Accessible ICT Procurement and Development

That is not always the case:

1. Each entity must do a third-party risk assessment. We do not lean on what any federal agency does. They have different abilities and services than we do. They have different support than we do. They go through a similar risk assessment process. They must get approval from their executive leadership. (per US Section 508 of the Rehabilitation Act of 1973)
2. Each entity is behind on following digital accessibility regulations. They have low digital accessibility program maturity. This was addressed in two official memorandums from the Office of Management and Budget (OMB) to all federal agencies in 2023:
   1. M-23-22: Delivering a Digital-First Public Experience: provides guidance to agencies on how to design and deliver websites and digital services to the public
   2. M-24-08: Strengthening Digital Accessibility and the Management of Section 508 of the Rehabilitation Act: provides guidance to help agencies advance digital accessibility by maintaining an accessible Federal technology environment, promoting accessible digital experiences, and continuing the implementation of accessibility standards in accordance with Section 508

That is not always the case:

1. Each entity must do a third-party risk assessment. Even within our System, we must each assess the risk. Each university has different abilities and services than we do. They have different support than we do. They go through a similar risk assessment process. They must get approval from their executive leadership. (per Texas Administrative Code, Chapter 213 and Title II of the Americans with Disabilities Act, Subpart H—Web and Mobile Accessibility)
2. Each entity is behind on following digital accessibility regulations. The US DOJ discusses this in the new rulemaking for ADA Title II in April 2024:
   1. Paragraph 692: "As history has demonstrated, requiring entities to comply with their nondiscrimination obligations without setting clear and predictable standards for when content must be made accessible has not resulted in widespread web and mobile app accessibility. The Department therefore believes it is critical to establish clear and consistent requirements for public entities to follow in making their web content and mobile apps accessible."
   2. Paragraph 928: "With subpart H, the Department is ensuring that people with disabilities generally will not have to request access to public entities' web content and content in mobile apps, nor will they typically need to wait to obtain that access. Given the Department's longstanding position on the accessibility of online content, discussed in section III.B and C of the preamble to the final rule, public entities should already be on notice of their obligations. If they are not, the final rule unquestionably puts them on notice."

If an ICT product or service is used for university business, it must be accessible. The third-party provider must give us appropriate accessibility documentation to assess that. The main goal of market research is to ensure third-party providers know our regulatory requirements and improve their ICT.

• If you were working, you should be able to continue to work whether you have or acquire a disability.
• If you were learning, you should be able to continue to learn whether you have or acquire a disability.

We can provide you with the introductory message to providers about accessibility documentation. Make sure to carbon copy the Digital Accessibility Officer. We can assist with technical questions directly when we are included in the request.

Whether you can find accessible ICT, it must be approved for acquisition by the Department of Information Technology (DoIT).

The intake form is in the Service Portal. Make sure the appropriate person is filling out the form. They need to know information about the third-party provider and the ICT, including:

• What the ICT product or service does*
• Whether it is cloud-hosted, on a local server, installed directly on a computer, or something else (e.g., hardware or a combination of hardware and software)
• Who DoIT can contact for support (e.g., email address, support portal)
• How much it would cost TAMU-CC or a member of the TAMU-CC community (e.g., student) required to purchase it to complete university business (e.g., work, research, education)
• Who and how many people would be using it
• What assistance is needed to renew, update, or implement the ICT
• What confidential information might be stored, transferred, or processed with it, if any
• What market research was completed to justify the acquisition in case there are liability risks

If the ICT is inaccessible, the answers on the intake form can be streamlined into the accessibility exception form.

* Executive leadership will often make the final decisions to acquire ICT. The answers on the intake form should be addressed to that audience. For example, the ICT description should be written as though the audience knows nothing about the product or service. What is it? What does it do? What business need does it serve?

Each area in DoIT reviews the submission request. The Digital Accessibility Officer reviews the accessibility documentation, if any is provided.

If the provider does not give us accessibility documentation, their ICT is automatically non-compliant. Providing accessibility documentation does not mean the ICT will be compliant.

What are the determinations after an accessibility documentation review?

1. Compliant:
   
   1. Occurrence: Rare
   2. Next steps: Move forward with acquisition.
   3. Cautions: Check that company will assist with ADA accommodation requests. EIR can still be inaccessible for some disabilities.
2. Non-Compliant:
   
   1. Occurrence: Very common
   2. Next steps: If liability risk is lower than business impact, submit an exception form. Justification must include market research. It must also build a case on how the liability risk is lower than business impact.
   3. Cautions: Exception form may not be approved. If exception is approved, it does not guarantee immunity for the university.
3. Exempt or holds an exception from accessibility standards compliance:
   
   1. Occurrence: Occasional
   2. Next steps: Move forward with acquisition.
   3. Cautions: Exemptions and exceptions can and will change in the future. As technology improves, some will be removed. Third-party providers cannot declare themselves exempt, only request exemption. Federal and state governments have lists of exemptions and exceptions.

