Obtain Feedback from CMS

[ohsh6o]

Extended Description

As a 10x ASAP developer, to gauge the interest of federal agency adoption of these tools, I want to know if a federal agency stakeholder will consider a plan to adopt and use this tooling in their own processes.

Preconditions

• [ ] Confirm schedule availability of CMS contacts.

Acceptance Criteria

• [ ] Meet with CMS and receive feedback from the contact from using the app in their local installation by ~August 26th~ TBD.
• [ ] Discuss viability of collaborating with CMS teams on use of that tool with a draft OSCAL SSP (even if it is not FedRAMP-specific)
• [ ] Confirm with Andres that he would/would not be a partner in a Phase 4

Story Tasks

• [ ] Report meeting result and action items.

Definition of Done

• [ ] Acceptance criteria met - Each user story should meet the acceptance criteria in the description
• [ ] Unit test coverage of our code > 90% (from QASP) this may be fuzzy and hard to prove
• [ ] Code quality checks passed (from QASP)
• [ ] Accessibility: (from QASP) as we create guidance or documentation and reports (semantic tagging including aria tags): demonstrate with 0 errors reported for WCAG 2.1 AA standards using an automated scanner and 0 errors reported in manual testing
• [ ] Code reviewed - Code reviewed by at least one other team members (or developed by a pair)
• [ ] Source code merged - Code that’s demoed must be in source control and merged
• [ ] Code must successfully build and deploy into staging environment (from QASP): this may evolve from xslt sh pipline into something more
• [ ] Security reviewed and reported - Conduct vulnerability and compliance scanning. threat modeling?
• [ ] Code submitted must be free of medium- and high-level static and dynamic security vulnerabilities (from QASP)
• [ ] Usability tests passed - Each user story should be easy to use by target users (development community? FedRAMP FART team)
• [ ] Usability testing and other user research methods must be conducted at regular intervals throughout the development process (not just at the beginning or end). (from QASP)
• [ ] Code refactored for clarity - Code must be clean, self-documenting
• [ ] No local design debt
• [ ] Load/performance tests passed - test data needed - saxon instrumentation
• [ ] Documentation generated - update readme or contributing markdown as necessary.
• [ ] Architectural Decision Record completed as necessary for significant design choices

[ohsh6o]

Andres emailed me last night and indicated he is unable to make the 26 August 2021 meeting and I will be out the following week. Will need to discuss with the team how to handle this and how it will handle 18F#222.

[ohsh6o]

Superceded by 18F#238 to focus scope of effort after missed session with CMS.