§ Government IT·5 min read·June 24, 2026

Section 508 Accessibility Compliance for Government Web Applications: A Remediation Checklist

A federal agency failed 38% of its web pages in a GSA audit. Here is the operational checklist that closes those gaps before they become contract liabilities.

IT Custom Solution Team·Office of the Director · IT Custom Solution LLC

A 2023 GSA Section 508 compliance assessment found that fewer than half of federal agency websites fully met WCAG 2.1 Level AA criteria. One agency's public-facing portal failed on 38% of sampled pages, primarily due to missing alternative text, broken keyboard navigation, and inadequate color contrast. The remediation effort took four months and required rework on components that had already passed internal QA. That outcome is avoidable with a structured pre-launch and ongoing audit process.

This checklist is organized by remediation priority. Work through it in order: structural issues compound downstream problems, so fixing them first reduces rework on interactive components and dynamic content.

Phase 1: Automated Baseline Scan

Run automated tools before any manual review. Automation catches roughly 30 to 40 percent of WCAG failures and establishes a documented baseline for contract deliverables.

Tools to run: axe-core (browser extension or CI pipeline integration), Lighthouse accessibility audit, IBM Equal Access Checker. Run all three; each surfaces different failure classes.
Output requirement: Export results as JSON or CSV. Log each violation with page URL, WCAG success criterion, severity, and element selector. This log becomes your remediation backlog.
Threshold to set: Zero critical violations (axe severity: critical) before any page moves to user acceptance testing.

Phase 2: Document and Page Structure

Structural issues affect every assistive technology user simultaneously. Fix these before addressing component-level problems.

Page title: Every page must have a unique, descriptive <title> element. Generic titles like "Home" or "Page 1" fail WCAG 2.4.2.
Heading hierarchy: Confirm one <h1> per page. Heading levels must not skip (e.g., <h2> directly to <h4>). Use a browser extension like HeadingsMap to visualize the tree.
Landmark regions: Pages must include <main>, <nav>, <header>, and <footer> landmarks. Screen reader users navigate by landmarks; missing them forces linear page traversal.
Language attribute: The <html> element must carry a valid lang attribute (e.g., lang='en'). Inline language changes (e.g., a French phrase in an English page) require lang on the containing element.
Skip navigation link: A "Skip to main content" link must be the first focusable element on every page. It may be visually hidden until focused.

Phase 3: Images and Non-Text Content

Informative images: Every <img> conveying information needs an alt attribute that describes the content, not the file name. "chart showing Q3 budget by agency" is correct; "image001.png" is not.
Decorative images: Set alt='' (empty string, not absent) so screen readers skip them.
Complex images (charts, graphs, maps): Provide a text equivalent either inline below the image or via a linked description page. An aria-describedby pointer to a nearby <figure> caption is acceptable if the caption is sufficiently detailed.
Icon fonts and SVGs: Icon fonts used without visible text labels must carry aria-label or aria-hidden='true' plus a visually hidden text alternative. Inline SVGs must include <title> and, for complex graphics, <desc> elements.
CAPTCHA: If used, provide an audio alternative. Better practice for government applications is to replace CAPTCHA with server-side bot detection.

Phase 4: Color and Visual Presentation

Contrast ratio, normal text: Minimum 4.5:1 against background (WCAG 1.4.3). Test with the WebAIM Contrast Checker or Colour Contrast Analyser desktop app.
Contrast ratio, large text: Minimum 3:1 for text 18pt or 14pt bold.
Non-text contrast: UI components (input borders, focus indicators, button outlines) and informational graphics must meet 3:1 against adjacent colors (WCAG 1.4.11).
Color as sole indicator: Never use color alone to convey status. Error states must include an icon or text label in addition to a red border.
Text resize: Zoom to 200% in browser. No content should be clipped, obscured, or require horizontal scrolling on a standard viewport.

Phase 5: Keyboard Navigation and Focus Management

Keyboard accessibility is the most common failure category in federal audits. Test every interaction without a mouse.

Tab order: Focus must move in a logical sequence matching the visual layout. Use tabindex='0' to add non-interactive elements to tab order only when necessary; avoid positive tabindex values.
Visible focus indicator: The focused element must have a clearly visible outline. Browser defaults are often insufficient. Define a custom focus style with at least 3:1 contrast against the surrounding color.
Keyboard traps: Focus must never be locked inside a component (e.g., a modal that cannot be closed with Escape). Test every modal, drawer, and overlay.
Custom widgets: Dropdowns, date pickers, sliders, and carousels must implement the ARIA Authoring Practices Guide (APG) keyboard patterns. A custom dropdown that opens on click must also open on Enter and Space, and close on Escape.
Focus management on dynamic content: When a modal opens, focus moves to the first interactive element inside it. When it closes, focus returns to the trigger element.

Phase 6: Forms

Label association: Every input, select, and textarea must have a programmatically associated <label> using for and id attributes. Placeholder text does not substitute for a label.
Error identification: Inline errors must be associated with the field via aria-describedby. The error message must identify the field and describe the required correction.
Required fields: Mark required fields with aria-required='true' and a visible indicator. Do not rely solely on an asterisk without a legend explaining its meaning.
Autocomplete: For fields collecting personal data (name, address, email), add the appropriate HTML autocomplete attribute value per WCAG 1.3.5.

Phase 7: Dynamic Content and ARIA

Live regions: Status messages (form submission confirmations, search result counts) that appear without a focus change must use role='status' or aria-live='polite' so screen readers announce them.
ARIA roles and states: Audit all aria-* attributes. Incorrect ARIA is worse than no ARIA. Common errors: aria-expanded not toggling on open/close, role='button' on a <div> without keyboard event handlers, aria-hidden='true' on focusable elements.
Timeout warnings: Sessions with timeouts must warn users at least 20 seconds before expiration and allow extension (WCAG 2.2.1).

Phase 8: Manual Testing with Assistive Technology

Automated tools cannot replace AT testing. Allocate time for the following combinations, which reflect the most common federal user configurations per the WebAIM Screen Reader Survey:

JAWS with Chrome on Windows
NVDA with Firefox on Windows
VoiceOver with Safari on macOS
VoiceOver with Safari on iOS (for mobile-accessible applications)

Test each critical user workflow end to end: login, form submission, navigation to key content, and any data table interaction.

Documenting Conformance

Produce a Voluntary Product Accessibility Template (VPAT) using the current ITI template (version 2.5 or later). A VPAT is required for most federal procurements. Each WCAG criterion must be marked Supports, Partially Supports, Does Not Support, or Not Applicable, with plain-language remarks. Vague entries like "partially supports" without explanation will be challenged during procurement review.

Takeaway

Section 508 remediation is cheaper before launch than after. Build the automated scan into your CI/CD pipeline, assign WCAG criterion ownership to specific developers, and schedule AT testing as a sprint gate, not an afterthought. The checklist above covers the failure categories that appear most frequently in federal audits; working through it systematically reduces the risk of a post-award finding that triggers contract penalties or rework mandates.

If your team is preparing a web application for a federal contract or needs a gap assessment against current 508 standards, reach out for a brief consult. IT Custom Solution works with government contractors and agencies on accessibility audits, VPAT preparation, and remediation planning from our office at 420 Lexington Avenue, Suite 1402, New York, NY 10170.

#section-508#accessibility-compliance#wcag#federal-it#web-remediation#government-contracting

§ Need a quote?

Tell us about the work.

IT Custom Solution delivers cybersecurity, cloud, managed IT, and custom software for federal, state, and local agencies.

Contact →Request a quote →