Field notes
A list of questions on concerns that cut across most software initiatives and are worth thinking through. What is utterly obvious, and therefore easy for some to forget, should be made explicit and clear to every stakeholder.
Each line is a starting point to get the thinking going. Feel free to add more things as they come up or get discussed.
The default list covers concerns that are painful to come up with late in the journey.
1.1 Generic compliance requirements worth highlighting - Typical examples are GDPR, NIS2, DORA, CRA and SOX.
1.2 Industry-specific compliance requirements - Different industries face different amounts of specific regulation to comply with. Clarify which ones apply.
2.1 Languages that should be supported - which UI and content locales the product is to ship with?
2.2 AI-prompt - is there an LLM in the solution? How is the prompt versioned, evaluated and observed in production?
2.3 Mobile-first - is mobile the primary surface, a parity surface, or entirely out of scope?
3.1 Guide/help - built-in help, tooltips, walk-throughs, or hand-off to support?
3.2 Share - should artefacts be shareable with users within and outside the primary tenancy (link sharing, role grants, expiry)?
3.3 Management-view - is there a separate admin and reporting screen for the people running the system, distinct from the end-user views?
4.1 UI-look and feel is ready - is the visual design done, in progress or not yet started?
4.2 UI design system is ready - are the rules for design and the reusable components ready, in progress or not yet started?
4.3 Content is ready - is the copy and the graphic material ready, in progress or not yet started?
5.1 Admin configurability - what knobs do the operators have in production?
5.2 User configurability - what knobs do the end users have themselves?
6.1 URL and DNS is ready - is the address decided and set up?
6.2 If operations with external part, under whose account - what does the account structure look like?
6.3 Location for backups beyond the normal site - has your data been secured with care?
7.1 Functional suitability - do we know clearly enough what the system is actually supposed to do, that the functions are complete, correct and solve the right problem?
7.2 Performance efficiency - what requirements do we have on response times, resource usage and capacity, and do we know at what volumes they apply?
7.3 Compatibility - does the solution need to coexist with or exchange data with other systems, and if so through which interfaces or formats?
7.4 Interaction capability - who is the user, and what is required for the solution to be learnable, accessible and hard to make mistakes with?
7.5 Reliability - what availability and fault tolerance are required, and how should the system recover after failures?
7.6 Security - what requirements do we have on confidentiality, integrity, traceability and authentication, and against which threats?
7.7 Maintainability - how should the solution be built to be easy to understand, test and change over time?
7.8 Flexibility - how well does the solution need to adapt to new environments, scale up or down, and be replaceable or reinstallable?
7.9 Safety - can the system cause harm to people, property or the environment, and how do we handle risks, fail-safe and warnings?