State Agency Website Compliance Checklist

TL;DR: State agencies are public entities under ADA Title II and must meet WCAG 2.1 AA (target 2.2 AA) by April 24, 2026 — and unlike a single city site, an agency typically owns a portfolio of sites, subdomains, applications, and vendor systems. The compliance problem is therefore one of inventory and governance as much as code: you need a complete asset inventory, VPAT-driven procurement (Section 508-style), centralized accessibility and privacy standards, and continuous monitoring across the whole estate. This checklist is organized for portfolio-scale compliance, not a single site.

State government has a structural compliance challenge that local government doesn’t: scale and sprawl. A single state agency may operate a primary .gov site, dozens of program subdomains, legacy applications on different stacks, microsites for campaigns and grants, and a long tail of third-party SaaS platforms (licensing, benefits, payments, GIS). All of it is covered by ADA Title II and the 2024 DOJ web accessibility rule, which sets a hard April 24, 2026 deadline for states (the 50,000+ population tier always applies at the state level).

This state agency website compliance checklist is built for portfolio-scale reality. It covers the asset inventory you need first, accessibility to WCAG 2.2 AA, Section 508-style procurement with VPATs, privacy under state law, security, and the cross-agency governance that makes any of it sustainable. It’s the state-tier companion to the city and county checklist and the public library checklist, and a deeper-scoped relative of the general government website compliance checklist.

Section 1: Build a Complete Web Asset Inventory (Do This First)

You cannot make compliant what you cannot see. The single most common reason state agencies fail to meet the deadline is that no one has a complete list of the sites and applications they’re responsible for. Forgotten subdomains, decommissioned-but-still-live microsites, and shadow-IT SaaS purchases are where complaints originate.

• Enumerate every domain and subdomain the agency controls (pull DNS records, certificate transparency logs, and analytics property lists).
• Catalog every web application (benefits portals, licensing systems, e-filing, payment flows) and its hosting/stack.
• List every third-party SaaS platform offered to the public on the agency’s behalf, with vendor and contract owner.
• Identify orphaned/legacy sites — campaign microsites, old program pages — and decide: remediate, redirect, or decommission. Killing dead sites is legitimate remediation.
• Assign an accountable owner to each asset. No owner means no remediation.
• See continuous compliance monitoring and state IT web portfolio management for keeping this inventory current.

Section 2: Confirm the Standard and Deadline

• State entities fall in the 50,000+ tier: the deadline is April 24, 2026.
• The legal technical standard is WCAG 2.1 Level AA; adopt WCAG 2.2 AA as the portfolio standard since it supersedes 2.1.
• Note the relationship to Section 508: 508 governs federal agencies and uses WCAG 2.0 AA via the Revised 508 Standards, while ADA Title II governs states — but the 508-vs-Title II distinction matters because much state procurement language and many vendor VPATs are framed around 508.
• If your agency receives federal funds or runs federally funded programs, Section 504 accessibility obligations also apply.
• Be aware of federal direction-of-travel like OMB M-23-22 (delivering a digital-first public experience) and the 21st Century IDEA Act; states frequently mirror these expectations even where not directly bound.

Section 3: Accessibility (WCAG 2.2 AA) — Apply Across the Portfolio

These are the same WCAG checks as any site, but the discipline at state scale is applying them consistently across every property via shared design systems and templates rather than site-by-site.

• Adopt or align to a statewide design system / accessible component library so accessibility is built into reusable patterns (USWDS-style or a state equivalent).
• Meaningful images have alt text; decorative images use alt="" (SC 1.1.1).
• Videos have accurate synchronized captions (SC 1.2.2); audio has transcripts.
• Body text meets 4.5:1 contrast; UI components 3:1 (SC 1.4.3, 1.4.11); content reflows at 320px/400% zoom (SC 1.4.10).
• Full keyboard operability with visible, unobscured focus (SC 2.1.1, 2.4.7, 2.4.11).
• Forms have associated labels, accessible errors, and correct autocomplete — see accessible government forms. State benefits and licensing forms are high-stakes; treat them as priority-one.
• PDFs (regulations, reports, notices) are tagged and OCR’d where scanned — see PDF accessibility. Prefer HTML for high-traffic content.

Section 4: Procurement — VPATs and Section 508-Style Contracting

State agencies buy far more web functionality than they build. Procurement is therefore the highest-leverage compliance control you have. State IT procurement rules in most states already require accessibility conformance and VPATs; the failure mode is not enforcing them.

