A Large County: Enterprise ADA Compliance for a Government Serving 1.2 Million Residents
Twenty-five departments. 12,000 PDFs. A custom Drupal build burning $280,000 a year just to stay running. Here's how the county traded all of it for one platform on Azure GovCloud, with a dedicated CSM and a compliance posture that finally holds.
1.2M
County residents served
25
Departments on single platform
12,000
PDFs in county archive
$280K
Prior annual Drupal maintenance cost
What a Custom Drupal Build Actually Costs
This is a large county government of 1.2 million residents, one of the largest local government agencies in the state, and in 2018 the technology office signed off on a custom Drupal 8 stack. On paper, it looked like the right call. A custom design system, workspaces for all 25 departments, integrated citizen service portals, a document management module built to spec. The initial build came in at $680,000.
Then came the years after the launch. By 2025, the county's IT team was tracking annual maintenance across three buckets, and the numbers weren't small:
Vendor support contract (Drupal consulting firm)
$144,000/yearBug fixes, security patches, module updatesInternal developer time (1.5 FTE allocated to Drupal)
$87,000/yearCounty IT staff hours burned on CMS upkeepHosting and infrastructure
$34,000/yearAWS infrastructure, managed by vendorAccessibility remediation (ad hoc)
$15,000/yearYearly contractor engagement for VPAT work$280,000 a year. And here's the part that stung: the $15,000 accessibility contractor was on the books, but the site's compliance still drifted month to month. Drupal's open architecture is a gift when you want to build weird custom features. It's a curse when you want accessibility to hold. Every new module, every theme tweak, every custom component was another chance for a regression. A once-a-year audit can't catch what a continuous development team ships every sprint.
Drupal annual maintenance breakdown (2025)
$280,000 total
Four buckets tracked by the county IT team on the custom Drupal 8 build.
The DOJ Letter and What the PDF Archive Was Hiding
Mid-2025. The county's ADA Coordinator opened an envelope from the Department of Justice. The county was on a list. Not a formal complaint, not yet. DOJ was asking counties over 1 million residents to walk through their Title II web accessibility plans and timelines. A polite letter with sharp teeth behind it.
The technology team commissioned a real audit. The findings landed hard:
- Automated WCAG 2.1 AA scan returned 3,847 violations across the county website, and this was the site paying a $15,000-a-year accessibility contract
- The document archive held 12,347 PDFs. A sample audit of 500 flagged 41% Critical and 38% High risk
- The citizen service portals (permit applications, court document access, property tax payment) had keyboard failures that stopped screen reader users from finishing transactions
- Six of the 25 department workspaces scored below 40%, meaning they failed more than 60% of the WCAG criteria checked
PDF risk audit (sample of 500 documents)
12,347 PDFs total
Random sample pulled from the county document archive during the 2025 audit.
Applied across the full 12,347-document archive, that projects to more than 9,700 PDFs at Critical or High risk.
Six Weeks Inside the Enterprise Security Review
The county's IT Security office doesn't rubber-stamp anything. The review of WPPersona ran six weeks before a contract went near a signature line, routed through the county's Carahsoft co-op contract vehicleto shortcut a full RFP. Here's what they looked at:
SOC 2 Type II Report
WPPersona handed over its current SOC 2 Type II audit covering Security, Availability, and Confidentiality. No material exceptions in the prior 12-month window. The security lead didn't have follow-up questions, which is unusual.
Data Processing Agreement
A DPA got signed that spelled out data classification, retention windows, and deletion terms. It lined up with state records retention schedules and the county's own data governance policy. No custom language fights.
Penetration Test Results
The most recent third-party pen test report came in, dated four months prior. County security walked the findings line by line. Every critical and high finding had already been closed before the report was shared.
FedRAMP Equivalence Assessment
No FedRAMP authorization on file, and WPPersona said so up front. So the security team ran controls against the FedRAMP Moderate baseline themselves. The platform met or beat the Moderate baseline on 89% of control families.
Azure GovCloud Hosting Confirmation
Enterprise deployment sits on Azure Government, split across US Gov Virginia and US Gov Texas. That met the county's data sovereignty rules for sensitive government data. No gray area, no waivers.
What the County Got, and What It Cost
Azure GovCloud hosting
Data stays in US Government regions. Meets the county data sovereignty rules without a waiver
Dedicated Customer Success Manager
Weekly check-ins during rollout. Monthly compliance reviews after. A named escalation path when things get urgent
99.99% uptime SLA
Custom SLA above the standard platform terms. Credits paid out for downtime events
Custom SSO (SAML + Azure AD)
Single sign-on across all 25 departments, tied into the county's existing Azure Active Directory
Enterprise compliance dashboard
The county CIO sees compliance across every department, PDF risk by department, remediation progress in one view
Priority PDF remediation support
WPPersona's enterprise team helped the county triage and coordinate the 12,000-document archive cleanup
Cost Comparison: Drupal vs. WPPersona Enterprise
Drupal maintenance (all-in, 2025)
$280,000/yearVendor support, internal FTE, hosting, accessibilityWPPersona Enterprise (projected)
$95,880/year$7,990/month Enterprise plan, GovCloud hosting includedAnnual savings
$184,120/year66% cut in total web platform ownership costAnnual web platform cost: Drupal vs WPPersona Enterprise
$184,120 saved / year
A 66% cut in total platform ownership cost, before counting the $680,000 initial Drupal build.
“We'd talked ourselves into believing that a big county needed a big, expensive platform. Turns out that complexity was the thing wrecking our compliance. Every new module or component we added risked another regression. A purpose-built compliant platform, where accessibility is enforced by design instead of audited a year later, is what a county our size actually needed.”
CIO, County Government
Running a Large County or Enterprise Deployment?
Enterprise plans include GovCloud hosting, a dedicated CSM, SAML SSO, and custom SLAs built for large government deployments. Tell us what you're dealing with.
Talk to Enterprise Team