Per Nancy's request, here is the software component list described in the ICE presentation by HLN Consulting llc. with the corresponding VA-TRM assessment. As you see below, the two key components of OpenCDS - jBPM and Drools are prohibited from use in VA enterprise. However, looking at the assement, which is dated 2009, some of the mentioned risks are no longer valid. For example, "jBoss AS is prohibited" is listed under jBPM as a risk; but we know jBoss AS was approved in 2012.