Non-functional Requirements Elicitation Question Bank

RequirementCoach™Non-Functional Elicitation Question Bank

© Copyright 2013 Enfocus Solutions Inc. All Rights Reserved

Non-functional Requirements Elicitation Question Bank

Practice Aid Type: Question Bank

Version and Release Date: 1.0 (Issued February 1, 2013)

Context: Requirements Development is the fifth task group in the Requirements Excellence Framework™. The purpose of this task is to deduce, capture, and agree upon a set of functional requirements and product characteristics (like non-functional requirements) that will achieve the stated business objectives. In this task group, a business analyst interprets stakeholder needs, prepares use cases, prioritizes requirements, and performs various other activities, in sequence, that promote a healthy requirements development cycle. Employing such methods as requirements visualizations and prioritization will demonstrate both clarity and efficiency within the development process.

Essentially, non-functional requirements capture conditions that are not directly related to the behavior or functionality of the solution, but rather describe environmental conditions under which the solution must remain effective or qualities that the system must have. Non-functional requirements need to be defined for all IT-related projects.

Purpose: The purpose of this question bank is to provide BAs with an extensive list of questions that can prove to be invaluable in creating their own non-functional requirements questionnaires.

How to Use: This question bank delivers a catalog of possible questions to consider during the documentation of non-functional requirements. Question banks are far more expansive than other checklists, and should be used as a resource to pull your own possible questions from. An expected benefit of this is easier documentation of non-functional requirements.

Requirements Excellence Framework Reference:

5.4 Document Non-functional Requirements


© Copyright 2013 Enfocus Solutions Inc. All Rights Reserved 1

The Who, What, Where, When, Why, & How of Non-Functional Requirements: An Elicitation Question Bank

A major step in preparing for requirements elicitation is determining what questions need to be asked. Without a prepared document listing the requirement questions you will need, elicitation sessions can veer of course or suffer from silence. Either way, this is valuable stakeholder time that you do not want to waste. Requirement questionnaires can be integral to keeping elicitation sessions on track and productive. Not every question provided here will be applicable to your specific project, but this extensive list will prove to be an invaluable tool in creating your own requirement questionnaires.

Table of Contents

pg. 40 17 Organizational Change

pg. 41 18 Performance

pg. 47 19 Portability

pg. 51 20 Processes

pg. 52 21 Recovery

pg. 52 22 Reliability

pg. 59 23 Reusability

pg. 62 24 Scalability

pg. 66 25 Security

pg. 73 26 System Recovery

pg. 78 27 Testing

pg. 84 28 Trade-offs

pg. 84 29 Usability

pg. 94 30 Users

pg. 95 31 Workflow

pg. 2 01 Alerts

pg. 2 02 Auditability

pg. 3 03 Availability

pg. 8 04 Backup and Recovery

pg. 8 05 Business Events

pg. 9 06 Capacity

pg. 10 07 Data

pg. 15 08 Development

pg. 15 09 Errors

pg. 15 10 Integrity

pg. 24 11 Interfaces

pg. 24 12 International

pg. 25 13 Interoperability

pg. 30 14 Locations

pg. 31 15 Maintainability

pg. 40 16 Monitoring



01.00.00 Alerts

01.01.00 Who?

01.01.01 Who receives system fault/repair audit reports?

01.01.02 Who gets called when the system is down?

01.01.03 Who should receive notification when there are system failures?

01.02.00 What?

01.02.01 What means of notification escalation should be used?

01.02.02 What means of correction escalation should be used?

01.02.03 What people need to be notified when there is a serious error?

01.02.04 What people need to be notified when there is a serious error?

01.03.00 When?

01.03.01 When should multiple people be notified?

01.04.00 How?

01.04.01 How does notification depend on type of error?

01.04.02 How should acknowledgment from someone taking responsibility for the problem be communicated?

02.00.00 Auditability

02.01.00 What?

02.01.01 What kind of audit trails or logs are kept?

02.01.02 What audits must be in place to detect unintentional or unauthorized changes to data?

02.01.03 What should be known about data changes?



03.00.00 Availability

03.01.00 Who?

03.01.01 Who is authorized to access what data when the system is unavailable?

03.01.02 Who supports the system during “after hours” or non-normal operation hours?

03.01.03 Who performs routine maintenance?

03.02.00 What?

03.02.01 What functions of the system are the most critical to the business?

03.02.02 What processes must always be available?

03.02.03 What means of notification should be used?

03.02.04 What means of notification should be used by type of system outage?

03.02.05 When the system is unavailable, what notification should be given to users attempting to access the system?

03.02.06 What is an acceptable amount of time to detect an outage?

03.02.07 What are the expectations of the availability of the system?

03.02.08 What are the associated risks to conducting business “as usual” if the system/application is unavailable?

03.02.09 What is the acceptable effort required of users/customers to gain access to data?

03.02.10 What problems with availability have been experienced in the past?

03.02.11 What are the greatest concerns about availability?

03.02.12 What is the cost to the business for system down time?

03.02.13 What is an acceptable affect on system availability of background activity?

03.02.14 What cost tolerance is acceptable to maintain the required level of availability?

03.02.15 What processes are considered to be absolutely mission critical to the business?

03.02.16 What processes must be the last to fail or be unavailable?



03.02.17 What level of limited availability in a degraded mode is acceptable?

03.02.18 What current availability issues must be avoided by this project?

03.02.19 What level of performance constitutes available?

03.02.20 What hardware components are common sources of availability issues?

03.02.21 What is the timeframe for problem resolution by the first-level support group?

03.02.22 What else should I be asking about availability “purpose”?

03.02.23 What is the fallback position for partial availability?

03.02.24 What special processes are executed for trade-shows, customer events or promotions?

03.02.25 What days during the week should the system be available?

03.02.26 What special processes run for week-end, month-end, and year-end?

03.02.27 What time-sensitive processing occurs? (Daily, monthly, quarterly, annually, month end, or year-end)

03.02.28 What specific periods are imperative to meet business or safety objectives?

03.02.29 What time frame should be used when tracking the percentage of availability over an extended period? (Day, week, month, quarter, year, or longer)

03.02.30 What is the expected availability during peak hours?

03.02.31 What is the acceptable availability during peak usage hours?

03.02.32 What is the acceptable amount of time to react to an outage?

03.02.33 When is the best time to perform maintenance?

03.02.34 What is the accepted tolerance for system failure or unexpected downtime?

03.02.35 What is an acceptable amount of time to correct a problem?

03.02.36 What is a reasonable time to wait for retrieval of information or materials stored off site?

03.02.37 What is an acceptable amount of time to perform maintenance?

03.02.38 What activities or tasks are more time critical than others?

03.02.39 What time periods must be avoided for upgrades and maintenance?



03.02.40 Depending on time of day, what means of notification should be used?

03.02.41 What else should I be asking about availability “timing”?

03.02.42 What users access the system in a location that is susceptible to availability issues?

03.02.43 What business locations must have access to the system?

03.02.44 What peak periods of usage vary by location?

03.02.45 What time periods must be avoided for upgrades and maintenance by business location?

03.02.46 What processes are performed at each location?

03.02.47 What resources are needed at each business location to prevent downtime?

03.02.48 What hardware/software and people resources are needed at each location to perform routine maintenance?

03.02.49 What else should I be asking about availability “data”?

03.02.50 What emergency access should be extended to each user class?

03.02.51 What are the expectations on system availability?

03.02.52 What emergency access is expected for each user class?

03.02.53 What percent of problems reported to the first level support group (for example, help desk) should be handled by the first level support group?

