Significant change evidence checklist¶

The architecture evidence for significant change, as a checklist you can work through or print. Built from the guardrail metadata each time the site is published.

Prototype - testing with users

This section is an early prototype that we are testing with users. It may change a lot, and some of it may be wrong. Check with your solution design authority before relying on it, and tell us what works and what does not through the feedback link above.

Tick what you have, link to where it lives, and bring it to your solution design authority or assessment. Where you cannot meet a Must, record the approved exception.

Artefacts¶

Architecture decision record (ADR) log - Record the change, the options and why.
C4 container diagram - Update it before you build.
Threat model - Revisit it for the change.
Data protection impact assessment (DPIA) - Update it if personal data processing changes.
Non-functional requirements (NFRs) - Check the change does not breach them, or agree new ones.
Exit plan - Update it if you add a product or supplier.
Runbooks and support model - Update them before the change goes live.

Must guardrails¶

GR-SEC-01 Follow Secure by Design - Secure by Design activities repeated for the change, with the risk owner involved
GR-SEC-02 Keep a current threat model - Threat model revisited for the change before it is built
GR-SEC-06 Test before go-live and after major change - IT health check scoped and booked for the change where it is significant
GR-DATA-06 Protect personal data by design - DPIA updated for any change in how personal data is processed
GR-TECH-01 Look for something to reuse first - ADR showing reuse options considered for any new component
GR-TECH-06 Get spend approval early - Architecture team consulted before new procurement for the change
GR-OPS-05 Be ready for live before you go live - Runbooks and support arrangements updated before the change goes live

Should guardrails¶

GR-API-04 Version and deprecate deliberately - Consumers told about breaking changes in advance, with a new version and a retirement date for the old one
GR-DEV-09 Record significant decisions as ADRs - ADR log in the repository or linked from its README
GR-TECH-03 Plan your exit before you enter - Exit plan updated for any new product or supplier
GR-AI-06 Talk to the TDA about novel use - Technical Design Authority review of any new AI use introduced by the change
GR-HOST-07 Design for the resilience the service needs - Recovery objectives and design checked for the change

Sign-off¶

Detail	Answer
Service
Completed by
Date
Solution design authority
Exceptions or departures (guardrail ids)

Read more on the significant change page.