Digital TransformationUser Experience & Accessibility
By How a fixed-fee Section 508 conformance assessment takes one public-facing federal website or web application from scan reports and unanswered assessment questions to a risk register, Trusted Tester evidence for a defined sample, defects in the agency's own tracker and a remediation plan priced from real findings.
Every federal agency must make the information and communication technology it develops, buys, maintains or uses accessible to employees and members of the public with disabilities. That is Section 508 of the Rehabilitation Act, and it has applied for decades. What has changed is the evidence. The annual governmentwide Section 508 assessment asks agencies how they test, how they track defects and how they fix them, and many 508 program managers find they cannot back their answers with records.
The gap is rarely a lack of goodwill. A public-facing service ships with an automated scan report that looked clean. A complaint arrives from a screen reader user who could not finish a form. A vendor's Accessibility Conformance Report says "Supports" for every criterion, and nobody can check it. The inspector general asks how the agency tests, and there is no written method to show.
This paper is for the Section 508 program manager who carries the assessment response, the system or program owner who funds fixes from the system's operations and maintenance budget, the CIO or digital services lead who answers for the result, and the contracting officer and COR who buy and accept the work. It describes Avalon Technology Services' Accessibility Modernization service, which starts with one engagement:
The illustration later in this paper works through the cost model. The base case is a 20 pages sample over 6 weeks: 240 hours at a blended $95 to $165 an hour, or $22.8K to $39.6K, with a $31K planning fee, far under the $350,000 simplified acquisition threshold.
Avalon tests, documents and fixes. It does not certify Section 508 compliance, because no certifying body exists, and the conformance claim stays with the agency.
Any two of these phrases in one meeting usually mean the agency has an evidence problem, not only a code problem.
| What the program says | What it usually means |
|---|---|
| "Our assessment answers were mostly 'ad hoc.'" | No written test method, no defect tracking, no retest records |
| "We have one tester and a two-thousand-item backlog." | Findings were never collapsed into patterns or ranked by risk |
| "Every vendor VPAT we get says 'Supports' for everything." | Nobody on staff has time to test the vendor's claim |
| "The IG asked how we test and we didn't have an answer." | Testing happens, but the evidence does not survive |
| "We bought an overlay widget and the complaints didn't stop." | The underlying code still fails; a script on top does not change that |
| "A JAWS user couldn't finish the application." | A blocking defect sits on a high-traffic path |
| Driver | What it says | What it means for this engagement |
|---|---|---|
| Section 508, Rehabilitation Act (29 U.S.C. § 794d) | Federal ICT must be accessible to employees and members of the public with disabilities | The obligation the audit tests against |
| Revised 508 Standards, 36 CFR Part 1194 (2017 refresh, effective January 18, 2018) | Incorporates WCAG 2.0 Level A and AA for web content, documents and software | The legal baseline for every finding |
| WCAG 2.1 and 2.2 Level AA (W3C) | Current W3C guidance with added criteria for mobile, low vision and cognitive needs | Tested where agency policy sets it, and reported as a separate delta, not as the legal standard |
| Annual governmentwide Section 508 assessment (29 U.S.C. § 794d-1) | Agencies report on testing, remediation, tracking and training; GSA runs the program through section508.gov | The test records and defect register are the evidence those answers need |
| DHS Trusted Tester process and the ICT Testing Baseline | The government's own manual test method and baseline | The method the audit follows, so results are comparable across agencies |
| FAR Part 39 | ICT the government buys must meet the 508 standards unless an exception applies | Acceptance testing and ACR review on contractor deliverables |
| 21st Century IDEA Act (2018) and the U.S. Web Design System | Public websites must be accessible, consistent and mobile-friendly | USWDS components are a sound base, but an implementation still needs testing |
OMB M-24-08, Strengthening Digital Accessibility and the Management of Section 508, was issued in December 2023 and set expectations for program managers, accessibility statements and lifecycle integration. Agencies should confirm how they apply it today. One more point matters to security staff: Section 508 is a separate compliance track from security authorization. No NIST SP 800-53 control implements it, and accessibility evidence is not ATO evidence.
