Accessibility

Accessibility Statement

The NetSec website strives to make its content usable for everyone, including visitors who rely on assistive technology. This page documents our current conformance status, known limitations, and how to report any barriers you encounter.

Conformance status

The NetSec website (netsec-cost.eu) is designed to meet the requirements of the Web Content Accessibility Guidelines (WCAG) 2.1 at Level AA, in line with the European standard EN 301 549. Based on our most recent internal assessment, the site is partially compliant, the majority of WCAG 2.1 AA success criteria are satisfied, with the limitations listed below.

Most recent internal audit

The 2 September 2026 assessment scanned all 66 page-locales with pa11y, which runs the HTML_CodeSniffer WCAG 2.1 AA rule set and axe-core under a headless browser. Results:

The scan returned 176 errors, 170 of them WCAG 2.1 SC 1.4.3 (Contrast Minimum) in dark mode. Almost all traced to one pattern: the dark-mode accent (#6ea1ff) paired with white text at 2.56:1. The May 2026 pass recorded below had corrected seven calls-to-action carrying that pairing, and the pattern was present in nine further places. Two of them appear on every page: the skip link a keyboard user reaches first, which rendered white on near-white at 1.12:1, and the Funded by the European Union attribution in the footer. All nine were corrected and measured at 10.86:1 or better in both themes.

The scan now returns 21 flags. Eighteen of those are the Network Map Working Group chips and the press kit colour swatches, both listed under Non-accessible or limited content below. The remaining three are one per locale on a link whose text is written by script after the page loads, cleared as a false positive on the same basis as the June 2026 flags.

One failure this scan does not reach was found by hand during the same assessment and is listed below as well: the secondary accent used as link text in light mode. The scanner reads the site in dark mode, so light-mode contrast needs checking in the browser.

Earlier audits

The 22 May 2026 audit ran as part of the launch-QA pass before the public push (full plan: docs/launch-qa-2026.md in the repository). It covered the eight most-trafficked pages (home, network directory, grants, press kit, roadmap, about, FAQ, glossary) across English, French, and German variants. It recorded no violations after fix, a Lighthouse accessibility score of 100, and one item for manual review.

One WCAG 2.1 SC 1.4.3 (Contrast Minimum) issue surfaced during the audit and was fixed before this statement was published: seven primary calls-to-action in dark mode rendered white text on the lighter dark-mode accent (`#6ea1ff`) for a 2.56:1 ratio, below the 4.5:1 AA floor. The affected buttons were pinned to the EU-blue brand colour (`#003399`) in dark mode, giving 10.86:1 contrast. The fix shipped in the same release as this audit.

The remaining item flagged for manual review is colour contrast on text rendered over backdrop-filter glass surfaces, which automated tooling cannot evaluate reliably because the perceived contrast depends on what's behind the surface (the body background plus the decorative blob ambience). We verified these surfaces meet WCAG 2.1 AA contrast in both light and dark mode by inspecting computed colours element-by-element in the browser.

A broader re-assessment on 2 June 2026 extended the review to every page across all three locales (full record: docs/audit-2026-06.md). It re-confirmed WCAG 2.1 AA with no new conformance issues. Two automated flags were checked and cleared as false positives: an empty heading inside a banner that stays hidden until JavaScript fills it, and an empty alt on a directory card template that the renderer populates at runtime.

Three additional final-pass checks completed the launch-QA review on the same day: a structural assistive-technology audit across the four most-trafficked pages (landmarks, heading hierarchy, alt-text, accessible names, all clean). Open Graph and Twitter Card metadata verified complete on every public page. A dark-mode readability sweep across all sixteen public English pages, with no further low-contrast text or surfaces beyond the manual-review item above. Three small corrections that surfaced during this pass are reflected in this release: the FR / DE beta-translation ribbon, which had misclaimed "machine translation", was corrected to "manual translation" (which has always been the methodology). The mobile navigation drawer's transparent background was tightened to near-opaque so the hero text no longer bleeds through behind nav items in dark mode. The network-directory deep-link spotlight was made resilient to a requestAnimationFrame deferral edge-case that could leave a shared /people.html#<slug> link visually unhighlighted on cold page load.

Non-accessible or limited content

The following parts of the site do not yet fully meet WCAG 2.1 AA, or have constraints worth flagging:

• Roadmap Gantt chart. A dense data visualisation. On narrow viewports the chart requires horizontal scrolling. The scroll region is keyboard-focusable so users can pan with arrow keys (WCAG 2.1.1), but a text-only alternative summary is not yet provided.
• Decorative animations. Aurora background blobs and reveal-on-scroll fades are automatically disabled when the operating system or browser signals prefers-reduced-motion. We do not currently expose a separate per-site override.
• Third-party assets. Country flag thumbnails are served from flagcdn.com and headshot photos from eiss-europa.com. Their long-term availability is outside the Action's direct control. If any image becomes unavailable, the surrounding text content remains intact and informative.
• Network Map canvas. A force-directed drawing of the whole Action. The canvas conveys clustering visually and cannot express that to assistive technology. Everyone it draws is listed as a table under the map, rendered into the page rather than by script, and the canvas itself takes keyboard focus. A text summary of the clustering is not yet provided.
• Working Group chips on the Network Map. The filter chips take their background from the Working Group colour and carry a white label. On the amber used for WG4 that measures 2.15:1, below the 4.5:1 AA floor. Setting the label colour from each Working Group's own luminance is tracked as issue #1774.
• Press kit colour swatches. The brand colour table prints each colour's name, hex value and role on the colour itself, which reaches 3.65:1 on the secondary accent. The swatch background is the content the table exists to show, so the fix is a layout decision rather than a recolour. Tracked as issue #1774.
• Link colour in light mode. The secondary accent (#0A84FF) used as link text on the light page background measures 3.43:1. This affects body links, the see-all links and the audience-router eyebrow on every page. A darker token for text use is tracked as issue #1773.
• EU emblem SVG. The Funded by the European Union emblem carries an aria-label and role="img", but no long description. It is described by the surrounding boilerplate text.

