Choosing technology¶
How to decide whether to reuse, buy or build - and how to avoid being stuck with the choice.
Doctrine: 1. Platforms before projects. Built as products, 2. Standards and guardrails before exceptions, 3. Reuse before buy
Principles: 3. Maximise value, minimise waste, 1. Delivery-focused architecture
Who these guardrails apply to
The core department. Whether the choosing technology guardrails also apply to Defra's arm's length bodies is still to be confirmed.
GR-TECH-01 Look for something to reuse first¶
Must Before buying or building, check the technology capability catalogue and cross-government components for something that already meets the need.
Why: Duplicate capabilities multiply cost, security risk and support effort.
How to meet it: Record in your ADR which strategic options you considered and why they did or did not fit. If a strategic option is close but not quite right, talk to the owning platform team before building around it.
GR-TECH-02 Buy commodity, build differentiating¶
Should Buy or use SaaS for commodity needs (email, HR, finance, CRM, document management). Build only where the capability is specific to Defra's mission and no product fits without heavy customisation.
Why: Heavily customised products combine the cost of building with the constraints of buying.
How to meet it: If you are configuring more than you are using out of the box, stop and reconsider. Prefer configuration over customisation; avoid modifying vendor code.
GR-TECH-03 Plan your exit before you enter¶
Should Any new product, platform or significant supplier dependency has a documented exit plan covering data export in open formats, contract terms and an estimate of switching cost.
Why: Lock-in is sometimes a sensible trade-off, but it must be a deliberate one.
How to meet it: Include an exit section in your ADR or business case. Make sure contracts give Defra ownership of its data and the right to export it.
GR-TECH-04 Assess SaaS before you adopt it¶
Must SaaS and third-party hosted products are assessed for security, data protection, data location, accessibility and integration before contract.
Why: Supply chain risk is one of the biggest sources of security incidents in government.
How to meet it: Use the Secure by Design supplier assurance activities, complete a DPIA if personal data is involved and confirm the product supports single sign-on with Microsoft Entra ID for staff (GR-IAM-02).
GR-TECH-05 Prefer open standards and portable technology¶
Should Choose products and components that use open standards and can be run on more than one provider.
Why: Portability keeps our options open and our commercial position strong.
GR-TECH-06 Get spend approval early¶
Must Spend that falls under the government digital and technology spend control is discussed with the architecture team before procurement starts.
Why: Architecture questions raised at the end of a procurement are expensive to answer.