Section 508 testing for software vendors
If a US federal agency, or a contractor selling to one, asked for your "508 VPAT", they want an Accessibility Conformance Report on the Revised Section 508 edition of the VPAT® (or the INT edition, which includes it). This page explains what that report covers, what testing it needs, and where the rules come from.
What Section 508 requires, and of whom
Section 508 of the Rehabilitation Act requires federal agencies to make the information and communication technology (ICT) they develop, buy, maintain or use accessible to people with disabilities (section508.gov: laws and policies). The law binds the agencies, not you. It reaches vendors through procurement: the Federal Acquisition Regulation tells agencies to buy accessible ICT (FAR subpart 39.2), so they ask vendors for an ACR before they buy. GSA's guidance for buyers says "To be considered for award, the ACR must be complete" (section508.gov).
The technical rules are the Revised 508 Standards, published by the US Access Board in January 2017. For web pages, documents and software interfaces they adopt WCAG 2.0 Level A and AA by reference.
What the Section 508 edition of the VPAT contains
The VPAT 2.5Rev Revised Section 508 edition (free from ITI) has these parts:
| Part | What it covers | For a typical web app |
|---|---|---|
| WCAG 2.0 tables (Level A and AA) | Every WCAG 2.0 success criterion. These rows also answer 508 sections 501.1, 504.2 and 602.3. | The bulk of the testing. |
| Chapter 3: Functional Performance Criteria | Whether people can use the product without vision, with limited vision, without hearing, with limited manipulation, and so on (302.1 to 302.9). | Answered from the same testing, with a remark for each. |
| Chapter 4: Hardware | Physical devices: kiosks, keypads, reach ranges. | Usually not applicable; the report says so. |
| Chapter 5: Software | Interoperability with assistive technology (502), applications (503) and authoring tools (504). | Section 501.1 exempts web apps that have no access to platform accessibility services, and include no components that do, from 502 and 503, if they meet WCAG 2.0 A and AA. Authoring rows apply if users create content. |
| Chapter 6: Support Documentation and Services | Your help pages, documentation and support channels (602 and 603). | Applies: help docs must be accessible and say how to use the accessibility features. |
GSA adds that "Only Level A and AA are required in an ACR intended to inform U.S. federal procurement", and that federal sales need the Revised Section 508 or INT edition (section508.gov: how to create an ACR). If you also sell to universities or companies that want WCAG 2.1 or 2.2, the INT edition covers both in one report.
What "Section 508 compliance testing" actually involves
ITI does not review or approve VPATs, and no single test makes a product permanently "508 compliant". Testing produces evidence: a dated report of how the product conformed, criterion by criterion. For a web app that means:
- automated scans of every screen in scope, which catch some problems but cannot judge many criteria;
- keyboard-only testing of every user flow;
- screen reader testing (for example NVDA with Firefox, or VoiceOver with Safari);
- checks of zoom, contrast, forms, error messages and time limits;
- a review of your help documentation for Chapter 6.
GSA's own testing guidance recommends this mix: automated tools "augment manual testing", and some requirements "must be tested manually" (section508.gov testing overview).
When an agency wants a DHS Trusted Tester
The Department of Homeland Security runs the Trusted Tester program, a standard test process for Section 508 based on the ICT Testing Baseline, with certification for individual testers. Not every buyer requires it, but some agencies do for certain work: the EPA, for example, wants custom software tested by a certified Trusted Tester.
Plain ACR does not offer Trusted Tester-certified testing. If your solicitation requires it, tell us in the quote form and we will say so before you pay anything, so you can go to a provider who has it.
Our Section 508 edition report
We test your web app and write the VPAT 2.5 Revised Section 508 edition (or the INT edition, which also covers WCAG 2.2 and EN 301 549): 1,990 USD for up to 15 screens or key flows, in 5 business days. You get the report in Word and PDF plus the list of issues found. How our testing works.