03.02.54 What advanced warning to users of planned outage is expected?

03.02.55 What information or materials are archived and stored off-site?

03.02.56 What information or materials are difficult to retrieve?

03.02.57 What are the “normal” business hours of operation?

03.02.58 What causes the most pain when the system is not available?

03.02.59 What else should I be asking about availability “logistics”?

03.02.60 What processes may have diminished availability due to degradation?

03.02.61 What notification is needed when the system is completely down?



03.02.62 What notification is needed when the system is partially down?

03.02.63 When the system is not available, what alternatives are there?

03.02.64 What external communications are the source of availability issues?

03.02.65 What processes should have availability limitations?

03.02.66 What else should I be asking about availability “processes”?

03.02.67 What processes use data for business that can be recovered following a system outage?

03.02.68 What processes or procedures are followed to continue doing business due to system malfunction?

03.02.69 What workarounds do the users use if the system is unavailable?

03.02.70 What triggers availability limitations?

03.02.71 What special processes run for government purposes?

03.02.72 What uses of the system are most apt to have availability issues?

03.02.73 What business processes cannot be performed if the system is down?

03.02.74 What processes are compromised by the loss of related processes?

03.02.75 What events or conditions may occur that would delay access to inputs/outputs?

03.02.76 What events or conditions may occur that would prevent access to inputs/outputs?

03.02.77 What processes cause the greatest loss of company productivity when unavailable?

03.02.78 What processes are dependent on the most system resources?

03.02.79 What routine maintenance is performed on the system? When is it performed?

03.02.80 What processes use data for business that cannot be recovered following a system outage?

03.02.81 What challenges do users have in inputting information or materials?

03.02.82 What else should I be asking about availability “roles”?

03.02.83 What challenges do users have in retrieving information or materials?



03.03.00 When?

03.03.01 When are multiple means of notification used?

03.03.02 When do the users need access to the information and materials they want?

03.03.03 When should emergency access be extended to bypass normal access restrictions?

03.03.04 If the system cannot be available “24/7” or “all the time,” when are acceptable periods or conditions for the system to be unavailable?

