TL;DR: Government web compliance spans three overlapping worlds — accessibility (WCAG, ADA Title II, Section 508), privacy (cookie consent, privacy policies), and security (CISA, KEV, security headers). This glossary defines the 40-plus terms that show up in audits, vendor reports, statutes, and procurement documents, in plain language. Each entry is one to three sentences, and many link to a deeper article. Bookmark it and hand it to anyone on your team who has to read an accessibility report or respond to a complaint.
If you manage a government website, you’ll encounter an alphabet soup of acronyms and standards across accessibility, privacy, and security. Vendor reports cite “SC 1.4.3,” procurement asks for a “VPAT,” your security team mentions the “KEV catalog,” and a constituent complaint references “ADA Title II.” This glossary defines the terms a public-sector web manager actually needs, in plain language, with links to deeper explainers where they exist. Terms are alphabetized; related concepts are grouped where it helps.
A
ADA Title II
The part of the Americans with Disabilities Act that applies to state and local government (“public entities”). The Department of Justice’s 2024 final rule under Title II requires government websites and mobile apps to conform to WCAG 2.1 Level AA, with compliance deadlines of April 24, 2026 for entities serving 50,000 or more people and April 26, 2027 for smaller entities and special district governments. See the Title II 2026 deadline explained and Section 508 vs. ADA Title II.
Alt text
Short for “alternative text” — a text description of an image, supplied via the HTML alt attribute, that screen readers read aloud. Required by WCAG SC 1.1.1 for all meaningful images; decorative images get an empty alt="". See how to fix missing alt text.
ARIA
Accessible Rich Internet Applications — a set of HTML attributes (like aria-label, role, and aria-describedby) that supply accessibility information to assistive technology when native HTML isn’t enough. The first rule of ARIA is to use native HTML when you can; misused ARIA often makes things worse. See using ARIA labels correctly.
Assistive technology (AT)
Software or hardware that disabled people use to access digital content — screen readers, screen magnifiers, switch devices, voice control, and braille displays. WCAG conformance is about whether your site works with AT.
axe
A widely used open-source accessibility testing engine (from Deque Systems) that powers many browser extensions and automated tools. Like all automated scanners, it catches mechanical issues but only a fraction of total WCAG problems — see automated vs. manual testing.
C
CISA
The Cybersecurity and Infrastructure Security Agency, the federal agency responsible for U.S. cybersecurity guidance and coordination. CISA publishes free resources and the KEV catalog (below) that government web teams should track. See CISA cybersecurity for government websites.
Color contrast ratio
The measured difference in luminance between text and its background, expressed as a ratio (e.g., 4.5:1). WCAG SC 1.4.3 requires at least 4.5:1 for normal text and 3:1 for large text at Level AA. Low contrast is one of the most common automated findings. See color contrast on government websites.
Conformance
The state of meeting all applicable requirements of a standard. WCAG conformance is claimed at a level (A, AA, or AAA) and requires that every applicable success criterion at that level passes — conformance is all-or-nothing per page, not a percentage.
Continuous monitoring
The practice of automatically and repeatedly checking a website for compliance issues over time, rather than testing once. It’s how government teams catch regressions — like a newly published photo with no alt text — before they become complaints. See continuous compliance monitoring.
Cookie banner
The consent notice that asks visitors to accept or reject cookies. For government sites, requirements depend on what cookies you set (analytics, embeds) and which privacy laws apply. See government website cookie banner requirements.
Core Web Vitals
Google’s set of three user-experience performance metrics: Largest Contentful Paint (LCP) for loading, Interaction to Next Paint (INP) for responsiveness, and Cumulative Layout Shift (CLS) for visual stability. They affect both usability and search ranking. See Core Web Vitals for government websites.
D
DOJ (Department of Justice)
The federal department that enforces ADA Title II for state and local governments, issues the rules that set WCAG as the standard, and investigates accessibility complaints against public entities.
K
KEV (Known Exploited Vulnerabilities)
A catalog maintained by CISA listing security vulnerabilities that are being actively exploited in the wild. Because these are confirmed real-world threats, they’re the highest-priority items to patch on any government system. See CISA Known Exploited Vulnerabilities.
L
Level A / AA / AAA
The three WCAG conformance levels. Level A is the minimum (the most basic barriers), Level AA is the standard target for government sites and what ADA Title II and Section 508 require, and Level AAA is the highest and is generally not required site-wide. When someone says “WCAG 2.2 AA,” they mean all Level A and AA criteria.
M
Mixed content
When a page served over HTTPS loads some resources (images, scripts, stylesheets) over insecure HTTP. Browsers may block these resources or warn users, breaking the page and undermining the security of the encrypted connection. See mixed content issues on government websites.
O
OCR (Office for Civil Rights)
A name shared by two relevant offices. The Department of Education’s OCR enforces Section 504 and ADA obligations for schools, colleges, and universities, including website accessibility — see OCR web accessibility in higher education. (OCR can also stand for optical character recognition, the technology that converts scanned-image PDFs into readable text — context tells you which is meant.)
OMB
The Office of Management and Budget, which issues government-wide policy directives to federal agencies, including digital experience and accessibility guidance.