The engagement covers one named public website or web application and works in the agency's own environments, repositories and defect tracker.
| Step | Activities |
|---|---|
| Inventory and triage | Catalog the property's templates, key user paths and linked documents; rank by traffic, mission criticality, complaint history and legal exposure; agree and document the test sample |
| Automated scan | Open-source tools (axe-core, ANDI, Lighthouse) across the whole property to find repeatable failures quickly |
| Manual Trusted Tester pass | The agreed sample, typically 15 to 30 pages or screens: keyboard-only operation, focus order, contrast, forms and errors, multimedia captions, and screen reader checks |
| Defect register | Each failure mapped to a WCAG success criterion and Trusted Tester test condition, collapsed into unique patterns and exported to Jira, GitHub Issues or Azure DevOps |
| Remediation plan | Patterns ranked by user impact and effort, component-level fixes separated from page-level fixes, and a firm-fixed-price quote for the follow-on |
The audit tests to the Revised 508 Standards, which means WCAG 2.0 Level AA. Where agency policy or the solicitation sets WCAG 2.1 or 2.2 AA, the added criteria are tested too, and the report shows them in a separate column so the 508 PM can see the legal finding and the policy finding apart. Sampling follows the W3C evaluation methodology (WCAG-EM), so the report states exactly what was tested and when. Conformance is reported for the tested sample at that point in time, and for nothing beyond it.
Screen reader checks use NVDA on Windows and VoiceOver on macOS and iOS browsers, both available without a license. Where the agency requires JAWS or Dragon results, the agency provides the licensed seats or test machines, and the statement of work names the full assistive technology matrix before testing starts. Native mobile apps are out of scope; they belong to Avalon's separate Mobile Development service.
| Deliverable | Format |
|---|---|
| Property inventory and risk register | XLSX register and a two-page prioritization brief |
| Conformance audit report | Report with legal-baseline and policy-delta findings for the tested sample |
| Defect export | Tickets in the agency's tracker, mapped to WCAG criteria and test conditions |
| Trusted Tester test evidence | Test-condition results retained as records |
| Prioritized remediation plan | Plan with pattern counts, effort ranges and a priced follow-on |
The entry engagement stops at the remediation plan. Visual redesign is UI/UX Design, a moderated usability study is User Testing and Feedback Analysis, and a rebuild is Application Modernization; each is a separate Avalon service. Fixes to commercial products the agency licenses are the vendor's obligation, pursued through the contract. Legal determinations, complaint representation, serving as the agency's 508 program manager, and remediation of a document backlog by volume are out of scope.
The value of the engagement is evidence that holds up when someone asks how it was produced.
| Who asks | What the engagement gives them |
|---|---|
| Annual assessment data call | A written test method, a dated sample, a defect register with status and a remediation plan with owners |
| Release or launch gate | A conformance report for the tested sample, showing what passes and what remains |
| Complaint or IG question | Test records that show what was tested, how and when, for agency counsel to use |
| Contracting officer | An agency-side test method for checking a vendor's ACR claims against the product |
| Accurate | Not accurate |
|---|---|
| Documented conformance status against the Revised 508 Standards for the tested sample | Certified 508 compliant |
| Remediation of identified failures, with retest evidence | Guaranteed compliance |
| Test evidence against a defined method and sample | Conformance beyond the tested sample or date |
| An input to the agency's own conformance claim | Part of an ATO or a security authorization |
Overlay scripts deserve a direct word. A widget that adjusts a page in the browser does not make the underlying code conform, and screen reader users often turn overlays off. The audit tests the code the agency owns, with any overlay disabled, and the plan fixes that code.
