Section 508 · DHS Trusted Tester · WCAG 2.2 AA

Section 508 Compliance, Tested Under the Government’s Own Methodology

The DHS Trusted Tester program is the federal government’s own Section 508 test methodology. Harbor’s evaluator holds that certification (TT-2606-09221), tests your product by hand against WCAG 2.2 AA, and signs the VPAT/ACR that federal and state procurement teams ask for, at a flat fee, on a committed date. You do not need a conforming product to start. Almost nobody has one.

Book a 15-Minute Call

DHS Trusted Tester TT-2606-09221
Named, DHS-certified evaluator on every report
Manual + automated testing
E&O insured

Section 508 has governed federal procurement for decades. What’s new is DOJ’s Title II web rule: state and local governments must meet WCAG 2.1 AA, entities serving 50,000 or more by April 26, 2027, smaller ones and special districts by April 26, 2028, and the rule covers content vendors provide on their behalf. Government buyers at every level are starting to ask for the documentation federal agencies always have.

Sound Familiar?

A federal RFP requires Section 508 conformance documentation you don’t have
An agency’s accessibility office reviewed your VPAT and pushed back
A state or local customer flagged DOJ’s Title II deadlines and asked where you stand
Your current VPAT was self-assessed, and you’re not sure it would survive a 508 review

Before You Compare Quotes

Four numbers worth knowing if this is your first accessibility audit. None of them are about us.

About 30 of 55

Criteria a Tool Cannot Decide

WCAG 2.2 has 55 Level A and AA success criteria. Most of them turn on judgement a scanner cannot make, such as whether alt text is correct rather than merely present. Automated testing is where an audit starts, not where it ends.

$100 to $350

Per Page, How Most Bill

Per-page pricing is the common model, so your page count drives your fee. A store with 300 products on one layout is 300 pages under that model. Ask any provider whether they count pages or templates before you compare two quotes.

$500 to $12,500

The Published Range

That is the span of publicly listed prices across the providers on our comparison page, and the conformance document is often billed separately on top. Quotes vary this widely because scope definitions do.

28%

Of Vendors Have One Ready

We checked 107 recognizable software companies for a conformance report a buyer could actually read. Fewer than a third could produce one without a form or a sales call. The full finding is published.

New to this? The buyer’s guide explains what you are actually paying for, why two quotes for the same site can differ tenfold, and the questions worth asking any provider, including us.

Competitor figures read from each provider’s own published pages on 2026-08-04, and re-checked quarterly. Our own figure is not among them: we size an engagement on a fifteen-minute call and fix it in writing before you commit.

How It Works

Step 1

Scope by Template Count

Section 508 scope is counted in unique templates, and the price of each tier is published, so the line item for your solicitation response can be written before you contact us. Email the template list and you get a written scope, a start date, and a committed ACR delivery date. A call is optional.

Step 2

Trusted Tester Audit + Fix Guides

Manual evaluation of every unique template against WCAG 2.2 AA by the DHS-certified evaluator, with keyboard and screen reader testing throughout, plus visual fix guides your developers can act on immediately.

Step 3

Signed VPAT/ACR

A conformance report in VPAT 2.5 format covering Section 508, WCAG, and EN 301 549, signed by the named Trusted Tester who performed the audit and formatted for procurement.

One flat fee, scoped by the count of unique templates and fixed in writing before you commit. Fifteen minutes on a call establishes it. How engagements work. Delivery date committed at signing, not estimated: signed ACR by Day 21 on a Focused engagement (Day 45 on Standard, Day 60 on Professional), backed by automatic late-delivery credits.

Where This Sits in the Market

Overlays and automated scans run a few hundred dollars a year and judge only the part of WCAG a machine can judge. Procurement reviewers know this and send those reports back.
Budget VPAT shops publish rates: the document itself from around $350, on top of a per-page audit that commonly totals $1,250 to $2,750. That buys a filled-in template covering a sample of screens, usually with no named evaluator and no committed date. If your buyer just needs a document in the vendor file, buy that one.
Enterprise accessibility vendors do genuinely excellent work, and their reports carry real weight. They also sell annual platform-and-services contracts that commonly start in the tens of thousands and run into six figures, because that is the business they are in.
Harbor is the rung between. One report, one flat fee, every template tested by hand by a named DHS-certified evaluator whose certificate number is published so your reviewer can read it, on a date committed at signing. Priced for a company that needs one deal unblocked, not a platform subscription.