03.03.05 When can upgrades be scheduled?

03.03.06 When should the availability limitations be imposed?

03.03.07 When are periods of planned/expected peak usage?

03.03.08 When do the users need to prepare or enter inputs?

03.03.09 When should correction escalation be invoked?

03.03.10 When should notification escalation be invoked?

03.03.11 When do the users need to retrieve or get outputs?

03.03.12 When do the users need to perform their work?

03.03.13 When are the users trying to do their jobs?

03.03.14 When are the most critical business periods? (time of day; busy season)

03.04.00 How?

03.04.01 How does notification depend on time of day?

03.04.02 After an outage, how should users be notified of system availability?

03.04.03 How does off-site storage hinder or delay productivity?

03.04.04 How would users describe availability?

03.04.05 How does routine maintenance hinder or delay productivity?

03.04.06 How would I define availability in terms of the functions that are performed?

03.04.07 How much permanent business loss is acceptable?



03.04.08 If the system is not available, how is the business affected?

03.04.09 How much is the business (sponsor) willing to invest to reduce the chance of downtime or failure?

03.04.10 How do security devices or procedures hinder or delay access of information or materials?

03.04.11 How does availability vary by time of day?

03.04.12 How would I define availability in terms of users that perform the work?

03.04.13 How do users in varying business locations need access to the system differently?

03.04.14 How long can the system be down before there is permanent business loss?

03.04.15 How will system usage be monitored by location?

03.04.16 How should availability limitations be imposed?

03.04.17 How does availability vary by function?

03.04.18 If the system/application is not available, how is business conducted?

03.04.19 How long is the user able to conduct business if the system/application is down?

04.00.00 Backup and Recovery

04.01.00 Who?

04.01.01 Who is authorized to perform system backups and restores?

04.02.00 When?

04.02.01 When should data be backed up?

04.03.00 How?

04.03.01 How frequently should data backups be taken?

04.03.02 How frequently should data be archived?

05.00.00 Business Events

05.01.00 What?

05.01.01 What is the response from the event?



05.01.02 What is the reaction of the system to each business event?

05.01.03 What is the response to each business event?

05.01.04 What events occur weekly?

05.01.05 What events occur monthly?

05.01.06 What events occur quarterly?

05.01.07 What events occur annually?

05.01.08 What is the minimum occurrences of each event?

05.01.09 What are the maximum occurrences of each event?

05.01.10 What events must the business support?

05.01.11 What are the business rules for the calculations used?

05.01.12 What is the system response from the event?

05.01.13 What actions take place when the event is triggered?

05.02.00 How?

05.02.01 How does the activity differ in terms of which user initiates the event?

05.02.02 How does the business event get triggered?

05.02.03 How are users added, changed, deleted, reviewed, and monitored?

06.00.00 Capacity

06.01.00 What?

06.01.01 What is the greatest number of simultaneous users during peak processing? Anticipated future usage?

06.01.02 What is the anticipated growth?

06.01.03 What peak load is anticipated?

06.01.04 What time-critical processes are expected?

06.01.05 What makes these processes time critical?



06.01.06 What happens to the system during the time-critical processes when too much time is taken?


06.01.08 What processes include complex calculations?

06.01.09 What is the typical number of users accessing the system simultaneously?

06.01.10 What processes require large volumes of data?

06.01.11 What part of the system does this performance target apply to?

06.01.12 What is the rate at which the system can process things?

06.02.00 How?

06.02.01 How shall the system respond when warning thresholds are hit?

07.00.00 Data

07.01.00 Who?

07.01.01 Who can validate that the process works correctly?

07.01.02 Who (role) is responsible for the underlying infrastructure?

07.01.03 Who (role) is responsible for entering the special information in the configuration?

07.01.04 Who is responsible for knowing the special information?

07.01.05 Who (user role) is responsible for the data?

07.01.06 Who views information?

07.01.07 Who should know about changes made to data?

07.01.08 Who has the authority to verify derived data?

07.01.09 Who has the authority to override approval decisions?

07.02.00 What?

07.02.01 What causes information to be created?



07.02.02 What causes information to be updated?

07.02.03 What causes information to be deleted?

07.02.04 What causes a change in status to information?

07.02.05 What derived data is stored?

07.02.06 What data are received from other systems, stored by this system, and must not be changed by this system?

07.02.07 What data elements must always be encrypted to all users?

07.02.08 What data elements must always be encrypted to all access attempts?

07.02.09 What data elements are completely blocked from unauthorized access?

07.02.10 What data elements are partially blocked from unauthorized access?

07.02.11 What if data became corrupted?

07.02.12 What combinations of data elements must not be shown to any group of people except the highest authorized?

07.02.13 What data elements require a higher level of security to access?

07.02.14 What information is updated based on the event?

07.02.15 What information history is customized by the user?

07.02.16 What data elements must have unique values?

07.02.17 What are special handling requirements for certain data types?

07.02.18 What control parameters will be stored and maintained?

07.02.19 What standards for managing common data elements like name and address fields apply?

07.02.20 What is the anticipated rate of requests for the addition of new features/functions?

07.02.21 What should be the measurement of a feature added to the product?

07.02.22 What levels of restricted access to any information exist?

07.02.23 What additional devices can be anticipated?

07.02.24 What considerations need to be given for configuration information?



07.02.25 What are the exceptions to user actions?

07.02.26 What is done when an exception occurs?

07.02.27 During what processes is information reusable?

07.02.28 What would prevent implementing changes in the current workflow?

07.02.29 What else should I be asking about flexibility “processes”?

07.02.30 What is the date presentation standard?

07.02.31 What date, time, date and time, attributes must be enforced consistently?

07.02.32 What check digit routines will be used by the system?

07.02.33 What data access methods must be used?

07.02.34 In what level of detail is history needed?

07.02.35 What information is needed to monitor adherence to business policies?

07.02.36 What types of notification methods can be anticipated?

07.02.37 What information is passed with the system response?

07.02.38 What information is heavily accessed?

07.02.39 What calculations on the data are performed?

07.02.40 What special information is needed to add a new interface?

07.02.41 Under what circumstances should information not be transferred?

07.02.42 What information is needed about each business object?

07.02.43 What are the expectations of the role for the one entering special information about the configuration?

07.02.44 What types of new customers might be added?

07.02.45 What is the expectation for adding new types of users?

07.02.46 What information is needed to facilitate user customization?

07.02.47 What information is needed about each user class?

07.02.48 What additional information about each business object would be nice to know?



07.02.49 What information requires quick access?

07.02.50 What encryption algorithms can be anticipated?

07.02.51 What quantity of data can be transmitted at one time?

07.02.52 What configuration settings are established at the user level?

07.02.53 What information do users need to perform a process?

07.02.54 What information is captured or modified by this process?

07.02.55 What error, informational, and help messages do users need?

07.02.56 What else should I be asking about flexibility “roles”?

07.02.57 What is the range of the degree a business policy might be broken?

07.02.58 During what times can the business policy be broken with no action required?

07.02.59 What additional input file formats can be anticipated?

07.02.60 What features/functions could be affected by regulatory control?

07.02.61 What is the value of being first to market with an innovation?

07.02.62 What user frustrations must be addressed, from the current release, to promote widespread use of the system?

07.02.63 What types of new products might be added?

07.02.64 What types of new services might be added?

07.02.65 What is the performance expectation for extending the system?

07.02.66 What is the extent to which the business policy might be broken?

07.02.67 What external factors cause business change?

07.02.68 What features/functions are most susceptible to external changes?

07.02.69 What enhancement capabilities can be expected?

07.02.70 What features/functions must be most flexible to respond to business changes?



07.02.71 What additional output file formats can be anticipated?

07.02.72 What types of new users might be added?

07.02.73 What other processes receive the same information requests from the users?

07.02.74 What interfaces with external systems can be anticipated?

07.02.75 What else should I be asking about flexibility “data”?

07.03.00 Where?

07.03.01 Where does information come from?

07.03.02 Where does information go?

07.04.00 When?

07.04.01 When doing new installations, what is the expected level of expertise for the installer?

07.05.00 Why?

07.05.01 Why should users be allowed to set their preferred date presentation?

07.05.02 Why should users be allowed to set their preferred presentation standards?

07.06.00 How?

07.06.01 How mature is the business for this application?

07.06.02 How does adherence to business policies vary by user class?

07.06.03 As the business evolves, how might this system be affected?

07.06.04 How many different types of features/functions are anticipated?

07.06.05 How large could the change be as a result of a regulatory change?

07.06.06 How frequently can additions be expected?

07.06.07 How quickly must the company respond to customer feedback?

07.06.08 How aggressive are the competitors in the same market space?

07.06.09 How fast must enhancements be completed?

07.06.10 How does the additional infrastructure alter the project scope?



07.06.11 How different will these new features/functions be from those expected in this release?

07.06.12 How much configuration special information is managed by the system?

07.06.13 How quickly should new devices be made available to users?

07.06.14 How much effort is expected for adding new, common devices?

07.06.15 How often is the calculated result needed?

07.06.16 How would you describe the purpose of the data used.

07.06.17 How do these new types of users differ from current users?

07.06.18 How is the information used?

07.06.19 How would users like to see or view information?

07.06.20 How often can a calculated result change?

07.06.21 How would users like to access information?

07.06.22 How does the quantity of instances vary by specific user?

07.06.23 How long must the information be available to the user?

08.00.00 Development

08.01.00 Where?

08.01.01 Where will software be changed or added?

08.01.02 Where will hardware be changed or added?

08.01.03 Where will the system be developed?

09.00.00 Errors

09.01.00 What?

09.01.01 What constitutes a serious error?

09.01.02 What errors must be tracked?



10.00.00 Integrity

10.01.00 Who?

10.01.01 Who triggers the business event?

10.01.02 Who is the recipient of the business event?

10.01.03 Who should be notified if a failure occurs?

10.01.04 Who should not trigger this event?

10.01.05 Who should be denied access through each communication type?

10.01.06 Who has authority to trigger the process?

10.01.07 Who triggers each event?

10.01.08 Who gets the response from the event?

10.01.09 Who (user/customer role) is authorized to delete data?

10.01.10 Who owns the interface between components/systems?

10.01.11 Who will need access during backup/restore procedures?

10.01.12 Who has authority to override backup/restore procedures?

10.01.13 When a multiple data store application is used, who (what component/system) is responsible for monitoring the other components/systems?

10.01.14 Who needs access to the information at each business location?

10.01.15 Who can best describe the process?

10.02.00 What?

10.02.01 What support processes might be affected by the system?

10.02.02 What else should I be asking about integrity “processes”?

10.02.03 What are concerns for the wholeness or completeness of the information?

10.02.04 If information exists within another system, what is the condition of the data?

10.02.05 What information already exists within another system?



10.02.06 What information is needed to perform the process?

10.02.07 What is the output of the process?

10.02.08 What is the relationship of each information group with other groups?

10.02.09 What kinds of user activities cause data corruption?

10.02.10 What multi-part information entry applications should the user/customer be allowed to recommence entry?

10.02.11 What data must be archived?

10.02.12 What information is needed to enforce business policies?

10.02.13 What multi-part information should be retained if a failure occurs partway through the entry?

10.02.14 What records of events happening are needed?

10.02.15 What history of changed data is needed?

10.02.16 In addition to the company security, what must this application do to protect the data?

10.02.17 What are concerns for the authenticity of the information?

10.02.18 What are information concerns for the genuineness or faithfulness of true representation?

10.02.19 What other steps must be taken to protect information?

10.02.20 What availability or assured service of information must be maintained?

10.02.21 What data are not made available for hardcopy reports?

10.02.22 What data should be backed up?

10.02.23 What are the expectations for data backup?

10.02.24 What are the expectations for data recovery?

10.02.25 What is needed to do each user’s job?

10.02.26 What data are stored locally (user’s computer) while using the application?

10.02.27 What is the cardinality between related information?

10.02.28 What controls over data mining of the application data must be put in place?

10.02.29 What safeguards must be put in place for information that resides externally?



10.02.30 What else should I be asking about integrity “data”?

10.02.31 What would be the risk to the business if an unauthorized user triggered the event?

10.02.32 Under what conditions can approval decisions be overridden?

10.02.33 What should happen when another component/system has not completed its responsibility?

10.02.34 What users initiate which business events?

10.02.35 What component/system is authorized to change data?

10.02.36 What component/system is authorized to delete data?

10.02.37 What users must see data only related to their role?

10.02.38 What roles are constrained to particular high-level analytics?

10.02.39 What roles have access to reporting system data but will be restricted from access to analytic system data?

10.02.40 What component/system is responsible for the data?

10.02.41 What information must be protected from which user classes at all costs?

10.02.42 What is the impact on the customer’s business if the information is out of date?

10.02.43 What consequences are there for two different users having two different versions of the data?

10.02.44 What control is required to authorize changes to data?

10.02.45 What user audit processes are in place currently?

10.02.46 What could be done to improve user audit controls?

10.02.47 What else should I be asking about integrity “roles”?

10.02.48 What are legal concerns in performing this process? Not performing the process?

10.02.49 What restrictions need to be applied to each user class?

10.02.50 What are the effects on business if a user class does not have access to requested information?

10.02.51 What makes that data necessary to protect?

10.02.52 What would be the effect on business if a user class does not have access for a few days, or a few weeks?



10.02.53 What audit trail of access to sensitive or confidential data should be kept?

10.02.54 What audit trail of unsuccessful data access should be maintained?

10.02.55 What audit trail of failed user actions should be kept?

10.02.56 What security violations that the system detects should be recorded?

10.02.57 What record of incorrect authentication (for example, password) entry should be kept?

10.02.58 What combination of data would cause serious damage to the business if made available?

10.02.59 What data must always be presented together for an accurate representation of the business?

10.02.60 What restrictions should be placed on modifying timed changes?

10.02.61 What audit trail of user actions should be kept?

10.02.62 What record should be kept of the frequency that data is viewed? Changed?

10.02.63 What audit trail of error conditions detected by the system shall be recorded?

10.02.64 What information must be captured when approval decisions are overridden?

10.02.65 What log of changes should be maintained?

10.02.66 What evidence of processes being run or executed are necessary?

10.02.67 What transaction history is needed? A transaction is a representation of an event or occurrence that happens at a point in time.

10.02.68 What audit trail of significant system events should be kept?

10.02.69 What steps should be taken to audit data quality?

10.02.70 What data functions must have time of activity recorded?

10.02.71 What audits must be in place to detect improper usage of data by either authorized or unauthorized users/customers?

10.02.72 What audits must be in place to detect improper usage of data by either authorized or unauthorized components/systems?

