Section 508 Compliance Testing and Attestation
Section 508 of the Rehabilitation Act of 1973 requires that digital content be accessible to people with disabilities. Compliance is not limited to federal agencies; it applies to any organization operating a public-facing website. Elevate Consult performs manual Section 508 testing using Department of Homeland Security (DHS)-certified Trusted Testers and delivers a formal attestation of conformance against the World Wibe Web Consortium (W3C) Web Content Accessibility Guidelines (WCAG 2.0) Level AA.
Automated scanning tools catch approximately 30% of accessibility issues. The remaining 70% require manual testing by a trained human reviewer. An automated report is not a Section 508 attestation.
Accessibility is a legal obligation, not a best practice
Section 508 of the Rehabilitation Act requires that electronic and information technology be accessible to people with disabilities. The governing technical standard is WCAG 2.0 Level AA ; a set of success criteria covering perceivability, operability, understandability, and robustness of digital content. The government treats public-facing websites similarly to physical storefronts: accessibility is a legal requirement, not optional. Organizations that fail to meet Section 508 requirements face legal exposure under the Rehabilitation Act and, in some cases, the Americans with Disabilities Act (ADA).
OMB Memorandum M-24-08, issued December 2023, reinforced these obligations by establishing immediate action requirements for federal agencies; including mandatory accessibility statements on all agency websites, public feedback mechanisms for reporting accessibility issues, and formal assessments of ICT accessibility policies. For federal contractors and technology vendors supplying agencies, this memo signals that agency buyers are under active OMB oversight to enforce accessibility in procurement, making supplier conformance more critical than ever.
For US-based technology vendors, SaaS providers, cloud operators, and managed service organizations entering the Spanish public sector market ( or already serving it ) ENS compliance is not optional. It is a contractual prerequisite that contracting officers enforce at the procurement stage.
WCAG 2.0
Level AA governing technical standard for Section 508 conformance
~30%
Accessibility issues detectable by automated tools the rest require manual review
DHS
Department of Homeland Security certifies Trusted Tester professionals
25%
of U.S. adults 61 million people have a disability, per CDC data cited in OMB M-24-08
Manual testing by DHS-certified Trusted Testers
Most accessibility vendors rely primarily on automated scanning. Elevate performs manual testing using the DHS Trusted Tester methodology the same standard used by federal agencies to validate Section 508 conformance. This is not a scan with a human summary attached. It is structured, reproducible, manual testing that captures the nuances automated tools cannot.
For US-based technology vendors, SaaS providers, cloud operators, and managed service organizations entering the Spanish public sector market ( or already serving it ) ENS compliance is not optional. It is a contractual prerequisite that contracting officers enforce at the procurement stage.
Elevate Consult
DHS Trusted Tester methodology
- Manual testing performed by DHS-certified Trusted Testers
- Structured, reproducible test process aligned with Section 508 Trusted Tester Program
- Captures nuances automated tools cannot detect: keyboard navigation flows, screen reader behavior, focus management, timing issues
- Formal attestation letter issued upon completion
- Remediation guidance included: walkthrough of what is needed to comply vs. what is currently in place
Automated-only testing
Common vendor approach
- Scan-based tools (axe, Lighthouse, WAVE) detect structural issues only
- Approximately 30% of WCAG 2.0 Level AA issues are detectable by automation
- Cannot evaluate keyboard navigation, focus order, or screen reader interaction
- Produces a report, not an attestation
- False sense of compliance — organizations assume clean scan equals conformance
Scope varies by site complexity and size
Every engagement is scoped based on the number of unique pages and the complexity of content present. Sites using consistent templates across pages can be tested more efficiently Elevate focuses on template-level differences rather than repeating identical test procedures across identical pages. Sites with video, audio, complex interactions, or dynamic content require more extensive testing.
Keyboard navigation and focus management
All interactive elements must be reachable and operable by keyboard alone. Focus order, focus visibility, and skip navigation links are evaluated against WCAG 2.0 Level AA criteria.
Screen reader compatibility
Content must be perceivable and operable with assistive technology. Elevate tests heading structure, ARIA labels, landmark regions, and meaningful link text elements automated tools frequently miss.
Images and non-text content
All images require appropriate alternative text. Decorative images must be marked as such. Complex images — charts, infographics, diagrams — require extended descriptions where needed.
Forms and interactive elements
Form fields require programmatic labels, error identification, and input assistance. Cookie banners, consent forms, and modal dialogs are tested as part of the interactive element review.
Color contrast and visual presentation
Text and interface components must meet WCAG 2.0 contrast ratios. Text over images, placeholder text, and disabled state contrast are evaluated manually.
Video and audio content
Prerecorded video requires captions and audio descriptions. Live video requires captions. Sites with multimedia content require additional scoping to address time-based media requirements.