| Phase | Timing | What happens |
|---|---|---|
| 0: Kickoff and access | Week 1 | Points of contact named, environments, repository and tracker access, test accounts for every role, sample method agreed in writing |
| 1: Inventory and triage | Week 2 | Templates and paths cataloged, risk ranking, test sample selected |
| 2: Conformance audit | Weeks 3–5 | Automated scan of the property and manual Trusted Tester pass on the sample |
| Plan and readout | Week 6 | Defect export, remediation plan, priced follow-on and readout |
| 3–5: Remediation, validation and ACR, sustainment (separate, conditional) | About 8–20 weeks | Two-week remediation sprints, retest, conformance report and ACR on the ITI VPAT template, pipeline checks and role-based training |
A single property typically runs 8 to 12 weeks end to end when remediation follows directly. The audit is Phases 0 to 2 only, bought as a standalone firm-fixed-price task. Remediation is quoted from the actual findings, then validation confirms what was fixed with the same method.
| Included | Separate work |
|---|---|
| One public website or web application | A portfolio of properties, or a native mobile app |
| Inventory of linked documents with a remediate, convert or retire recommendation | Document remediation by page volume |
| A priced remediation plan | Remediation, unless bought as the follow-on |
| Unclassified systems | Classified environments or cleared on-site work |
Avalon takes one engagement at a time, works business hours, and works on unclassified systems only. Avalon's founder leads the engagement. The accessibility test lead is named personnel, hired or subcontracted for the engagement and listed in the proposal with a résumé. Avalon has no past federal engagements under this service. FAR 15.305 says an offeror without a record of past performance may not be evaluated favorably or unfavorably on that factor; what protects the program is a named tester, a fixed price, a written sample and a small first engagement.
| Requirement | How it is handled |
|---|---|
| Accessibility test lead | Named personnel holding a current DHS Trusted Tester certification, listed in the proposal; IAAP credentials where the agency asks for them |
| Remediation engineers | Front-end engineers named before any remediation follow-on is bid |
| Civilian or DoD access | Named personnel whose investigation level matches the agency's requirements, as a condition of the engagement |
| Tools and assistive technology | Open-source test tools, NVDA and VoiceOver; licensed tools such as JAWS run on agency-provided seats; Avalon resells nothing |
| Insurance and contract vehicles | Any coverage the solicitation requires is a condition of award; Avalon does not hold a GSA Schedule or a governmentwide contract today |
Key personnel substitution requires CO approval. Reports, registers, test records and code delivered under the engagement belong to the agency, with data rights as the contract specifies.
| Engagement | Market-norm range | Avalon |
|---|---|---|
| Single public website audit, 20–30 sample pages | $20K–$60K | Firm fixed price; $18K–$35K for the base scope; illustrative $31K |
| Authenticated application audit, multiple roles | $40K–$120K | Firm fixed price against a named screen and role count |
| Rapid public-page scan | Not a standard band | Fixed fee under the $15,000 micro-purchase threshold; illustrative $5.7K–$9.9K |
| Remediation sprints | $95–$165/hr blended | Conditional follow-on, priced from the audit's findings |
| ACR authoring on the ITI VPAT template | $4K–$12K per product | Conditional follow-on after validation |
| Training | $2.5K–$8K per session | Conditional follow-on |
The audit sits under the $350,000 simplified acquisition threshold and can be bought as an open-market purchase. A rapid public-page scan fits under the micro-purchase threshold as a paid discovery step. Larger work can be subcontracted to Avalon by a prime. Avalon does not hold a GSA Schedule or a governmentwide contract today, and it does not resell software, assistive technology or licenses.
Accessibility fixes to a fielded system are usually funded from that system's operations and maintenance budget, which makes a six-week fixed-price audit a natural July-to-September purchase. Prices are fixed against one named property, a written sample size, a named role count and assistive technology matrix, and a dated dependency schedule. Compliance work is never priced on a share of outcomes.
The figures below are a planning illustration for one representative unclassified public website. They are not a quote and not a result from any engagement.