OMB M-23-22
A 2023 OMB memorandum, “Delivering a Digital-First Public Experience,” directing federal agencies to make their websites and digital services accessible, fast, mobile-friendly, and user-centered. It operationalizes the 21st Century IDEA Act. See OMB M-23-22 and digital experience policy.
P
POUR
The four foundational principles of WCAG: content must be Perceivable, Operable, Understandable, and Robust. Every success criterion falls under one of these principles. See what WCAG is.
PDF accessibility
The set of requirements that make PDF documents usable with assistive technology — tagged structure, reading order, alt text on images, and real (not scanned-image) text. Inaccessible PDFs are a top source of government accessibility complaints. See PDF accessibility for government websites.
R
Remediation
The work of fixing identified accessibility (or security) defects. A remediation plan prioritizes findings by severity and impact and assigns owners and timelines, turning an audit’s list into an actionable roadmap. See building an accessibility remediation plan.
S
Screen reader
Software that reads on-screen content aloud (or sends it to a braille display) for blind and low-vision users. Common screen readers are JAWS and NVDA (Windows) and VoiceOver (Apple). Testing with a real screen reader is essential because automated tools can’t evaluate the spoken experience.
Section 504
A section of the Rehabilitation Act of 1973 prohibiting disability discrimination by entities that receive federal funding — including public schools, universities, and many state and local programs. It’s a major reason educational institutions must make their websites accessible.
Section 508
The part of the Rehabilitation Act requiring federal agencies to make their electronic and information technology accessible. Section 508 incorporates WCAG 2.0 Level AA as its technical baseline. It applies to federal agencies (and their vendors), distinct from ADA Title II’s coverage of state and local government — see Section 508 vs. ADA Title II.
Security headers
HTTP response headers that instruct browsers to enforce security protections — such as HSTS (force HTTPS), Content-Security-Policy (control what can load), and X-Content-Type-Options. Missing security headers are a common, easily fixed weakness on government sites. See security headers for government websites.
Severity
A rating (often critical / serious / moderate / minor) assigned to an accessibility finding based on how badly it affects users, how many users it affects, and how often the affected component appears. Severity drives remediation order.
Success criterion (SC)
An individual, testable requirement within WCAG, each with a number and a conformance level — for example, SC 1.4.3 Contrast (Minimum), Level AA. WCAG 2.2 AA comprises roughly 55 success criteria. Audit reports map every finding to a specific SC.
V
VPAT (Voluntary Product Accessibility Template)
A standardized document in which a vendor reports how their product conforms to accessibility standards (WCAG, Section 508), criterion by criterion. Government procurement teams request VPATs to evaluate whether software they’re buying is accessible. See VPATs in government procurement.
W
WCAG (Web Content Accessibility Guidelines)
The international technical standard for web accessibility, published by the W3C. WCAG 2.2 is the current version; government compliance targets Level AA. WCAG is organized under the POUR principles and broken into success criteria. See what WCAG is, the WCAG 2.2 AA checklist, and what changed from 2.1 to 2.2.
WebAIM Million
An annual automated accessibility analysis of the top one million website homepages, published by WebAIM. It’s widely cited for showing that the large majority of homepages have detectable WCAG failures — a useful directional benchmark, though it only measures automatically detectable issues.
A Few More Terms You’ll Hear
21st Century IDEA Act
A 2018 federal law (Integrated Digital Experience Act) requiring federal websites to be accessible, consistent, mobile-friendly, and user-centered. It’s the statutory backbone behind OMB M-23-22. See the 21st Century IDEA Act.
Accessibility statement
A public page on your site describing your accessibility commitment, the standard you target (WCAG 2.2 AA), known limitations, and how to report a problem. Increasingly expected and sometimes required. See how to write an accessibility statement.
Audit
A point-in-time evaluation of a website against an accessibility standard, combining automated scanning and manual testing, producing a report of findings mapped to success criteria and severity. See what a web accessibility audit is and how to conduct one.
Focus indicator
The visible outline or highlight showing which element currently has keyboard focus. WCAG SC 2.4.7 requires it to be visible. See keyboard accessibility.
HTTPS / TLS
The encrypted protocol (HTTP over TLS) that protects data between a visitor’s browser and your server. Government sites should serve everything over HTTPS; serving resources over plain HTTP creates the mixed-content problems described above.
Keyboard accessibility
The requirement (WCAG SC 2.1.1) that all functionality be operable using a keyboard alone, without a mouse — essential for people with motor disabilities and screen reader users. See keyboard accessibility for government websites.
Landmark
An ARIA or HTML5 region (like <nav>, <main>, <header>) that lets screen reader users jump directly to major page areas. Proper landmarks dramatically improve navigation.
Captions
Synchronized text for the audio in a video, required by WCAG SC 1.2.2 so deaf and hard-of-hearing users can follow the content. Auto-generated captions usually need human correction to be accurate. See video captions for government websites.
Compliance terminology spans accessibility, privacy, and security because a modern government website has to be defensible on all three fronts — and the same page can carry a WCAG failure, a tracking cookie set without consent, and a missing security header all at once. Knowing the vocabulary is the first step; staying on top of it across a constantly changing site is the hard part. Govzu continuously monitors government websites across accessibility, privacy, security, and performance — translating these terms into a live, prioritized picture of where your site stands and what to fix next — so your team isn’t decoding an audit report once a year, but acting on plain answers every day.