Executive leadership will review:

• the accommodations and workarounds that can be provided if ICT is inaccessible
• the ways TAMU-CC or the third-party provider can make the ICT accessible
• the market research conducted that proves due diligence in selecting the ICT

If the ICT is rejected:

• the client will need to either end the acquisition request or
• transition to an alternative ICT product or service that has been approved for use

If the ICT is approved:

• the client will be approved to acquire the ICT product or service for the duration of the exception and
• the client will need to review marketplace options before the exception expires

The main goal is to educate the third-party providers of our regulatory requirements. These will become stricter in 2026. We want to ensure they are all informed ahead of time.

Employees are protected from job discrimination based on disability. They are not required to disclose their medical conditions.

Employees disclosing their medical conditions to their supervisor and human resources office may help them acquire reasonable accommodations. Yet they fear they will be discriminated against if they do disclose their medical conditions. This means you may work with people who have disabilities they have not disclosed.

Our TAMU-CC community is a diverse population. With disclosure not required, and the ability for any person to acquire a disability at any time, we assume our TAMU-CC community includes people with disabilities. This means all ICTs must be reviewed for compliance with accessibility requirements.

This depends on how much information we have on the ICT. Provide information early on about your ICT. If it is already in the IT Repository, we may request less information.

• If it is already reviewed, approval will be quick.
• If a previous exception has expired, you will be submitting a new exception for approval.

Best case scenario is a day or two. Worst case scenario may be a month or two. Delays typically come from the provider. Delays sometimes come if we need clarification about the ICT from you.

Note: The accessibility review is one part of the entire IT vetting process. Other IT areas may take longer or shorter time to review depending on the request. For example, a cloud-hosted solution that processes confidential information will need TX-RAMP certification.

We are required to acquire accessible ICT. If we do not, we must accept liability risk. Almost every government agency and university does procure inaccessible ICT. Some have stricter procurement policies. Our regulations will be requiring stricter procedures.

Many providers, including large corporations, still have inaccessible ICT. Some universities act as companies who provide ICT for acquisition. Many of those universities, including major universities, still have inaccessible ICT.

Many providers do not know about accessibility laws. Many providers are improving their accessibility but not there yet. Some accessibility issues are technologically impossible to resolve right now. Some take time to do more research and development. Our goal is to communicate the priority that digital accessibility has in the acquisition process.

The law makes our university accountable and liable to spread the word to third-party providers.

Their technical teams often do not have digital accessibility training. They do not know the legal requirements we must follow. For example, accessibility overlays are in the news for lawsuits. However, it is the companies who buy and use the accessibility overlays that are noted in the lawsuits, not the ones selling the overlays.

It is up to us to inform the providers, since it will affect our ability to use their ICT in the future. We provide them with educational materials. We point them to accessibility consulting companies that can assist them. We are often the first to tell them about digital accessibility.

If we do not inform them, it may impact our business relationships in the future. We must document the improvement of our ICT. If providers refuse to improve accessibility, we may have to end those relationships.

Some universities have already been forced to end relationships. The university and the provider may appear in the news, harming both their reputations. Companies may lose money when relationships end. Universities may lose federal funding and programs. Communities may lose services provided by universities.

A team effort to improve accessibility is important to continue these business relationships.

We do not want to get to that point. Our desire is to ensure business processes continue and strategic goals are met. But, that may mean looking into other alternatives if this ICT is rejected:

• Give yourself enough time to look at other options. The justification section in the exception form includes market research. You should have considered all alternatives when documenting that market research.
• Give yourself enough time to communicate a transition period. If you are switching to another ICT, determine what that will take. Who do you need to assist you with the transition? Discuss plans with DoIT. They may be able to help you with remediation or alternative accommodations.

No matter where ICT is in a project life cycle, accessibility checks are important. The provider should address their process in the Vendor Accessibility Development Services questionnaire. If you are developing ICT, consider these steps as well:

1. Plan: Determine where digital accessibility compliance will need to be addressed. Is content being created or an interface/layout being adjusted? Note those areas that will need review time.
2. Design: Some visual or usability aspects can be reviewed during the design process. These accessibility concerns include color choice, font size/choice, and layout spacing.
3. Develop: Some interactivity may need to be addressed. For example, how can a keyboard access all the options? How can a user tell where they are on an application? How can a user stop some interactive element from becoming too distracting?
4. Test: Many tools already have accessibility checkers to assist you with digital content. For example, Microsoft 365, Cascade CMS, and Adobe Acrobat DC Pro. Web browsers have accessibility tools or you can install plugins. However, automated tools do not address all accessibility issues. Some elements of accessibility will need to be manually checked. These are typically concerned with basic human understanding or context. For example, does the alternative text address the context of the image? Does the order of navigation make sense?
5. Maintain: Regularly check modifications to content or development. Technological advances may make some accessibility standards easier to include. That typically means adjusting some code or options to set those in motion.

This is an ongoing, cyclical process until the university is no longer using the ICT. For example, IBM's Equal Access Toolkit incorporates accessibility into their project life cycle.

Note that not all areas or elements may be accessible upon launch of the ICT. Ensure a roadmap is in place to address non-compliant items soon. One week after launch? Two weeks? Whatever the plan, the main goal is progress.