Non-functional requirements

State how well the process and any system must work, each with a way to measure it and a source for any number.

With the functional requirements. Feeds: tests, risks, the traceability matrix and the business requirements document.

• Name the quality, in one or two words.
• Write the requirement in one sentence.
• Write the fit criterion: how you would measure it, with the number.
• Tag every number: LAW if the law sets it, GUIDE if guidance or official data sets it, MINE with a reason if you chose it.
• Link the rule or the source behind it, and the risk it protects against.

1. How would you measure it? Answered in Fit criterion column. Each row says what a tester does and what they must see; NFR-10 cannot be measured until OQ-04 is answered.
2. Where does the number come from? Answered in Tag and Rationale columns. The numbers in NFR-01, NFR-08 and NFR-09 are MINE, each with its reason.
3. Which of these are legal duties? Answered in Rows NFR-06 and NFR-03. NFR-06 enforces a duty in FOIA: the re-usable form required by section 11(1A) (BR-48). NFR-03 goes beyond BR-54 by choice: the offence needs the intention to prevent disclosure, and append-only records are a local control.
4. What happens if it fails? Answered in Risk column, where a risk is logged. For the rows marked None logged, a failure is caught by the test in the Tested by column.
5. Why is there no number for volumes or load? Answered in Rationale column of NFR-08 and NFR-09: no target depends on volumes, which nobody outside the council knows (OQ-06).

• "Fast" and "secure" with no measure. You can spot them when no test could fail them.
• A list copied from elsewhere: it holds qualities that no rule or risk in the work asks for.
• Numbers with no tag: nobody can tell a legal limit from a guess.
• A local choice tagged as law: the row claims more than the clause it cites, such as a duty for some cases written as one for every case.
• Functional requirements in disguise: the row says what the system does, not how well it does it.

• No target here depends on how many requests the council receives. Nobody outside the council knows that number OPEN OQ-06. Rejected: assumed volumes for load targets, which would be invented numbers presented as requirements.
• NFR-10 has no number. The retention period is the council's to set OPEN OQ-04. Rejected: a period copied from another organisation's schedule, which would turn a guess into a rule.
• NFR-01 treats the calendar as data. The GOV.UK list ends on 26 December 2028 and includes one-off days, such as 15 June 2026 in Scotland GUIDE SRC-08. Rejected: holidays written into the deadline logic, which would need a code change whenever the list changes (RSK-01, RSK-02).