10.02.73 What integrity checks must be in place to validate data after a restore?

10.02.74 What integrity checks must be in place to validate data after recovery?



10.02.75 What integrity checks must be in place to validate data after an abnormal event?

10.02.76 What data must be available for high-level analytics of the business?

10.02.77 What are the greatest concerns regarding access to reports produced by the analytic system?

10.02.78 What information will provide user confidence that the system is working?

10.02.79 In what business areas would failure to perform hurt the business the most?

10.02.80 If users were away for two weeks, what would be the first things they checked upon returning?

10.02.81 What else should I be asking about integrity “purpose”?

10.02.82 What should happen if a user is in the middle of entering a timed change when its time is reached?

10.02.83 What should happen to a timed change that needs approval but hasn’t been approved by the time it’s due?

10.02.84 What are the expectations for data restore?

10.02.85 What sequence must the process follow?

10.02.86 What stimulates the business event to occur?

10.02.87 At what logical points or triggers should the user be aware that information entered has been retained?

10.02.88 What timed changes to information occur?

10.02.89 What coordinated changes to information occur?

10.02.90 What incremental changes of data should be stored between backups?

10.02.91 What else should I be asking about integrity “timing”?

10.02.92 What users access the system in a location that is susceptible to data corruption?


10.02.94 What information audits should be performed at each business location?

10.02.95 What are the peak periods of usage that vary by location?

10.02.96 What geographic dependencies are there to the business events?

10.02.97 What data are stored in multiple places?



10.02.98 What data will be stored locally?

10.02.99 What time periods must be avoided for backup/restore procedures by business location?

10.02.100 What data manipulation processes are performed at each location?

10.02.101 What resources are needed at each business location to safeguard integrity?

10.02.102 What hardware/software and people resources are needed at each location to perform audit processes?

10.02.103 What data elements must be presented in combination and not as individual elements?

10.02.104 What else should I be asking about integrity “logistics”?

10.02.105 What functions should each user be allowed to perform?

10.02.106 What types of technology equipment are currently used?

10.02.107 What types of communication are currently used?

10.02.108 What is the relationship between business events?

10.02.109 What happens to the output from the process?

10.02.110 What are the current responsibilities of the users?

10.02.111 What steps are needed to ensure data are represented in the manner intended by the source/authority?

10.02.112 What steps are needed to ensure data are maintained in the manner intended by the source/authority?

10.02.113 What areas cause bottlenecks or issues?

10.02.114 What information must be updated by a particular user class while other users are viewing the information?

10.02.115 What entry of information could be disrupted?

10.02.116 What happens if either the system or an external interface system fails during the transmission of data?

10.02.117 What controls must be in place when transforming data from reporting systems to analytic data stores?

10.02.118 What steps should be taken to deal with loss of data from multi-part entry?



10.02.119 What processes or procedures need to be in place to protect software from viruses that can cause data loss or corruption?