Figures are competitors’ own published list prices where they publish at all. Most firms at this tier and above quote privately. See the full comparison.

Book a 15-Minute Call

What You Receive

VPAT® 2.5 ACR (INT edition: Section 508, WCAG 2.2, EN 301 549) formatted for publication
Machine-readable OpenACR export, the open ACR format developed for GSA
Publishable accessibility statement
Visual fix guides with annotated screenshots for every finding
Follow-up reviews of remediated pages, with a re-issued ACR after each (2 on Focused, 3 on Standard and Professional, 5 on Enterprise)
Up to 90 days of post-delivery email support

Want to see the real thing first? Read the sample VPAT/ACR and the sample remediation plan, published in full, or browse all deliverables.

Common Questions

What is a DHS Trusted Tester, and why does it matter here?: Trusted Tester is the Department of Homeland Security’s certification in the federal government’s own manual test process for Section 508 conformance. Many federal accessibility teams evaluate vendor products with that same methodology. When your ACR comes from a certified Trusted Tester (TT-2606-09221), the reviewer on the agency side recognizes the method, because it is theirs.
Does Section 508 apply to my company?: Section 508 directly binds federal agencies, and it reaches vendors through procurement: agencies are required to buy accessible technology, so the obligation shows up in your world as a documentation requirement in RFPs, renewals, and contract clauses. If you sell software or digital services to the federal government, expect to be asked for a current ACR. What a specific solicitation requires is a question for the contracting officer.
We sell to state and local governments, not federal. Does this still apply?: Increasingly, yes. DOJ’s 2024 rule under ADA Title II requires state and local government web content to meet WCAG 2.1 AA, entities serving 50,000 or more by April 26, 2027, smaller ones and special districts by April 26, 2028, and it covers content vendors provide on an entity’s behalf. Many states also apply their own 508-style procurement standards. The practical effect is that state and local buyers are starting to ask vendors for the same conformance documentation federal agencies do.
Is this different from your VPAT service?: Same engagement, described for different buyers. Our VPAT preparation service speaks to the document any procurement team asks for; this page is for vendors selling to federal agencies and other government buyers, where the test method itself is part of the evidence. Either way you get a manual WCAG 2.2 AA audit and a signed VPAT/ACR on a date committed at signing. Start from whichever page matches your deal.
Can we see what your evaluation actually finds?: Yes, on a real federal site. We ran the process against a public government homepage and published all of it, including the findings we discarded: A Worked Section 508 Evaluation. Automated analysis produced 25 candidate issues; 7 survived manual verification and 18 did not, and the page gives the reason for every one. That ratio is the part of the work you are actually hiring for.
How will our report hold up in an agency’s 508 review?: It arrives as the kind of evidence reviewers are looking for: testing performed under the government’s own Trusted Tester methodology, by a named certified evaluator, documented in the format procurement expects. Reviewers push back hardest on vendor-written, all-Supports VPATs; an independent report with credible Partially Supports remarks and specific remarks is what they expect to see. Each agency runs its own review and reaches its own conclusion, so what we stand behind is the accuracy and completeness of the evaluation and the report.

Talk to the Auditor, Not a Sales Team

You will be talking to Andrew Szigety, the accessibility consultant who runs your audit and signs your report. Fifteen minutes, no pitch, and you can end it owing nothing. We work out what counts as a template, what your deadline needs, and where your product is awkward, and you leave with a fee and a delivery date.

Book a 15-Minute Call

Harbor provides technical audits and conformance documentation, not legal advice. Consult counsel on how Section 508 and DOJ’s Title II rule apply to your business.