Section 508
Definition
Section 508 requires federal agencies to buy, build and use accessible technology that meets the Access Board's Revised 508 Standards, which adopt WCAG 2.0 AA.
Section 508 is not optional for any software sold to or used by the federal government. The Revised Section 508 Standards (2017) align with WCAG 2.0 Level AA and cover web content, software, hardware, support services, and documents.
Key Section 508 requirements for software
- All UI components operable by keyboard alone (no mouse required)
- Screen reader compatibility (ARIA labels, semantic HTML, focus management)
- Sufficient color contrast (4.5:1 for normal text, 3:1 for large text)
- Captions for all video content; audio descriptions for visual-only content
- No content that flashes more than 3 times per second (seizure risk)
Testing for 508 compliance
Automated tools (axe, Lighthouse, WAVE) catch 30-40% of 508 issues. The remainder require manual testing with screen readers (JAWS, NVDA, VoiceOver) and keyboard-only navigation. Build 508 testing into CI/CD -- axe-core integrates with Jest and Playwright for automated accessibility regression detection.
Related terms
FedRAMP
FedRAMP is the U.S. government's standardized security authorization program for cloud services used by federal agencies, reusable across agencies once granted.
ATO (Authority to Operate)
An Authority to Operate (ATO) is the formal approval granted by a federal Authorizing Official that allows a software system to operate within a government environment after completing the NIST Risk Management Framework assessment process. ATOs are required before any federal system goes live and must be continuously maintained -- typically reviewed annually and triggered by significant system changes.
CMMC (Cybersecurity Maturity Model Certification)
CMMC is the DoD's certification program verifying that defense contractors protect federal contract information and controlled unclassified information.
HIPAA Software
HIPAA software is any application that creates, receives, maintains, or transmits Protected Health Information (PHI) and must comply with the HIPAA Security Rule's administrative, physical, and technical safeguards. Healthcare software companies that handle PHI must sign a Business Associate Agreement (BAA) with covered entities -- violations carry fines of $100-$50,000 per violation up to $1.9 million annually.
See how we implement this
Custom Application Development
Purpose-built software designed around your exact requirements.
Legacy System Modernization
Migrate, refactor, or replace aging systems without disrupting operations.
Security & Compliance
How we secure client systems, and how compliance requirements are scoped in the design phase on regulated builds.
AI Workflow Automation
LLMs and intelligent agents that eliminate repetitive work across your organization.
Need help implementing this in your business?
Code and Trust translates AI concepts like section 508 into working implementations, starting with a workflow audit that shows exactly where it creates ROI.
Schedule AI Audit →