10.02.120 What processes or procedures need to be in place to protect hardware?

10.03.00 Where?

10.03.01 Where would users hate to see something go wrong?

10.03.02 Where should the user recommence entering information later on, from the point they had reached previously?

10.03.03 Where does the output from the process go?

10.04.00 When?

10.04.01 When a failed component/system returns, what initiates recovery?

10.04.02 When should changes to data be committed?

10.04.03 When will data quality be measured?

10.04.04 When will data security be measured?

10.04.05 When the user is interrupted during data entry, where does the user expect to resume entry?

10.05.00 Why?

10.05.01 Why would each user interact with the system?

10.06.00 How?

10.06.01 How does the existing data need to change in the system under development?

10.06.02 How does each business policy affect information groups?

10.06.03 How long should backed-up data be retained?

10.06.04 How long will data be stored to allow user/customer to complete entry in a multi-part entry system?

10.06.05 How long should transaction history be retained?

10.06.06 How long should archived data be retained?



10.06.07 How long should the system retain partial data from interrupted entry?

10.06.08 When data are changed, how long should the previous value be retained?

10.06.09 When data are changed, how many generations of previous values need to be retained?

10.06.10 How does each business policy affect each user class?

10.06.11 Once verified, how is externally sourced data changed?

10.06.12 How does the process differ by user class?

10.06.13 How are high-level analytics constrained by role?

10.06.14 How will the information be used?

10.06.15 How are data levels of access granted?

10.06.16 How many concurrent users are there for each communication type?

10.06.17 How does this event conflict with business policies?

10.06.18 How is this event triggered by business policies?

10.06.19 How does each business policy affect business events?

10.06.20 How is the business policy dependent on another policy?

10.06.21 How does the satisfaction of this business policy affect another policy?

10.06.22 How much data can be lost?

10.06.23 How will data access be audited?

10.06.24 How should the system prompt the user to verify data when an interrupted entry is resumed?

10.06.25 How long is the current communication response time?

10.06.26 How does data transmission vary by business location?

10.06.27 How do integrity needs vary by business location?

10.06.28 How do users in varying business locations access information differently?



10.06.29 How are business policy geographically dependent?

10.06.30 How does the process vary by geographic location?

10.06.31 How should the coordination of data stored in multiple data stores be managed?

10.06.32 How should data stored in multiple data stores be recovered?

10.06.33 How does off-site storage help or hurt integrity?

10.06.34 How will system usage be monitored by location?

10.06.35 How does processing differ between deleting and canceling information?

10.06.36 How are derived data verified before presentation?

10.06.37 How would the users like the system to work?

10.06.38 How is access of sensitive data controlled?

10.06.39 How is externally sourced data verified?

10.06.40 How should coordinated changes be managed? (multi-site, multi-platform, multi system)

10.06.41 How will data security be measured?

11.00.00 Interfaces

11.01.00 Who?

11.01.01 Who sets the rules for the interface?

11.02.00 What?

11.02.01 What timing expectations exist when using the interface?

11.02.02 What timing constraints must be considered while using interfaces?

11.02.03 What internal systems will interface with the system under development or installation?

11.02.04 What external systems will interface with the system under development or installation?

11.02.05 What are other systems this specific system must connect with?

11.03.00 When?

11.03.01 When is the interface upgraded?



11.04.00 How?

11.04.01 How often is the interface upgraded?

11.04.02 How well and how quickly must the interface recover from a failure?

12.00.00 International

12.01.00 What?

12.01.01 What current languages are supported?

12.01.02 What nationalities and languages must be supported?

12.01.03 What currencies must be supported?

12.01.04 What are possible new sites in the same country?

12.01.05 What dialects within languages must be supported?

12.02.00 How?

12.02.01 How does the system need to support currency conversion?

13.00.00 Interoperability

13.01.00 Who?

13.01.01 Who should not be using this system?

13.01.02 Who should be involved in supplying requirements regarding business policies, rules, and procedures?

13.01.03 Who owns the interface?

13.01.04 Who has expertise in the technology?

13.01.05 Who will build the interface adapter?

13.01.06 Who must be alerted when the interface fails?

13.01.07 Who is responsible for the interface?

13.01.08 Who maintains the interface documentation?

13.01.09 Who (role) coordinates the interfaces?

13.01.10 Who (role) approves addition/removal of interfaces?



13.01.11 Who will be responsible for the integration of the interfaces?

13.01.12 Who has access to the required technology?

13.02.00 What?

13.02.01 What information is expected to be customizable by the customer?

13.02.02 What information is missing from reports currently produced?

13.02.03 What need is there to record what was sent and received on the interface?

13.02.04 What kinds of data exchange are envisioned (query, update, create)?

13.02.05 What need is there to record acknowledgment of receipt from the other system?

13.02.06 What documentation exists for the interface?

13.02.07 What need is there to detect missing or duplicated traffic?

13.02.08 What information must be exchanged with other systems?

13.02.09 What else should I be asking about interoperability “data”?

13.02.10 What are the standards and abilities of the external supplier?

13.02.11 What customers expect the latest device to be available?

13.02.12 What customers are early adapters of new technology?

13.02.13 What are the roles and responsibilities of each “who” identified?

13.02.14 What role will the business partners play in the development of this system?

13.02.15 What external suppliers use the interface?

13.02.16 What kind of customers will want to use this system?

13.02.17 What internal departments will interface with the system under development or installation?

13.02.18 What external departments will interface with the system under development or installation?

13.02.19 What new roles will be needed?

13.02.20 What other interfaces exist with this external supplier?

13.02.21 What else should I be asking about interoperability “roles”?



13.02.22 What is the impact of not having the interface?

13.02.23 What agreements (contracts, obligations) have been put in place?

13.02.24 What agreements (contracts, obligations) must be secured?

13.02.25 What state, national, and international laws affect the processes performed by the system under development?

13.02.26 What corporate policies will affect the system?

13.02.27 What additional limits exist that should be imposed on customers?

13.02.28 What additional limits exist that should be imposed on business partners?

13.02.29 What policies must change to meet new business objectives?

13.02.30 What other applications would interface for exchange of data?

13.02.31 What corporate policies of business partners conflict with the system?

13.02.32 What is the effect on business if an imposed policy was not followed?

13.02.33 What legal policies must be enforced to protect the company?

13.02.34 For each policy, what would be the impact on the business if the rule is not enforced?

13.02.35 What data are important to the business?

13.02.36 What data are important to the business partners?

13.02.37 What information is the customer interested in?

13.02.38 What types of future interfaces are anticipated?

13.02.39 What is the purpose for the interface?

13.02.40 What protections are needed from the external vendor?

13.02.41 What would be the effect on the business if this event were not handled by the system?

13.02.42 What rules must be enforced to maintain profitability?

13.02.43 What are restrictions on the format or medium that must be used for input or output?

13.02.44 What specifications are needed for the interface adapter?

13.02.45 What controls are needed over change?



13.02.46 What interfaces require special access control?

13.02.47 What specific technology must be used?

13.02.48 What specific technology should not be used?

13.02.49 What industry standard protocols must be applied to this application?

13.02.50 What version(s) of industry standards must be followed?

13.02.51 What need is there to switch the interface on and off?

13.02.52 What additional usages exist for this interface?

13.02.53 What is the trade-off with efficiency, reliability, and integrity?

13.02.54 If there are multiple interface alternatives, what alternative is preferred priority for use?

13.02.55 What standards for interfaces does the company require?

13.02.56 What industry standards exist for the interface?

13.02.57 What is a widely accepted standard for this interface?

13.02.58 What inputs are coming from systems outside the proposed system?

13.02.59 What outputs are sent to systems outside the proposed system?

13.02.60 What else should I be asking about interoperability “purpose”?

13.02.61 What business conditions would trigger an action by the system?

13.02.62 What happens at the start of a normal workday?

13.02.63 What happens at the end of a normal workday?

13.02.64 What other standard periods drive activities?

13.02.65 What business events are cyclical?

13.02.66 What is the average number of occurrences of each event?

13.02.67 What else should I be asking about interoperability “timing”?

13.02.68 What volume of information is currently provided from each location?

13.02.69 What volume of information is currently received from each location?



13.02.70 What else should I be asking about interoperability “logistics”?

13.02.71 What forms of access will the customers use?

13.02.72 What forms of access with the business partners require?

13.02.73 What are alternatives when the interface fails?

13.02.74 What happens when the interface changes?

13.02.75 What configuration parameters are required?

13.02.76 What commercial software will be part of the interface?

13.02.77 What ways are necessary to support users adding their own devices?

13.02.78 What problems can we anticipate with upgrading users to new technology?

13.02.79 What alternate routes (multiple interfaces) exist between the systems?

13.02.80 What influence on interface design can we exercise?

13.02.81 What load levels have been tested on the interface?

13.02.82 What options are available for the interface?

13.02.83 What are possible alternatives for the interface?

13.02.84 What else should I be asking about interoperability “processes”?

13.03.00 Where?

13.03.01 Where is the interface incomplete for our intended use?

13.03.02 Where can documentation for industry standards for this interface be found?

13.03.03 Where do the business partners operate?

13.04.00 When?

13.04.01 When are periods of time that information will be accessed more than others?

13.04.02 When (during what peak times) will the system be used for any of the role types?

13.04.03 When are the peak times that each event occurs, if any?

13.04.04 When is the information exchanged?



13.04.05 When adding new devices will the communications protocol be standard?

13.05.00 Why?

13.05.01 Why is the data important to the business?

13.05.02 Why is the system needed?

13.06.00 How?

13.06.01 How would other departments or people describe the data?

13.06.02 How does one user role type differ from another?

13.06.03 How does each person, department, or system that interfaces with the system under development receive and/or provide information?

13.06.04 How many of each role type are expected to interact with the system in the first month of operation? First year?

