Website uses .gov domain or agency-approved domain with agency branding

Federal websites not using a .gov domain — or lacking documented agency approval for an alternative — are indistinguishable from phishing sites to the public. Citizens rely on .gov to verify legitimacy before submitting personal data or completing government transactions. The 21st Century IDEA Act (Sec. 3) and OMB M-23-22 both require .gov domains for federal public-facing sites. Missing or incomplete agency branding in header and footer compounds the risk: users cannot confirm the site belongs to the agency they intend to contact, undermining the trust that government services depend on.

Register a .gov domain through the Cybersecurity and Infrastructure Security Agency (CISA) at get.gov, then update your deployment config. If a non-.gov domain is unavoidable, obtain and document written agency approval. Add agency name and logo to both the header and footer in app/layout.tsx:

// app/layout.tsx
export default function RootLayout({ children }: { children: React.ReactNode }) {
  return (
    <html lang="en">
      <body>
        <header>
          <img src="/agency-seal.png" alt="Department of Example" width={64} height={64} />
          <span>Department of Example</span>
        </header>
        <main>{children}</main>
        <footer>
          <p>An official website of the Department of Example</p>
          <img src="/agency-seal.png" alt="Department of Example" width={48} height={48} />
        </footer>
      </body>
    </html>
  )
}