are necessary, the Project Owner may ask for assistance from DSPS. If accommodations or equitable alternatives are necessary, the Project Owner shall work with DSPS to create an EEAAP.

It is important to note that if accommodations are necessary but cannot be provided, the ICT may be used but cannot be required. Instead, students, personnel (those representing or working on behalf of the District), and/or community members must be provided with an equitable alternative.

Basic Tests to Evaluate Accessibility

The following tasks should be tested first to get an idea of the general state of a product’s accessibility.

  • Can the tab-key be used to navigate to and from all interactive elements, including hyperlinks, form fields, and buttons?
  • Can hyperlinks be activated with the Enter/Return key?
  • Can buttons be activated with the Spacebar or Enter/Return key?
  • If a form field’s text label is clicked on, does the cursor move into that form field?
  • If the product contains audio or video:
    • Are there controls to pause or stop the playback?
    • Do audio files have transcripts?
    • Do videos have captions?
  • For any blinking, scrolling, or moving content, are there controls to pause, stop, or hide that content?
  • Does any content flash more than three times in a one-second period?
  • If using a website, can you zoom in 200% without loss of content or functionality?

If the software fails any of these basic tests, it is not WCAG 2.0 compliant. Conversely, there is no guarantee that the software is compliant just because it passes the above tests: software must be fully vetted to identify potential accessibility issues. 

Products that cannot be made accessible or only meet some of the standards are eligible for consideration only if they can be accommodated in an equally effective manner. Additionally, items that are not intended for the general public, such as routers and firewalls, are exempt from these standards.

However, products that cannot be accommodated in an equally effective manner are not considered responsive, and as such, are not eligible for consideration or award of the contract or purchase order (CCC Accessibility Purchaser FAQs).

It is Irvine Valley College's obligation to provide the most accessible solution. As a result, given a choice between like products, those with greater accessibility shall take precedence.

Vice President of College Administrative Services, serves as Section 508 Compliance Officer and provides guidance in the areas of developing, procuring, maintaining, and using ICT products and services within the college.