NFR & compliance catalogue
A reusable menu of non-functional and compliance requirements, selected per product at Definition and verified at Refinement. Turns domain constraints from tribal knowledge into testable requirements.
The menu
Select what applies; state the target; it becomes testable.
| Area | Options / targets |
|---|---|
| Quality (ISO/IEC 25010) | performance efficiency, reliability, security, maintainability, portability — with concrete targets |
| Accessibility | WCAG 2.2 AA (see accessibility standard) |
| Data protection | UK GDPR, data residency (UK / India handling) |
| Financial conduct | FCA Consumer Duty; Lloyd's / market rules where relevant |
| AI features | EU AI Act risk classification (see AI decision auditability) |
| Availability | uptime SLO, RPO / RTO |
| Auditability | audit-trail completeness, retention |
| Multi-tenancy | tenant isolation guarantees |
The rules
- Selected at Definition — the applicable rows go into the PFD with concrete targets.
- Verified at Refinement — each becomes a check in the Refinement Exit gate.
- A requirement without a target isn't a requirement — "fast" is not a target; "p95 < 300ms" is.
Standards referenced: ISO/IEC 25010, WCAG 2.2, UK GDPR, FCA Consumer Duty, EU AI Act.