We plan to address these limitations in future iterations.

Accessibility features in place

• Semantic landmarks (<header>, <nav>, <main>, <footer>) and a clean heading hierarchy without level jumps.
• Skip-to-content link visible on keyboard focus.
• Visible :focus-visible ring on every interactive control.
• alt text on every image. Explicit <label for> association on every form input.
• Light and dark themes with a manual toggle in the navigation. The operating system's prefers-color-scheme is the default.
• prefers-reduced-motion disables decorative animations.
• The Management Committee by Country directory uses a native <details> accordion, fully keyboard- and screen-reader-accessible without bespoke ARIA wiring. Deep-links to specific country cards auto-expand the section.
• The Gantt grid uses ARIA grid roles (role="table", role="row", role="columnheader", role="cell") so assistive technology parses it as tabular data. The scrollable region itself is keyboard-focusable.
• Working-group membership chips on each member are grouped with role="group" and an aria-label so screen readers announce them as a group (e.g. "Working-group membership: WG1, WG3") rather than as loose tokens.
• Contact form: inline validation, accessible error reporting, and a confirmation toast announced via role="status" aria-live="polite".
• The Network Map canvas is keyboard-focusable: arrow keys walk its Working Groups, research themes and people, Enter opens a profile and Esc clears the selection, with a polite role="status" region announcing what the selection lands on. The same people are listed in a table under the map that does not depend on scripting, and the map answers in words when a filter has emptied it or its data fails to load.
• The COST logotype and EU emblem containers respect the COST Visual Identity Guide (white container, clear-space, minimum size).

Preparation of this statement

This statement was first prepared by self-assessment on 22 May 2026 as part of the launch-QA pass before the public push, updated on 2 June 2026 after a broader re-assessment, and updated again on 2 September 2026 after a full automated scan of every page-locale. The website was reviewed against WCAG 2.1 AA using:

• Automated structural + a11y scans with pa11y (wrapping axe-core 4.11 and HTML_CodeSniffer) on the eight most-trafficked public pages, with collapsible regions expanded.
• Lighthouse performance + accessibility + best-practices + SEO scans on home, network directory, grants, and press kit. Accessibility scored 96-100. Best practices 96. SEO 100.
• Manual contrast verification on glass surfaces and dark-mode CTAs using a per-element in-browser helper (real computed colours, not heuristic estimates). This caught the dark-mode CTA contrast issue that automated tooling under-reported.
• Structural assistive-technology audit across home, network directory, grants, and press kit: landmark roles, heading-level monotonicity (no skipped levels), image alt-text coverage, accessible names on every interactive element, label association on every input. All four pages cleared.
• Open Graph and Twitter Card metadata sweep on the home, About, roadmap, and press-kit pages, full coverage of og:type / og:title / og:description / og:url / og:image (+ width / height / alt) and the equivalent Twitter Card tags, plus a render check on the 2400×1260 shared og-image.png.
• Dark-mode readability sweep across all sixteen public English pages, with both visual review and a programmatic per-element contrast probe. No new low-contrast findings beyond the manual-review item already flagged above.
• Manual keyboard navigation through the home page, network directory, and grants page.
• A per-page broken-link sweep via the new scripts/check-links.sh (910 internal links, 56 external), caught nine anchor refs left over from the IA pass.

The 22 May audit also flagged four Lighthouse performance scores below the internal floor of 80 (range 67-75), driven by render-blocking external font CSS. That cause has since been removed by self-hosting the web fonts, and performance is now watched by an informational Lighthouse run on each change. Performance remains a quality-of-experience concern, not a WCAG conformance gap.

We re-assess after material changes to the design system or content structure, and at a minimum once per year. The next scheduled review is 22 May 2027 or sooner.

Feedback and contact

If you encounter an accessibility barrier on this website, or need any of its content in an alternative format, please get in touch:

• Email the Action Chair, Dr Moritz Weiss, at moritz.weiss@gsi.lmu.de
• Or use the contact form on the home page and mention "accessibility" in your message.

We aim to respond within 10 working days.

Enforcement procedure

If you are not satisfied with our response, you may contact the equality body or accessibility-compliance body in your country. Within the European Union, each Member State designates its own enforcement body under the Web Accessibility Directive 2016/2102.

Accessibility Statement v1.5 · prepared 2 September 2026 (full automated scan, dark-mode contrast corrections, three open limitations recorded) · supersedes v1.4 of 27 August 2026 (Network Map keyboard path and list alternative), v1.3 of 2 June 2026 (June re-assessment), v1.2 of 22 May 2026 (final pre-launch pass), v1.1 of 22 May 2026 (launch-QA review) and v1.0 of 14 May 2026 · next scheduled review 22 May 2027.