NFR catalogue¶
Defra's standard non-functional requirements. Start from these rather than writing your own, so services are consistent and assessors know what good looks like.
Draft - to be confirmed
Parts of this page, such as names, timings and thresholds, are still being confirmed by the architecture team. Use it as a guide, and check with your solution design authority before relying on the detail.
How to use it: pick your service tier, copy the requirements that apply into your backlog with the target for your tier, and add any service-specific NFRs using the guidance on writing good NFRs. Ids such as NFR-AVL-01 are stable, so you can reference them in stories, test reports and contracts.
Availability and resilience¶
The service is there when users need it and recovers quickly when it fails.
| ID | Requirement | How to show it is met | Target by tier | Related guardrails |
|---|---|---|---|---|
NFR-AVL-01 |
Availability The service is available to users for the target percentage of its supported hours, measured monthly, excluding planned maintenance announced 5 working days ahead. |
Synthetic monitoring of the main user journey; monthly availability report. | T1: 99.9% T2: 99.5% T3: 99% T4: Best effort |
GR-OPS-03 |
NFR-AVL-02 |
Recovery time objective After a major failure, the service is restored within the recovery time objective. |
Disaster recovery test with a timed restore. | T1: 4 hours T2: 24 hours T3: 3 working days T4: 5 working days |
GR-HOST-07 |
NFR-AVL-03 |
Recovery point objective No more data is lost in a failure than the recovery point objective allows. |
Backup configuration review and point-in-time restore test. | T1: 15 minutes T2: 1 hour T3: 24 hours T4: 24 hours |
GR-HOST-07 |
NFR-AVL-04 |
No single point of failure The service runs across at least two availability zones, with no single component whose failure stops the service. |
Architecture review and a zone failure test. | T1: Required T2: Required T3: Recommended T4: Not required |
- |
NFR-AVL-05 |
Graceful degradation When a dependency fails, users are told what has happened and do not lose information they have entered. |
Dependency failure tests in the pipeline. | All tiers | GR-OPS-04 |
Performance and capacity¶
The service is fast enough for users and copes with expected peaks.
| ID | Requirement | How to show it is met | Target by tier | Related guardrails |
|---|---|---|---|---|
NFR-PRF-01 |
Page response time 95% of page requests complete within 2 seconds, measured at the server, at expected peak load. |
Load test at peak volume before go-live and after significant change. | All tiers | - |
NFR-PRF-02 |
API response time 95% of synchronous API calls complete within 500 milliseconds at expected peak load. |
Load test and production monitoring of latency percentiles. | All tiers | GR-API-02 |
NFR-PRF-03 |
Peak capacity The service handles twice the highest expected peak (for example a scheme deadline or flood event) without failing. |
Load test at 2x forecast peak; autoscaling configuration review. | T1: 2x peak T2: 2x peak T3: 1.5x peak T4: Expected peak |
- |
NFR-PRF-04 |
Low bandwidth Core journeys are usable on a 3G connection, with page weight under 500KB excluding cached assets. |
Lighthouse or WebPageTest on a throttled connection. | All tiers | GR-FE-05 |
Security¶
The service protects its users, data and Defra.
| ID | Requirement | How to show it is met | Target by tier | Related guardrails |
|---|---|---|---|---|
NFR-SEC-01 |
Threat model A current threat model exists and is reviewed at every significant change and at least annually. |
Threat model in the repository or linked from it, with a review date. | All tiers | GR-SEC-02 |
NFR-SEC-02 |
Vulnerability remediation Critical vulnerabilities are fixed within 14 days and high within 30 days, or a risk decision is recorded. |
Scanner reports and the risk register. | All tiers | GR-SEC-05 |
NFR-SEC-03 |
Independent security testing An IT health check proportionate to risk is completed before go-live and after significant change. |
Health check report and remediation plan. | T1: Required T2: Required T3: Required T4: Risk based |
GR-SEC-06 |
NFR-SEC-04 |
Encryption All data is encrypted in transit with TLS 1.2 or higher and encrypted at rest. |
Configuration review and automated TLS checks. | All tiers | GR-SEC-04 |
NFR-SEC-05 |
Access control Users and services have only the permissions they need, granted by role, and access is reviewed at least every 6 months. |
Role model documentation and access review records. | All tiers | GR-IAM-03 |
Accessibility and usability¶
Everyone who needs the service can use it.