13.06.05 How does this external supplier rate on the vendor scorecard?

13.06.06 How will customers find the information they want?

13.06.07 How important is each “who” that has been identified?

13.06.08 How quickly do new devices reach the market?

13.06.09 How important is each data group to the success of this system?

13.06.10 How important is each policy to the success of the system?

13.06.11 How important is each event to the system under development?

13.06.12 How important is each location to the system?

13.06.13 How are conflicts with the standards reconciled?

13.06.14 How would I describe the purpose of the interface?

13.06.15 How much new information is expected the first month through the first year that the new system is operating?

13.06.16 How quickly must the application adopt the new devices?

13.06.17 How will the interface be stress-tested?



13.06.18 How many generations of interfaces must be supported?

13.06.19 How is the interface upgraded?

13.06.20 How many versions of the communications protocol are in use?

13.06.21 How widely used is the interface?

14.00.00 Locations

14.01.00 What?

14.01.01 What is the skill level of those users in remote locations for managing installations and upgrades?

14.01.02 What type of information is transferred by each business location?

14.01.03 What are the plans for additional locations?

14.01.04 What kinds of things should the system be able to support multiples of?

14.01.05 What is different (how diverse) about each new site?

14.01.06 What are possible new sites in the same industry?

14.01.07 What are possible new sites within the organization?

14.01.08 What would be the priority by geographic location and business processes?

14.01.09 What is the availability time frame at each location?

14.01.10 What are the possible variations within a single installation?

14.02.00 Where?

14.02.01 Where are customers located?

14.02.02 Where does the business operate?

14.02.03 Where (in what sites) will the system be installed?

14.03.00 How?

14.03.01 How does routine maintenance vary by business location?

14.03.02 How does system availability vary by business location?

14.03.03 How many users need access at each location?



14.03.04 How rapidly will languages be added?

14.03.05 How much information would be retrieved by each business location?

14.03.06 How much information is uploaded by each business location?

15.00.00 Maintainability

15.01.00 Who?

15.01.01 Who should be notified if scheduled maintenance will be delayed or not performed?

15.01.02 Who supports the users when maintenance is performed?

15.01.03 Who needs access security to perform system maintenance?

15.01.04 Who should be notified when time-triggered maintenance tasks fail?

15.01.05 Who performs routine maintenance?

15.01.06 Who performs system upgrades?

15.01.07 Who migrates enhancement releases?

15.01.08 Who owns the points of interface?

15.01.09 Who is responsible when an interface with a device fails?

15.01.10 Who is responsible for the interface?

15.01.11 Who (what role) will be performing the maintenance?

15.01.12 Who (role) will be authorized to manage control parameters?

15.01.13 Who should be notified of maintenance tasks and schedules?

15.01.14 Who needs to monitor maintenance records?

15.02.00 What?

15.02.01 What expectations are there for uninstalling the whole system?

15.02.02 What expectations are there for uninstalling system components?

15.02.03 What expectations are there for re-installing alternate configurations?

15.02.04 When external factors cause change, which factors require a system response?



15.02.05 What is expected for adding a new instance?

15.02.06 What is the hardware and software that is currently used?

15.02.07 What licensing controls should be implemented?

15.02.08 What simplifications of multiples are acceptable?

15.02.09 What means for extending features are available in the current design?

15.02.10 What design considerations need to be made for adding physical devices?

15.02.11 What is the trade-off between innovative and incremental releases?

15.02.12 What is the expected combination of modifying existing features and adding new features?

15.02.13 What will be the user acceptance test criteria?

15.02.14 What is the trade-off between flexibility and performance?

15.02.15 What else should I be asking about flexibility “purpose”?

15.02.16 What fiscal reporting periods will the system be expected to support?

15.02.17 What is the trade-off between small, quick feature changes and large, more time consuming feature changes?

15.02.18 What is the lead-time notice of regulation change?

15.02.19 What is the rate of regulation change?

15.02.20 What would be the expected performance for peak periods?

15.02.21 What information transmissions vary by user class?

15.02.22 What information transmissions vary by device type?

15.02.23 What is the expected volume growth of information over the next year? Five years? Ten years?

15.02.24 What history information will be accessed immediately?

15.02.25 What are the considerations for making upgrades by skipping release levels?

15.02.26 What is the sequence in which the events must occur?

15.02.27 What else should I be asking about flexibility “timing”?

15.02.28 What level of support for multiple features is expected?



15.02.29 What other related business areas might this system support?

15.02.30 What are the plans for installation at remote locations?

15.02.31 What additional/alternate database platforms can be anticipated?

15.02.32 What else should I be asking about flexibility “logistics”?

15.02.33 What additional functions/features can be anticipated?

15.02.34 What combinations of information and processing requires special access privileges?

15.02.35 What concerns exist about vendor-supplied documentation?

15.02.36 What are the data type attributes that must be enforced consistently?

15.02.37 What are the numeric data attributes that must be enforced consistently?

15.02.38 What numeric standards apply for: signed, unsigned, units, and rounding?

15.02.39 What maintenance records should be kept?

15.02.40 What messaging formats must be used?

15.02.41 What maintenance schedule information do users need?

15.02.42 What else should I be asking about maintainability “data”?

15.02.43 What effect do maintenance activities have on customers?

15.02.44 What effect do maintenance activities have on users?

15.02.45 What points of interface exist with vendor components?

15.02.46 What level of access is expected of the maintenance staff?

15.02.47 What else should I be asking about maintainability “roles”?

15.02.48 What response time is expected for adding simple, moderate, or complex enhancements?

15.02.49 What is the expected skill level of the enhancement development team?

15.02.50 What preventative maintenance should be applied?

15.02.51 What external mandates for upgrades or changes impact the project?

15.02.52 What features are most likely to change?



15.02.53 What proposed standards or changes to existing standards exist?

15.02.54 What anticipated new releases expand functionality?

15.02.55 What are the drivers of business change?

15.02.56 What changes to the business organization could affect the system?

15.02.57 What types of mandatory changes can be expected?

15.02.58 What business rules could change that would affect the system?

15.02.59 What date management and terminology will be used consistently by the system?

15.02.60 What degree of complexity is anticipated for add-on enhancements?

15.02.61 What is the importance of staying on current releases?

15.02.62 What hardware devices or software features are expected to require the most frequent maintenance?

15.02.63 What audits are performed on maintenance service levels?

15.02.64 What user interface and presentation design standards should be in place?

15.02.65 What are standard display formats for all data attribute types?

15.02.66 What file format and database interface standards must be in place?

15.02.67 What are the industry standard messaging formats?

15.02.68 What protocols must be used?

15.02.69 What are the industry standards for the protocols?

15.02.70 What will be needed to keep business running while software or hardware is being replaced or upgraded?

15.02.71 What concerns exist about vendor supplied software?

15.02.72 What are the cost expectations for maintenance enhancements?

15.02.73 What are the known industry standards?

15.02.74 What trade-offs are there between maintenance and availability?

15.02.75 What trade-offs are there between maintenance and reliability?

15.02.76 What trade-offs are there between maintenance and flexibility?



15.02.77 What elements must be defined to develop an acceptable service-level agreement?

15.02.78 What changes in the regulations could affect the system?

15.02.79 What service level agreements are in place with the customers?

15.02.80 What vendor agreements are in place on the software?

15.02.81 What regulations govern this application?

15.02.82 What else should I be asking about maintainability “purpose”?

15.02.83 What lead-time notice is there for mandatory changes?

15.02.84 What are the seasons in this line of business?

15.02.85 What time standard has been established?

15.02.86 What are the responses necessary due to seasonality?

15.02.87 What industry changes are anticipated?

15.02.88 What changes are anticipated in the industry or organization?

15.02.89 What elements or features change frequently due to external events, decisions, or regulations?

15.02.90 What specific time frames during the day should maintenance activities be avoided?

15.02.91 What peak periods in processing cause maintenance concerns?

15.02.92 What maintenance is triggered by time of day?

15.02.93 What maintenance is triggered by events?

15.02.94 What maintenance is performed automatically by the system?

15.02.95 What else should I be asking about maintainability “timing”?

15.02.96 What time zone is the standard for the system?

15.02. 97 Where is the most maintenance needed?

