Choosing a content management system for an agency website

Reference article · 5 min read

A website redesign usually begins with a conversation about the look of the site and ends with a decision about software. The content management system determines who can publish, how fast a wrong page can be corrected, whether the site meets accessibility requirements, where the content actually lives, and what happens when the agency wants a different vendor. That decision outlasts the visual design by many years.

There is no single best CMS for a city, county, or state agency. There are three broad categories, each with predictable tradeoffs, and the right fit depends on the size of the communications team, the technical staff available to maintain a platform, and how much the site has to do beyond publishing pages.

The three realistic categories

Government-focused hosted platforms. Sold as a subscription to public agencies, bundling hosting, templates, support, and modules for agendas, calendars, and notifications. They launch quickly and need little infrastructure work. In exchange the agency accepts the vendor's content model, fewer integration options, and renewal pricing set by the party holding the content.
General commercial CMS products. Mature platforms sold across industries, with strong editing, workflow, and analytics. Government-specific features are usually absent, and most implementations need a partner to build templates and integrations. Accessibility and retention behavior then depend on how the site is built, not on the product alone.
Open source systems. Drupal, WordPress, and static site approaches paired with a headless CMS. No license fee, a content model the agency controls, a wide talent pool, and content that is portable by design. Someone still has to own patching, upgrades, and hosting, whether that is internal staff or a support vendor under contract.

Accessibility starts with the authoring tools

Most accessibility review focuses on public-facing pages. The authoring interface deserves equal attention. Staff with disabilities have to be able to use the editor, which is what the W3C Authoring Tool Accessibility Guidelines address, and a good editor also makes inaccessible content hard to publish: required alternative text, enforced heading structure, components that cannot drop below contrast minimums, and a check that runs before a page goes live.

A federal rule under Title II of the Americans with Disabilities Act sets the Web Content Accessibility Guidelines, version 2.1, Level AA, as the technical standard for state and local government web content and mobile applications, with compliance dates that vary by the size of the entity. Section 508 governs federal agencies and is referenced by many state laws and grant conditions. Requirements change, so confirm current obligations with counsel or the official text. Ask every vendor for an accessibility conformance report covering the public templates and the administrative interface, and treat it as a claim to verify, not a certification.

Governance, workflow, and language access

Departments publish at different speeds and with different risk. The platform should support:

Role-based permissions scoped to a department or content section.
Review and approval before publish, with a documented emergency path for public safety messages.
Scheduled publishing and expiration, so temporary notices do not become permanent.
A complete audit trail of who changed what and when.
Real multilingual structure, meaning separate translated pages with correct language attributes and stable URLs, not only a machine translation widget. Agencies receiving federal financial assistance have language access obligations under Title VI, and machine output alone rarely satisfies a vital-document obligation.

Records retention and public records

Published web content is frequently an agency record under state law, and the retention schedules issued by the state archives or records office usually apply to it. Ask how long the CMS keeps prior revisions, whether the vendor purges them on its own schedule, whether revisions can be exported, and what happens when a page is deleted rather than unpublished. Confirm the system can support a litigation hold and show what the site said on a given date. Some agencies use separate web archiving instead of relying on the CMS.

Hosting and security responsibility

Write down who does what, because assumptions here are expensive. Clarify who patches the CMS core, add-on modules, and the operating system; who manages certificates, DNS, and the web application firewall; how often backups are taken and when a restore was last tested; and how quickly the vendor must report a security incident. Require single sign-on and multifactor authentication for authors, and keep the .gov domain registration and DNS control in the agency's hands regardless of who hosts.

Leaving without a rebuild

Most rebuilds happen because content was trapped, not because the design aged out. Reduce that risk in advance:

Require a structured export on demand covering pages and their fields, media files, taxonomy, users, and redirects, available at any time at no extra charge rather than only at termination.
Ask the vendor to demonstrate an export during evaluation and inspect what it contains.
Keep the domain, DNS, analytics account, and URL structure under agency control so links and search results survive a move.
Establish ownership of designs, templates, and custom code in writing, and clarify the license for anything built on open source.

What to require in the contract

Accessibility conformance, with remediation duties and timelines for defects found after launch.
Agency ownership of all content and data, stated plainly.
Export rights, format, and frequency, plus transition assistance for a defined period at defined rates.
Security duties, incident notification timelines, and subprocessor change notice.
Records retention support, including help with public records and discovery requests.
Renewal price protection and a cap on increases.
A scored demonstration using the agency's own content and a real approval workflow, not the vendor's sample site.

HQT advises agencies on web platform selection, accessibility remediation, and migrations between content management systems.

Frequently asked questions

What is the best content management system for a city government website?

There is no single best product. Government-focused hosted platforms launch fastest and bundle common municipal features, general commercial products offer stronger editing and workflow but need an implementation partner, and open source systems such as Drupal or WordPress give the most control over content and portability. Choose based on the size of your communications team, who will handle patching and hosting, and how easily content can be exported later.

Does our agency website have to meet WCAG 2.1 Level AA?

A federal rule under Title II of the Americans with Disabilities Act adopts WCAG 2.1 Level AA as the technical standard for state and local government web content and mobile applications, with compliance dates that depend on the size of the entity. Many states also have their own accessibility statutes, and grant conditions can add requirements. These rules change, so confirm current obligations and deadlines with your counsel or the official rule text rather than relying on a vendor's summary.

Is website content considered a public record we have to retain?

In most states, published web content can be an agency record subject to the retention schedules issued by the state archives or records office. That makes CMS revision history, deletion behavior, and export capability retention questions, not just convenience features. Ask the vendor how long prior versions are kept and whether they can be exported, and check with your records officer on what your schedule requires.

How do we avoid rebuilding the site every time we change vendors?

Most rebuilds happen because content is trapped in a proprietary structure, not because the design is outdated. Require a structured export on demand that includes page fields, media, taxonomy, users, and redirects, and ask the vendor to demonstrate that export during evaluation. Keep the .gov domain, DNS, analytics account, and URL structure under agency control so links and search results survive a platform change.

Is an open source CMS secure enough for a government website?

Open source platforms are widely used in government and can be run securely, but security depends on who owns patching and upgrades rather than on the license model. If no one has the time or contract obligation to apply updates promptly, an unmaintained open source site becomes a real risk. Either assign that responsibility to internal staff with the capacity to do it or put it in a support contract with defined response times.