| ID | Requirement | How to show it is met | Target by tier | Related guardrails |
|---|---|---|---|---|
NFR-ACC-01 |
WCAG 2.2 AA The service meets WCAG 2.2 level AA and publishes an accessibility statement. |
Automated checks in the pipeline, manual testing with assistive technology and an accessibility audit before public beta. | All tiers | GR-FE-01 |
NFR-ACC-02 |
Design system Public-facing pages use GOV.UK Frontend components and patterns. |
Code review and service assessment. | All tiers | GR-FE-02 |
NFR-ACC-03 |
Works without JavaScript Core journeys can be completed with JavaScript unavailable. |
End-to-end tests run with JavaScript disabled. | All tiers | GR-FE-03 |
NFR-ACC-04 |
Supported browsers and devices The service works on the browsers and assistive technologies in the GOV.UK Service Manual's supported list. |
Cross-browser test results. | All tiers | - |
Observability and supportability¶
The service can be monitored, supported and fixed by people who did not build it.
| ID | Requirement | How to show it is met | Target by tier | Related guardrails |
|---|---|---|---|---|
NFR-OPS-01 |
Logging and tracing Structured logs, metrics and traces with correlation ids are sent to the platform observability tooling. |
Dashboard and a traced request across service boundaries. | All tiers | GR-OPS-01, GR-OPS-02 |
NFR-OPS-02 |
Alerting Alerts on user-facing symptoms reach the support team within 5 minutes of a breach. |
Alert test during operational readiness review. | T1: 24/7 on-call T2: Extended hours T3: Business hours T4: Business hours |
GR-OPS-03 |
NFR-OPS-03 |
Runbooks Runbooks cover deployment, rollback, restart, common failures and contacts. |
Runbook walkthrough with the support team before public beta. | All tiers | GR-OPS-05 |
Maintainability and testability¶
The service is cheap and safe to change.
| ID | Requirement | How to show it is met | Target by tier | Related guardrails |
|---|---|---|---|---|
NFR-MNT-01 |
Automated deployment Every change reaches production through an automated pipeline, and any release can be rolled back. |
Pipeline configuration and a rollback demonstration. | All tiers | GR-DEV-04, GR-HOST-03 |
NFR-MNT-02 |
Automated tests Unit, integration and journey tests run on every change, and the main branch is always releasable. |
Pipeline results and coverage of critical journeys. | All tiers | GR-DEV-05 |
NFR-MNT-03 |
Supported runtimes and dependencies Languages, frameworks and dependencies are on supported versions, with automated update pull requests. |
Dependency report. | All tiers | GR-DEV-06 |
NFR-MNT-04 |
Documentation The repository explains how to run, test and deploy the service and links to its decision records. |
README and ADR log review. | All tiers | GR-DEV-08 |
Interoperability¶
The service works with the rest of Defra and its partners.
| ID | Requirement | How to show it is met | Target by tier | Related guardrails |
|---|---|---|---|---|
NFR-INT-01 |
Documented APIs APIs are described with OpenAPI or AsyncAPI and published to the API catalogue. |
Specification in the repository; catalogue entry. | All tiers | GR-API-02, GR-API-08 |
NFR-INT-02 |
Standard identifiers Shared entities use the identifiers in Defra's data standards (such as SBI, CRN, CPH and UPRN). |
Data model review. | All tiers | GR-DATA-03 |
Data and compliance¶
Data is accurate, protected and kept for the right length of time.
| ID | Requirement | How to show it is met | Target by tier | Related guardrails |
|---|---|---|---|---|
NFR-DAT-01 |
Data protection A DPIA is completed before personal data is processed, and personal data is minimised. |
Approved DPIA. | All tiers | GR-DATA-06 |
NFR-DAT-02 |
Retention and disposal Data is retained and deleted automatically in line with Defra retention schedules. |
Retention configuration and a disposal test. | All tiers | GR-DATA-09 |
NFR-DAT-03 |
Data location OFFICIAL data is stored in UK regions. |
Infrastructure configuration review. | All tiers | GR-HOST-06 |
NFR-DAT-04 |
Data quality Data quality rules are defined for data that feeds payments, regulatory decisions or statistics, and are measured. |
Data quality dashboard. | All tiers | GR-DATA-08 |
Sustainability¶
The service uses no more energy and resources than it needs.
| ID | Requirement | How to show it is met | Target by tier | Related guardrails |
|---|---|---|---|---|
NFR-SUS-01 |
Right-sized and switched off Non-production environments scale down out of hours, and production scales with demand. |
Scaling configuration and monthly cost and carbon report. | All tiers | GR-SUS-02 |
NFR-SUS-02 |
Carbon reporting The service's cloud carbon footprint is reported alongside its cost. |
Cloud provider carbon report. | All tiers | GR-SUS-05 |