The test lead works at one-quarter time during kickoff and inventory and full time during the audit and the plan. The project manager works at one-quarter time throughout. All hours price at the blended $95 to $165 an hour band, a market-norm range for small-business accessibility work.
| Phase | Base weeks | Test lead | Project manager |
|---|---|---|---|
| Kickoff and inventory | 2 | 0.25 FTE | 0.25 FTE |
| Conformance audit | 3 | 1.0 FTE | 0.25 FTE |
| Plan and readout | 1 | 1.0 FTE | 0.25 FTE |
| Total hours | 6 | 180 | 60 |
| Scope | Weeks | Hours | Rate-band range | Planning fee |
|---|---|---|---|---|
| Base: public website, 20 pages | 6 | 240 | $22.8K–$39.6K | $31K |
| A: public website, 30 pages | 7 | 290 | $27.6K–$47.9K | $38K |
| B: authenticated application, 40 screens | 10 | 410 | $39.0K–$67.7K | $53K |
| C: rapid public-page scan | About 2 | 60 | $5.7K–$9.9K | Under $15K |
The base case is 240 hours, or $22.8K to $39.6K, with a $31K planning fee at the midpoint. That sits inside the $20K to $60K website band and inside Avalon's $18K to $35K audit price, but the top of the rate band does not: the base scope fits $35K only at about $146 an hour or less, which is why the statement of work fixes the sample at 20 pages. A 30-page sample with a four-week audit runs $27.6K to $47.9K. An authenticated application with 40 screens and several roles runs $39.0K to $67.7K over 10 weeks, near the floor of the $40K to $120K application band, because every role multiplies manual testing.
Remediation cost depends on unique defect patterns, not raw instances, and on how many sit in shared components. Nobody knows either number before the audit. At the same rates, one two-week sprint with 2 engineers is 160 hours, or $15.2K to $26.4K; the audit tells the agency how many sprints the findings need and which fixes in shared components close the most defects first. The same logic applies to documents: triage decides what to retire or convert before anyone pays per page to fix it.
| Pitfall | How to avoid it |
|---|---|
| The sample grows mid-audit | Name the property, sample size, roles and assistive technology matrix in the statement of work; additions by priced modification |
| A bottomless document backlog | Triage first; enumerate page counts for any remediation; never "as needed" |
| Compliance oversell | Report the tested sample at a point in time; no "certified" or "guaranteed" language |
| Agency-side access delays | Access, accounts and onboarding written as dated dependencies |
| Testing only what is reachable | Hold the audit until every in-scope role has a test account |
| Commercial product dead ends | Document the failures and route them to the vendor through the contract and its ACR |
| Overlay entanglement | Test with overlays disabled and fix the underlying code |
Most accessibility programs are not short on intent. They are short on evidence: what was tested, how, against which standard, and what is still broken.
The natural first step is the fixed-fee Section 508 conformance assessment: one public-facing service, about six weeks, under the simplified acquisition threshold, ending in a risk register, a conformance report for a defined sample, defects in the agency's own tracker and a priced remediation plan. To discuss a service, contact Avalon Technology Services at contact@AvalonTechServices.com.
ACR
Accessibility Conformance Report: a product's conformance statement, usually written on the ITI VPAT template.
Alteration
A change to legacy ICT that removes its safe harbor under the Revised 508 Standards.
ICT Testing Baseline
The federal baseline of tests used to check conformance with the Revised 508 Standards.
Trusted Tester
The DHS manual test process and the certification for testers who use it.
WCAG
Web Content Accessibility Guidelines from the W3C; version 2.0 Level AA is the Section 508 baseline.
WCAG-EM
The W3C methodology for selecting and documenting a representative evaluation sample.
All values are planning assumptions for one representative unclassified public website. None is drawn from a specific agency, a real system or a completed engagement.
| Assumption | Value | Basis |
|---|---|---|
| Property | One public website; 20-page manual sample | Planning assumption |
| Phases | Kickoff 1, inventory 1, audit 3, plan 1 week | Inside knowledge base phase ranges |
| Staffing | Test lead 0.25 then 1.0 FTE; PM 0.25 FTE | Knowledge base delivery model |
| Rate | $95–$165 an hour blended | Market-norm small-business band |
| Rapid scan | 60 hours | Planning assumption |
| Price check | Base fee $31K | Inside $20K–$60K and $18K–$35K; under the SAT |