15.02.98 What maintenance support is expected at each location?

15.02.99 What maintenance is performed at each location?

15.02.100 What changes in the configuration environment could affect the system?



15.02.101 What will be the environment of use?

15.02.102 What will be the development environment used?

15.02.103 What level of maintenance is required at each business location?

15.02.104 What routine maintenance is performed at each business location?

15.02.105 What maintenance is performed offsite?

15.02.106 What is the schedule for upgrades or releases at each location?

15.02.107 What time-triggered maintenance is performed at each location?

15.02.108 What event-triggered maintenance is performed at each location?

15.02.109 What else should I be asking about maintainability “logistics”?

15.02.110 On what types of operating environments/hardware configurations will this system be deployed?

15.02.111 Under what events or conditions should this system deviate from any standard?

15.02.112 Under what conditions is the industry standard messaging format not adequate?

15.02.113 Under what conditions is the industry standard protocol not adequate?

15.02.114 What features are strongest from the competitors?

15.02.115 What features are most appealing to the customers?

15.02.116 What workaround processes are performed while the system is being maintenanced?

15.02.117 What functions are limited or unavailable during maintenance?

15.02.118 What type of support is needed from the vendors?

15.02.119 What vendor devices will be used in this system?

15.02.120 What types of harsh conditions are hardware components subject to that could cause frequent failure?

15.02.121 What provisions exist for modification of the industry standard messaging format?

15.02.122 What provisions exist for modification of the industry standard protocol?



15.02.123 What are current procedures and processes for system maintenance?

15.02.124 What maintenance activities are performed automatically?

15.02.125 What maintenance activities are performed manually?

15.02.126 What is the expected skill level of the maintenance team?

15.02.127 What is the expected interruption when adding, changing, or repairing a hardware device?

15.02.128 What types and varieties of hardware devices will be used on the system?

15.02.129 What is the expectation for repairing related, non-repaired defects?

15.02.130 By location, what maintenance is done manually?

15.02.131 By location, what maintenance is automated?

15.02.132 What else should I be asking about maintainability “processes”?

15.03.00 Where?

15.03.01 Where will the system need agility to remain viable with the expected business growth?

15.03.02 Where is the source code escrowed to prevent emergency situations from vendor supplied software?

15.04.00 When?

15.04.01 When should users be notified that a business policy might potentially be broken?

15.04.02 When is the expected peak period for each user class?

15.04.03 When is the expected peak period for each business event?

15.04.04 When is the expected peak period for each business location?

15.04.05 When is information needed?

15.04.06 When is the peak period that data transmission occurs?

15.04.07 When (what specific time) must downloaded information be available?

15.04.08 When (during what time periods) is information accessed more than others?

15.04.09 When (at what point) in the process in the information needed?

15.04.10 When (during what time frames) is routine maintenance unacceptable?



15.04.11 When should routine maintenance be performed?

15.04.12 When could future installations happen?

15.04.13 When will it be necessary to perform maintenance on hardware devices?

15.05.00 How?

15.05.01 How will the system manage software license expiration?

15.05.02 How easy should it be to “plug in” a new interface?

15.05.03 How difficult is it to modify or extend the application to meet specific needs?

15.05.04 How long is the system expected to be in use?

15.05.05 How often are new sites added for installation?

15.05.06 How rapidly is the business changing or evolving?

15.05.07 How tolerant of change are the users/customers of the system?

15.05.08 How frequently will different currencies be added?

15.05.09 How quickly must new features/functions be completed?

15.05.10 How long should information be kept?

15.05.11 How soon is the history needed for analysis?

15.05.12 How often is information transmitted?

15.05.13 How often must the information be uploaded?

15.05.14 How often must the information be updated?

15.05.15 How fast must installations be completed?

15.05.16 How broad (and how limited) is the set of environments for which the system should be suitable?

15.05.17 How will the system monitor adherence to business policies?

15.05.18 How will the system know that users are who they claim to be?

15.05.19 How much experience does the current staff have with the devices?



15.05.20 How quickly must enhancements be added?

15.05.21 How easy should it be to change devices?

15.05.22 How are early adopters in this line of business served?

15.05.23 How mature is the line of business this application is being built to support?

15.05.24 How mature is the industry in this line of business?

15.05.25 How stable is the configuration environment?

15.05.26 How frequently will enhancements be added to the system?

15.05.27 How fast-paced are the competitors’ responses?

15.05.28 How frequently do the devices require repair?

15.05.29 How often are maintenance releases expected?

15.05.30 How often do upgrades to interfaces get released?

15.05.31 How often do upgrades to components get released?

15.05.32 How often do regulations change?

16.00.00 Monitoring

16.01.00 Who?

16.01.01 Who is responsible for monitoring system faults, recoveries, and repairs?

16.01.02 Who is responsible for survivability aspects of purchased software and hardware?

16.01.03 Who gets called when system failures occur?

16.02.00 How?

16.02.01 How will system throughput be monitored by location?

16.02.02 How will system capacity be monitored by location?

16.02.03 How will system response time be monitored by location?

17.00.00 Organizational Change

17.01.00 Who?



17.01.01 Who is responsible for training the users?

17.01.02 Who is responsible for supporting the users?

17.02.00 What?

17.02.03 What are the expectations for users to learn the system without providing training?

17.02.04 What specific needs of the prospective users must be met?

17.02.05 What user classes require more help than others?

17.02.06 What particular sequence should be used to train the users?

17.02.07 What user classes have the most volume of data entry errors?

17.02.08 What volume of users are there currently? Expected in the future?

17.02.09 What users input the most data?

17.02.10 What usability characteristics are requested by novice users? By expert users?

17.02.11 What help features are most frequently used? What features are not used?

17.02.12 What user classes use existing help features?

17.02.13 What else should I be asking about usability “roles”?

17.02.14 What similar systems are available that the users are familiar with and like to use?

17.02.15 What similar systems are available that the users are familiar with and do not like to use?

17.03.00 How?

17.03.01 How would I describe the typical user of the system.

17.03.02 How would I describe the “novice” or “beginner” user.

17.03.03 How would I describe the “expert” or “power” user.

17.03.04 How much user to user collaboration happens while using the system?

17.03.05 How do different levels of users view the relationships within the data?

17.03.06 How well will the users remember how to use the low-frequency features?

17.03.07 How do the users “feel” about the system?



17.03.08 How will users be trained?

18.00.00 Performance

18.01.00 Who?

18.01.01 Who should receive notification when there are system failures?

18.01.02 Who is authorized to access what data?

18.01.03 Who (role) should receive warning messages as thresholds are exceeded?

18.01.04 Who performs routine performance tuning?

18.01.05 Who gets called when the system is not performing as expected?

18.01.06 Who should receive system performance audit reports?

18.02.00 What?

18.02.01 What is the outgoing source of throughput peak volume?

18.02.02 What is the incoming source of throughput peak volume?

18.02.03 What requests require indicators of progress while processing?

18.02.04 What requests require estimates of time remaining before completion?

18.02.05 What warning thresholds can be set as capacity grows?

18.02.06 What is the balance between incoming and outgoing throughput?

18.02.07 What else should I be asking about efficiency “data”?

18.02.08 What are the expectations on system efficiency?

18.02.09 What are the expectations on system response time?

18.02.10 What are the expectations on system throughput?

18.02.11 What are the expectations on system capacity?

18.02.12 What users should have a need for greater efficiency than others?





18.02.15 What limits to the number of simultaneous users apply?

18.02.16 What forcible eject/reject requirements exist for a user?

18.02.17 What types of users can be affected by traffic metering?

18.02.18 What else should I be asking about efficiency “roles”?

18.02.19 What demand spike can we anticipate?

18.02.20 What response time expectations are there by function?

18.02.21 What class or category levels of performance can be defined?

18.02.22 What level of throughput is expected of the system?

18.02.23 What is the minimum number of events the system must store?

18.02.24 What performance is measured?

18.02.25 What timeframe does this performance requirement need to meet?

18.02.26 What is the maximum acceptable response time end-to-end?

18.02.27 What percentage of time is the stated response time expected?

18.02.28 What volume levels will be measured, and in what timeframes?

18.02.29 What performance indicators are most important to the business?

18.02.30 On what basis is this performance goal specified?

18.02.31 What is a tolerable length of response time?

18.02.32 What is the expected response time in [unit of measure]?

18.02.33 What is the expected throughput in [unit of measure]?

18.02.34 What is the expected capacity in [unit of measure]?

18.02.35 What is the expected (accepted) average response time?

18.02.36 What is the expected (accepted) maximum response time?

18.02.37 What is the expected (accepted) average throughput?



18.02.38 What is the expected (accepted) minimum throughput?

18.02.39 What is the expected (accepted) maximum throughput?

18.02.40 What is the expected speed to complete the task?

18.02.41 What is an acceptable mode of operation when the system has been degraded in some manner?

18.02.42 At what load level can response begin to degrade?

18.02.43 What is acceptable degradation during peak times?

18.02.44 What have been barriers to expected performance?

18.02.45 What is the worst that can happen if the requirement is not met?

18.02.46 What are risks associated with performance problems?

18.02.47 What is an acceptable cost of monitoring?

18.02.48 What is the capacity of the system to store events of a particular type?

18.02.49 What functions are candidates for metering response time?

18.02.50 What are the predictors of high volume activity?

18.02.51 What circumstances or conditions must be met from the operating environment?

18.02.52 What efficiency conditions might exist from vendor hardware?

18.02.53 What efficiency conditions might exist from vendor software?

18.02.54 What is typical off-peak throughput? Peak throughput?

18.02.55 What is the expected duration of peak use activity periods?

18.02.56 What time of day will peak usage occur?

18.02.57 What requests have maximum response time limits?

18.02.58 What requests have minimum response time limits?

18.02.59 What requests have maximum sequential response time limits?

18.02.60 What requests have minimum sequential response time limits?

18.02.61 What requests are sequential with maximum time limits?



18.02.62 What requests are sequential with minimum time limits?

18.02.63 What requests require completion by the user within a set period of time?

18.02.64 What requests require completion by the user after a set period of time?

18.02.65 What timeframe is this capacity expected?

18.02.66 What should the balance be between primary and secondary processes?

18.02.67 What are the most important activities to process during peak load times?

18.02.68 What activities can be reduced during peak load times?

18.02.69 What else should I be asking about efficiency “timing”?

18.02.70 What users access the system in a location that is susceptible to efficiency issues?

18.02.71 What users in varying business locations need access to the system differently?

18.02.72 What peak periods of usage vary by location?

18.02.73 What part of the system do each of the performance requirements pertain?

18.02.74 What time periods must be avoided for performance tuning by business location?


18.02.76 What resources are needed at each business location to increase efficiency performance?

18.02.77 What hardware/software and people resources are needed at each location to execute performance tuning?

18.02.78 What else should I be asking about efficiency “logistics”?

18.02.79 What are acceptable response times during exception processing?

18.02.80 What messages can be sent when warning thresholds are hit?

18.02.81 What response is expected when stated capacities are exceeded?

18.02.82 What exception processes must be considered?

18.02.83 What development techniques may be used to improve retrieval time?



18.02.84 What processing considerations (encryption, protocols, message sets) must be included in the application?

18.02.85 What operations are dependent upon vendor software?

18.02.86 What is the average expected hardware configuration?

18.02.87 What vendor software is under the company’s control?

18.02.88 What are the minimum hardware specifications expected for implementation to support the performance requirements?

