Section 508 Compliance: A Complete Guide for Government Contractors

Section 508 of the Rehabilitation Act requires federal agencies to make their electronic and information technology accessible to people with disabilities. Since the 2018 Section 508 Refresh, the technical standard has been aligned with WCAG 2.0 Level AA — and practically speaking, meeting WCAG 2.1 AA satisfies Section 508 technical requirements. If your organization sells software, SaaS, or digital services to the federal government, Section 508 compliance is a contract requirement, not optional.

Who Section 508 applies to#

• All federal agencies purchasing or developing ICT (information and communications technology)
• Federal contractors developing ICT products for agency use
• Organizations receiving federal funding who develop digital products for use by federal employees or the public
• Vendors responding to federal RFPs that include ICT components

What Section 508 covers#

The standard covers a broader scope than just websites:

• Web content and web applications
• Software (desktop and mobile applications)
• Operating systems
• Hardware (kiosks, multifunction devices, printers)
• Telecommunications products
• Video and multimedia content
• Electronic documents (PDFs, Word, Excel, PowerPoint)
• Support documentation and services

What is a VPAT and when do you need one#

A Voluntary Product Accessibility Template (VPAT) — also called an Accessibility Conformance Report (ACR) — is a structured document that describes how well your product meets Section 508 and WCAG standards. Federal procurement officers require VPATs before purchasing ICT products. A VPAT is not a certification; it is a self-assessment (though credible VPATs are based on independent testing). There are four VPAT templates: 508 (federal), WCAG (international), EU (European Accessibility Act), and INT (combined). Most federal vendors should produce the 508 or INT version.

The DHS Trusted Tester program#

The Department of Homeland Security's Trusted Tester Certification is the most recognized credential for Section 508 testing in the federal ecosystem. DHS Trusted Testers follow a standardized testing process that produces consistent, reproducible results. Federal agencies increasingly require that Section 508 audits be conducted by Trusted Tester-certified professionals. All of our Section 508 auditors hold active Trusted Tester certifications.

How to prepare for a Section 508 audit#

• Inventory all ICT components in scope — web, mobile, desktop, documents, hardware
• Run an initial automated scan to identify the most obvious issues
• Test with assistive technologies: JAWS + Chrome, NVDA + Firefox, VoiceOver + Safari
• Remediate critical keyboard and screen reader barriers first
• Document your testing process and findings in a VPAT
• Establish a maintenance process — Section 508 compliance is not a one-time event