Conformance to Section 508 isn't a "one and done." Technology, and user needs change over time. Just like in the InfoSec community, systems (aka EIT) change and with each change induces or reduces risk (aka Section 508 conformance).
Why not look at "conformance" to Section 508 as Risk Management. Over 350 million users in the USA have the capability of accessing our ICT/EIT, 35 million are known to have disabilities,
...more »
Conformance to Section 508 isn't a "one and done." Technology, and user needs change over time. Just like in the InfoSec community, systems (aka EIT) change and with each change induces or reduces risk (aka Section 508 conformance).
Why not look at "conformance" to Section 508 as Risk Management. Over 350 million users in the USA have the capability of accessing our ICT/EIT, 35 million are known to have disabilities, and several million of are also our peers in Federal Service. Every one of these users have within their power the ability under the law to file a complaint; they are each a potential risk. Some are a higher risk than others; some work for the Federal government, and that risk is (fortunately) growing as we become a more inclusive society.
Conformance to accessibility standards, just like FISMA compliance, is a moving target but can be effectively managed if we look at differently. In FISMA they 'certify' systems Risk. In FISMA they evaluate Risk proabistically, and apply resources accordingly. In FISMA, they require the documentation of the System to security standards, and permit Risk's as long as they are managed appropriately. And when they are not (Systems sometimes get compromised, Programs sometimes run out of money, and data unfortunately gets lost)...when they are not those Systems and their Owners are held accountible.
Why can't we 'certify' our ICT/EIT upon creation, track its ownership thru revisions, assign it a Risk (ie public facing with 350 million risk points, verse internal with 5000 risk points), validate the Risk using objective data (logs, trouble tickets, support requests, etc), and apply appropriate resources to the ICT/EIT over its lifetime. Under FISMA, you can't leave a System unpatched and public facing, why do we have dormant content (files, forms, etc) still out in the .gov space?
We need to think differently. Challenge our assumptions. Collect objective data. And build a national framework to better manage conformance of our ICT/EIT. Its been over a decade what we're doing is not working.
« less
full details »
Social Web