• Require an accessibility conformance report (VPAT 2.x) for every web-facing product before purchase or renewal.
• Read VPATs critically: a VPAT is a vendor self-assessment, not certification — see the VPAT procurement guide. Treat “partially supports” as a defect to be scoped, not a pass.
• Include enforceable accessibility clauses in RFPs and contracts: WCAG 2.1/2.2 AA conformance, remediation timelines, acceptance testing, and remedies for non-conformance. The compliance tool procurement guide provides reusable language.
• Make accessibility a scored evaluation criterion, not pass/fail boilerplate.
• Test the delivered system in your environment with assistive technology before acceptance — the contracted product and the deployed configuration differ.
• Track vendor defects and timelines centrally so the same vendor isn’t re-bought across agencies with known, unresolved barriers.

Section 5: Privacy and State Law

• Publish a clear, current privacy policy per property (or a consistent statewide policy) covering collection, use, retention, and rights.
• Map obligations under applicable state privacy laws — many states have enacted comprehensive privacy statutes, and several have specific provisions for government data.
• Implement cookie consent where required and audit third-party trackers, which proliferate across large portfolios.
• Ensure agency systems handling sensitive program data (health, benefits, tax) meet sector-specific privacy/security rules in addition to the website baseline.
• Constrain vendor data use in contracts: storage location, access, breach notification, and prohibitions on secondary use.

Section 6: Security

• Enforce HTTPS with HSTS across every property; redirect HTTP. Inventory and monitor all certificates — sprawl means certs expire silently on forgotten subdomains.
• Apply baseline security headers via shared platform configuration where possible.
• Patch CMSs, frameworks, and dependencies on a defined cadence across the portfolio; eliminate end-of-life stacks.
• Follow CISA guidance for government websites; use .gov and DNS protections.
• Enforce MFA and least-privilege on all admin/CMS access; centralize identity where feasible.
• Run periodic vulnerability scanning across the full domain inventory, not just flagship sites.
• Decommission and securely archive end-of-life properties rather than leaving them online and unmaintained — abandoned sites are both a security and an accessibility liability.

A Realistic Sequencing for the 2026 Deadline

Portfolio-scale compliance can feel paralyzing. A pragmatic order of operations keeps the program defensible even when full conformance across hundreds of assets isn’t achievable by April 24, 2026:

1. Inventory and ownership — you cannot defend a program against assets you’ve never listed. Finish this first.
2. Triage by traffic and stakes — remediate the public-facing, high-traffic, transactional properties (benefits, licensing, payments, tax) before low-traffic informational pages.
3. Fix the design system once — accessibility built into shared templates and components remediates many sites at once and prevents new regressions.
4. Enforce procurement clauses on every renewal in the window so you stop adding inaccessible vendor systems.
5. Document the rest — a written, prioritized remediation plan with timelines and conforming-alternate-version commitments is itself evidence of good faith. DOJ and OCR look for a credible program, not instant perfection across an entire state estate.
6. Turn on continuous monitoring so the portfolio doesn’t regress the day after you finish.

Section 7: Cross-Agency Governance

At state scale, governance is the compliance program. Code fixes don’t stick without standards, ownership, and monitoring that span the whole estate.

• Establish (or align to) a statewide web accessibility policy with the WCAG 2.2 AA standard, owners, and reporting.
• Designate an agency accessibility coordinator and a chain to the state CIO/CDO office.
• Publish an accessibility statement with a barrier-reporting mechanism on each property.
• Mandate accessibility training for content authors and developers across agencies.
• Centralize a remediation and VPAT/vendor register so progress is reportable to leadership and auditors.
• Deploy continuous, automated monitoring across the entire portfolio so new pages, subdomains, PDFs, and vendor changes are caught the day they ship. Manual audits cannot keep pace with a multi-site estate — see continuous compliance monitoring for government and state IT web portfolio management.

For a state agency, compliance is fundamentally a coverage problem: the risk isn’t the flagship site your team watches closely — it’s the forgotten benefits microsite, the unpatched legacy app, and the inaccessible licensing portal a vendor updated last quarter. A point-in-time audit of a portfolio this large is obsolete the moment it’s finished. Govzu continuously crawls every site and subdomain across your agency’s web estate, surfaces accessibility, privacy, and security regressions as they appear, and gives state IT and accessibility leaders a single, time-stamped view of compliance across the whole portfolio — the evidence you need to manage the 2026 deadline and hold vendors accountable afterward.