Any organization with a public-facing website
Section 508 applies broadly. Federal contractors, agencies, and any organization operating a public website are subject to accessibility obligations. Organizations serving users who may include individuals with disabilities — which is essentially every public website — should treat conformance as a baseline operational requirement.
Federal agencies
Federal contractors
Public-facing organizations
SaaS and web app providers
Compliance and legal teams
Digital and IT leads
Two structured outputs from a single-phase engagement
Elevate’s Section 508 testing is a single-phase engagement. Upon completion, your organization receives two deliverables: a detailed findings report and a formal attestation letter. Elevate does not produce code for remediation, but provides clear, page-level guidance on what changes are required to achieve conformance.
Detailed findings report
Page-by-page findings organized by DHS Trusted Tester procedures aligned to WCAG 2.0 Level AA success criterion. Each finding identifies the specific issue, the element affected, the applicable criterion, and the remediation required to achieve conformance.
Attestation letter
Formal letter issued by a DHS-certified Trusted Tester attesting to the conformance status of the tested pages against WCAG 2.0 Level AA. This is the regulatory deliverable that demonstrates independent validation of your accessibility posture.
How organizations are using this service
Elevate’s Section 508 testing is deployed as a standalone engagement or as part of a broader compliance program where accessibility obligations intersect with privacy, data security, or federal contract requirements.
Elevate performed Section 508 Trusted Tester testing on Wipro HPS’s CMS EDE application as part of a broader compliance testing engagement. The review assessed conformance against WCAG 2.0 Level AA across the application’s pages, identifying accessibility gaps, and providing remediation guidance to support the client’s compliance program.
Wipro HPS — CMS Enhanced Direct Enrollment (EDE) Application
Common questions
Does Section 508 apply to our organization if we are not a federal agency?
Yes. Section 508 applies to any organization that operates a public-facing website. The government treats public websites similarly to physical storefronts — just as stores must meet accessibility requirements for individuals with disabilities, organizations with public websites are subject to the same obligations. Federal contractors are also directly subject to Section 508 requirements through their contract obligations.
Has federal enforcement of Section 508 increased recently?
Yes. OMB Memorandum M-24-08, issued December 2023, strengthened federal agency requirements around Section 508 compliance, mandating the establishment of agency-wide Section 508 programs, public accessibility statements, and formal complaint mechanisms across all federal websites. The memo also requires agencies to conduct comprehensive assessments of their ICT accessibility policies and make those policies publicly available. For vendors and contractors supplying technology to federal agencies, this increased oversight directly affects procurement evaluations — agencies are now required to validate Section 508 conformance before accepting deliverables. Organizations that cannot demonstrate conformance risk losing contract eligibility.
What is a DHS Trusted Tester and why does it matter?
The DHS Trusted Tester program is a certification process that qualifies testers to perform standardized, reproducible Section 508 conformance testing using a defined manual methodology. A Trusted Tester certification means the reviewer has been trained and tested by DHS on the correct application of WCAG 2.0 Level AA criteria. This matters because automated tools cannot replicate the manual evaluation required to confirm true conformance — and an attestation from a Trusted Tester carries regulatory weight that a scan report does not.
Why is manual testing necessary if we already ran an automated accessibility scan?
Automated tools detect approximately 30% of WCAG 2.0 Level AA accessibility issues. The remaining 70% require a trained human reviewer to evaluate: keyboard navigation flows, screen reader interaction, focus management, meaningful link context, and other criteria that tools cannot assess programmatically. A clean automated scan does not indicate conformance and cannot serve as an attestation.
How is the engagement scoped and priced?
Scope is determined by the number of unique pages on your site and the complexity of content present. Sites using consistent page templates across sections can be scoped more efficiently — Elevate tests at the template level and focuses review on pages that differ meaningfully from the base template. Sites with video, audio, complex forms, or dynamic content require additional scoping. Elevate assesses complexity during an initial discovery call before any engagement begins.
Does Elevate help with remediation after the testing is complete?
Elevate does not write code or build technical fixes directly. The detailed findings report provides clear, issue-level remediation guidance — specifying what needs to change and why, not just that a violation exists. Elevate can walk your development team through the findings and explain what conformance requires versus what is currently in place, providing the context your team needs to implement the changes independently.
Can we combine Section 508 testing with a privacy or cookie compliance review?
Yes. Elevate offers Section 508 testing as a standalone engagement or as part of a combined website compliance review that includes cookie compliance, privacy policy review, and accessibility testing in a single engagement. Organizations with overlapping obligations across accessibility and privacy frameworks often find the combined engagement more efficient.
GET STARTED
Ready to validate your website's Section 508 conformance?
Elevate Consult performs manual Section 508 testing using DHS-certified Trusted Testers and delivers a formal attestation of conformance against WCAG 2.0 Level AA.