What Is Section 508 Compliance? A Guide for Federal Contractors
If your organization delivers digital products or services to the federal government, Section 508 compliance is not optional. It is a legal requirement that applies to every website, application, and electronic document used by or delivered to a federal agency.
What Section 508 Requires
Section 508 of the Rehabilitation Act requires federal agencies to make their information and communications technology (ICT) accessible to people with disabilities. This applies to websites, web applications, software, electronic documents (PDFs, Word, Excel, PowerPoint), and multimedia content.
The standard is enforced through procurement. When a federal agency contracts with a vendor, the deliverables must conform to the ICT Accessibility Standards published by the U.S. Access Board, which incorporate WCAG 2.0 Level AA success criteria.
In practice, most agencies and prime contractors now reference WCAG 2.1 AA as the minimum standard.
Who Must Comply
Section 508 applies to:
- Federal agencies and their employees
- Prime contractors delivering digital products to the government
- Subcontractors whose work is included in federal deliverables
- Software vendors whose products are procured by federal agencies
- Cities, counties, and universities receiving federal funding (under related DOJ enforcement actions)
If you are in the federal supply chain, your digital deliverables are subject to these requirements.
What Happens If You Do Not Comply
Non-compliance creates real consequences:
- Rejected deliverables — contracting officers can refuse to accept work that does not meet Section 508 requirements
- Delayed payments — acceptance is tied to compliance, and non-conforming work delays invoice approval
- Lost bids — prime contractors increasingly require 508 compliance evidence from subcontractors before awarding work
- Legal risk — DOJ enforcement actions against non-compliant organizations have increased significantly since 2022
- Reputational damage — accessibility failures reflect poorly on an organization's technical competence
How Compliance Is Validated
The Department of Homeland Security (DHS) developed the Trusted Tester process as the standard methodology for evaluating Section 508 compliance. Trusted Testers are certified professionals trained to evaluate digital content against a defined set of test criteria.
A Trusted Tester evaluation produces an Accessibility Conformance Report (ACR), which documents the conformance level of a digital product against each applicable WCAG success criterion. This report is typically prepared using the Voluntary Product Accessibility Template (VPAT) format.
The ACR is what government buyers use to evaluate a product's accessibility posture during procurement.
The Difference Between Automated and Manual Testing
Automated scanning tools can identify some accessibility issues — missing alt text, color contrast failures, broken ARIA attributes — but they only cover a subset of the requirements. The DHS Trusted Tester process includes 63 test criteria, and automated tools can reliably address approximately 42 of those 63.
The remaining 21 criteria require manual evaluation by a certified tester. These include keyboard navigation logic, screen reader behavior, meaningful alt text quality, and complex interaction patterns.
A full compliance evaluation requires both automated and manual testing.
How to Prepare
Organizations preparing for a Section 508 compliance evaluation should:
- Identify all digital properties in scope — websites, applications, documents, and multimedia
- Understand your contract requirements — review the solicitation or contract for specific 508 language
- Run an initial automated scan to identify obvious issues before committing to a full audit
- Remediate known issues before testing — fix alt text, heading hierarchy, form labels, and color contrast
- Engage an independent validator — an independent evaluation carries more weight with primes and contracting officers than self-assessment
Why Independence Matters
When the same firm that builds a product also certifies its compliance, there is an inherent conflict of interest. Independent validation eliminates that conflict. An independent evaluator has no incentive to overlook issues, and the resulting report is more credible to primes, agencies, and contracting officers.
Simkins & Elgazar is an independent Section 508 compliance validation firm serving federal contractors, cities, counties, and universities. We are DHS Trusted Tester certified and conduct all evaluations using federal testing methodology. Contact us to discuss your compliance needs.