Council briefing
Two deadlines every small town is facing.
Website accessibility by April 26, 2028, and what your cyber insurer now requires before it renews.
What this covers in fifteen minutes
1
Website accessibility
A federal rule with a date. What it requires, what usually fails on a town website, and the path to compliance.
2
Cyber insurance
What carriers now require before they renew, what a town risks without it, and how to get ready before the next renewal.
Both are fixable. Both cost less the earlier you start.
Civic & Main
2
The rule
April 26, 2028
The Department of Justice's Title II rule requires state and local governments to meet WCAG 2.1 Level AA on their websites and apps. That is the date for governments under 50,000 residents.
Who it applies to
Every city, town, county, township, and special district. There is no small-town exemption.
The date moved once
Extended in April 2026 from April 2027. Larger governments have until April 24, 2027.
Civic & Main
3
What counts as your web content
The town website
Every page, menu, and image.
Online forms and payments
Permit applications, utility bill pay, complaint forms.
Documents you post
Agendas, minutes, ordinances, budgets, permit forms.
Meeting recordings
Council video and audio need captions or transcripts.
Social media you control
Posts from the town's own accounts.
Vendor-run portals
Billing and permit systems a vendor hosts. The town is still responsible.
Limited exceptions cover archived content and some documents others posted before the deadline.
Civic & Main
4
WCAG 2.1 AA in plain English
| Requirement | What it means for a town website |
|---|---|
| Text alternatives | Every image, map, and logo has a written description a screen reader can speak. |
| Captions | Meeting videos carry captions or a transcript. |
| Contrast | Text is readable against its background, a measured ratio, not a judgment call. |
| Keyboard | Everything works without a mouse, including menus and forms. |
| Structure | Headings, labels, and links make sense when read aloud in order. |
| Documents | PDFs are real, tagged text with headings, not scanned pictures of paper. |
Civic & Main
5
Where most town websites fail today
Scanned PDFs of minutes and ordinances
Photos and logos with no text description
Light gray text on a white background
Drop-down menus that will not open from a keyboard
Forms with fields that have no labels
Embedded maps and videos with no alternative
None of these require a new website. All of them require someone to find them.
Civic & Main
6
Why start this year
Fixing takes months
Remediating documents and forms is slow work, and every web vendor's queue fills as the date gets close.
The obligation already exists
The date may move again in court. Title II has required accessible services since 1990, and complaints and demand letters do not wait for 2028.
The budget cycle
Next year's budget is being adopted now. An audit this year puts the fixes in next year's budget instead of a mid-year appropriation.
Civic & Main
7
The path to compliance
1
Audit
About two weeks. Every page, form, and posted document checked against the standard.
2
Plan
Findings ranked by severity, written so your web vendor can price the work.
3
Fix
Vendor or staff work through the list. Most items are small; documents take the longest.
4
Verify
Re-audit, publish an accessibility statement, and set a routine for new documents.
Audit in fall 2026. Remediate through 2027. Verified before April 2028.
Civic & Main
8
Small governments are targets, not bystanders
34%
of state and local governments were hit by ransomware in 2024
$2.83M
average cost to recover, more than double the year before
99%
of those hit saw attackers go after their backups
Attackers go where staff is thin. In a small town that means payroll, utility billing, and the records the clerk's office runs every day.
Source: Sophos, The State of Ransomware in State and Local Government 2024
9
What insurers now require before they renew
| Control | What it means for the town | What they ask to see |
|---|---|---|
| Multi-factor authentication | On email, remote access, and every admin account. Partial coverage counts as none. | MFA enforcement report |
| Endpoint detection and response | Modern protection on every computer and server, not signature antivirus. | Coverage report from the tool |
| Tested, offline backups | Copies an attacker on your network cannot reach, with a dated restore test. | Restore-test log |
| Written incident response plan | Who does what, who gets called, and proof it was exercised in the last year. | The plan and tabletop notes |
| Training and patching | Phishing awareness for staff, and updates applied on a schedule. | Completion and patch reports |
Civic & Main
10
What happens without them
Coverage
Applications denied or not renewed. Higher premiums. Ransomware limited to a fraction of the policy or excluded outright.
Claims
A control you said you had but did not can void a claim after an incident, when the town needs the money most.
Indiana law
Every political subdivision must report a cyber incident to the Indiana Office of Technology within 48 hours of discovery.
The insurer's checklist and the state's expectations point at the same five controls. Meeting one meets the other.
Civic & Main
11
The path to insurable
1
Assess
Accounts, backups, training, vendors, and policies checked against your carrier's own application.
2
Gap list
What fails, what it costs to fix, and in what order. Most gaps are settings, not purchases.
3
Policies and plan
A security policy set, an incident response plan, and a tabletop exercise with the people who would actually respond.
4
Evidence binder
The reports and logs the underwriter asks for, refreshed before each renewal.
Timed to the renewal, so the town walks into it with answers instead of a questionnaire.
Civic & Main
12
One assessment.
One plan.
One budget line.
Accessibility and cyber readiness share the same site visit, the same council report, and the same fix list for your web vendor. Fixed fee, quoted in writing before any work starts.
Next steps
A free 30-minute consultation
No obligation. Bring three things and you will leave with a written scope and a fixed price.
- Your website address
- Your cyber insurance renewal date and last application
- A list of the systems the town runs: email, utility billing, payroll, records
info@civicandmain.com
civicandmain.com
Civic & Main
14
Sources
- U.S. Department of Justice, Title II web accessibility rule (April 2024) and compliance-date extension (April 20, 2026). Summary: Reed Smith, April 2026
- W3C, Web Content Accessibility Guidelines (WCAG) 2.1, Level AA
- Sophos, The State of Ransomware in State and Local Government 2024: attack rate, recovery cost, backup targeting
- Sophos, State of Ransomware 2025: median ransom paid by state and local government
- Indiana Office of Technology, Cyber Incident Reporting Law (HEA 1169, 2021): 48-hour reporting for political subdivisions
- Cyber insurance underwriting requirements, 2026: industry renewal checklists from multiple carriers and brokers, summarized
Civic & Main
15