18.02.89 What hardware could constrain development?

18.02.90 What is the lowest common denominator for design consideration of user equipment?

18.02.91 What are known resource limitations?

18.02.92 What can be done if the performance cannot be met?

18.02.93 What can be done if the performance is not met?

18.02.94 What else should I be asking about efficiency “processes”?

18.03.00 Where?

18.03.01 Where did the tolerable response time come from?

18.04.00 When?

18.04.01 When is an acknowledgment before results an expected response?

18.04.02 When should multiple people be notified?

18.04.03 When does measurement start and stop?

18.04.04 When should performance be measured?

18.04.05 When during the week, month, quarter, and year will peak times occur?

18.04.06 When can traffic be metered for limiting access?

18.04.07 When should text versus graphical design considerations be used?

18.05.00 Why?

18.05.01 Why is this level of performance needed?



18.06.00 How?

18.06.01 How much data should be retained for each user?

18.06.02 How much data should be retained for each customer?

18.06.03 How much data should be retained for each transaction?

18.06.04 How much data should be retained for each product?

18.06.05 How long should the data be retained?

18.06.06 How long should the data be retained for real-time access?

18.06.07 How many things can the system cope with and work on at once?

18.06.08 How critical is this performance factor?

18.06.09 How will volume of activity be measured?

18.06.10 How can performance be measured?

18.06.11 How should performance be monitored?

18.06.12 How much resource should be allocated to monitoring?

18.06.13 How critical to the business are the performance requirements?

18.06.14 How much is acceptable to pay for this level of performance?

18.06.15 How often should performance be measured?

18.06.16 How do peak activity periods compare to normal activity periods of use?

18.06.17 How does routine performance tuning vary by business location?

18.06.18 How does system efficiency vary by business location?

18.06.19 How does off-site storage capacity hurt or help performance?

18.06.20 How long does it take the system to satisfy user requests?

18.06.21 How much main memory is needed to support the system?

18.06.22 How much secondary storage space is needed to support the system?



19.00.00 Portability

19.01.00 Who?

19.01.01 Who will be porting the system to different environments or locations?

19.01.02 Who is accountable for the portability requirements?

19.01.03 Who might identify the portability requirements?

19.01.04 Who is knowledgable in the portability requirements of the technology being used?

19.01.05 Who can approve language translation?

19.02.00 What?

19.02.01 What portability requirements must be communicated to suppliers?

19.02.02 What portability requirements must be communicated to customers/users?

19.02.03 What portability requirements from other systems or projects can be reused?

19.02.04 What data files must be portable?

19.02.05 What else should I be asking about portability “data”?

19.02.06 What customers are expected to be early adopters of new technology?

19.02.07 What else should I be asking about portability “roles”?

19.02.08 What is the possibility of moving to a new platform?

19.02.09 What will be different when moving to a new environment?

19.02.10 What copyright, patent, and trademark requirements need to be addressed internationally?

19.02.11 What intentions are there to remain an industry leader?

19.02.12 What local governmental regulations need to be addressed?

19.02.13 What are the required operating environments?

19.02.14 What operating environment is considered the base environment?

19.02.15 What is the transportability of the software? Hardware?

19.02.16 What other applications will co-exist in the operating environment?



19.02.17 What types of database platforms are expected to be supported?

19.02.18 What constraints exist in the target component configuration?

19.02.19 What are the criteria for selecting new hardware configurations?

19.02.20 What are the criteria for selecting new software and firmware configurations?

19.02.21 What standard display formats for all data attribute types must be used?



19.02.24 What date, time, date and time attributes must be enforced consistently?

19.02.25 What new device types can be anticipated for future implementation?

19.02.26 What plans are being made to move to new environments?

19.02.27 What is the growth potential for the industry?

19.02.28 What are possible trade-offs between portability and reusability?

19.02.29 What are possible trade-offs between portability and reliability?

19.02.30 What are expectations for new or emerging implementations in the industry?

19.02.31 What else should I be asking about portability “purpose”?

19.02.32 What is the established time zone standard?

19.02.33 What else should I be asking about portability “timing”?

19.02.34 What taxes and customs must be managed when adding new countries?

19.02.35 What languages may we add in the future?

19.02.36 What language is the base language?

19.02.37 What languages do our customers/users speak?

19.02.38 What import/export taxes could apply in other countries?

19.02.39 What is the capability to partially disassemble the software/hardware for physically moving?

19.02.40 What equipment will need special documentation to cross the borders?



19.02.41 What is the likelihood that the software/hardware or product will survive shipping hazards?

19.02.42 What configuration constraints might exist in certain countries?

19.02.43 What is the compatibility of the software/hardware with standard moving equipment and vehicles such as trucks and forklifts?

19.02.44 What else should I be asking about portability “logistics”?

19.02.45 What interfaces are required?

19.02.46 What combinations of components will be used?

19.02.47 What changes in technology are available and may be possible to take advantage of in the future?

19.02.48 What various combinations of system by environment are there?

19.02.49 What could be the expected changes to development environments?

19.02.50 What component configurations are expected?

19.02.51 What network configurations are expected?

19.02.52 What implementation strategies should be used to develop portable software?

19.02.53 What system/applications are dependent upon other system/applications or components?

19.02.54 What system/applications or components are dependent upon the organization’s system/application?

19.02.55 With what other system/applications or components must the organization’s system/application co-exist?

19.02.56 When moving to a new platform, what components are included?

19.02.57 On what operating environments will this system be deployed?

19.02.58 When upgrades are made to the systems, what is the release sequence by configuration environment?

19.02.59 When deploying on devices, what configurations must be considered?

19.02.60 What are the expected operating environments?

19.02.61 What possible constraints exist in potential component configurations?

19.02.62 What components are most likely to move to a new platform?

19.02.63 What else should I be asking about portability “processes”?



19.02.64 If the product will be shipped, what considerations must be given to protecting the product during shipping?

19.03.00 Where?

19.03.01 Where should portability requirements be stored for accessibility?

19.04.00 How?

19.04.01 How adaptable to technology changes are the customers?

19.04.02 How important is portability?

19.04.03 How do competitors release their products?

19.04.04 How is configuration management coordinated between environments: development, test, and deployment?

19.04.05 How mature is the industry this system supports?

19.04.06 How will this environment change with new systems?

19.04.07 How will this implementation be an industry leader?

19.04.08 How soon will technology changes be available?

19.04.09 How rapidly are new devices expected to be introduced?

19.04.10 When an opportunity arises to move to a new environment, how quickly must the business be available?

19.04.11 How quickly do competitors move to new technology?

19.04.12 How will language translation be managed?

19.04.13 How will international support be addressed?

19.04.14 How stable/mature is the development environment?

19.04.15 How are enhancement releases managed through multiple configuration environments?

19.04.16 How many database platforms are anticipated to be used on installations?



20.00.00 Processes

20.01.00 Who?

20.01.01 Who enforces the adherence to business policies?

20.02.00 What?

20.02.01 What should occur if a business policy is not followed?

20.02.02 What processes are legally required?

20.02.03 What processes are required by contract obligation?

20.02.04 What processes will be used by the most customers?

20.02.05 What processes will be used by the most users?

20.02.06 What processes are most dependent on the system being available?

20.02.07 What source can provide an accurate count of existing processes?

20.02.08 What source can provide an accurate volume count of existing transactions?

20.02.09 What processes produce the most revenue?

20.02.10 What processes produce the least revenue?

20.02.11 What processes manage the most time-sensitive data?

20.02.12 What processes manage the least time-critical data?

20.02.13 What processes have the most recoverable data?

20.02.14 What processes have the least recoverable data?

20.02.15 What processes are the most frequently used?

20.02.16 When availability of a process is lost, what processes take the longest to regain a normal state of productivity?

20.02.17 When availability of a process is lost, what processes are the quickest to regain a normal state of productivity?



20.03.00 Why?

20.03.01 Why does the process work that way?

20.04.00 How?

20.04.01 How would I describe the current workflow?

20.04.02 How does the process work today?

21.00.00 Recovery

21.01.00 What?

21.01.01 What types of users can be affected by fault and repair monitoring?

21.01.02 What skill level of technician is required to recover or restore the system?

21.01.03 What else should I be asking about survivability “roles”?

21.01.04 What measures are in place to recover software and hardware from unauthorized access?

21.02.00 How?

21.02.01 How would I define “recovery”?

21.02.02 How would I define “system restore”?

22.00.00 Reliability

22.01.00 Who?

22.01.01 Who is responsible for monitoring system errors and outages?

22.01.02 Who is responsible for reliability of purchased software and hardware?

22.01.03 Who should receive notification when there are system outages?

22.01.04 Who should receive notification when there are system errors?

22.01.05 Who is authorized to perform what functions on the system?

22.01.06 Who is authorized to access what data?

22.01.07 Who should receive warning messages when errors occur?



22.01.08 Who performs system upgrades and releases?

22.01.09 Who gets called when system outages occur?

22.01.10 Who receives system error/failure audit reports?

22.02.00 What?

22.02.01 What are the classifications for found defects?

22.02.02 What is considered a critical bug or defect?

22.02.03 What acknowledgment is required indicating that someone has taken responsibility for the problem?

22.02.04 What notifications are necessary at the time of system failure?

22.02.05 What means of notification are currently used?

22.02.06 What training and documentation must be provided for the critical components?

22.02.07 What types of reports or validations are available or necessary to monitor system accuracy?

22.02.08 What system failure reports are needed?

22.02.09 What system failure data are captured currently?

22.02.10 What system performance data are needed by auditors?

22.02.11 What error messages and error detection information trails are provided by the system?

22.02.12 What alternate, cross-check calculations can be performed to validate derived data?

22.02.13 What components manage unrecoverable data?

22.02.14 What should the system maintain on an event log?

22.02.15 What data exists for use in rigorous testing to achieve the level of desired reliability?

22.02.16 What else should I be asking about reliability “data”?

22.02.17 What source can provide an accurate count of existing end-users?

22.02.18 What source can provide an accurate count of existing customers?

22.02.19 What source can provide an accurate count of existing processes?

22.02.20 What source can provide an accurate volume count of existing transactions?



22.02.21 What are the user expectations for system reliability?

22.02.22 What are the customer expectations for system reliability?

22.02.23 What users should have a need for greater reliability than others?

22.02.24 What user classes need to be notified when there is a serious error?



22.02.27 What limits apply to the number of simultaneous users?

22.02.28 What types of users can be affected by error and failure metering?

22.02.29 What skill level of technician is required in an outage?

22.02.30 What else should I be asking about reliability “roles”?

22.02.31 What is the acceptable level of known bugs or defect rate allowed to migrate into production?

22.02.32 What service agreements are in place with vendors of purchased hardware and software?

22.02.33 What is the cost of lost/incorrect data?

22.02.34 What is the business benefit of the expected level of reliability?

22.02.35 What is the cost of lost business when the expected level of reliability is not achieved?

22.02.36 What system components must run for extended periods of time without failure?

22.02.37 At the time of a problem, what component(s) must receive immediate attention?

22.02.38 What degree of recovery or restart is expected of failed components?

22.02.39 Under what circumstances would the whole system be required to shut down?

22.02.40 What is the expected rate of reliability?

22.02.41 What are the success factors for the level of desired reliability?

22.02.42 What is the severity of impact if failures occur?

22.02.43 What is the measurement of defect rate?

22.02.44 What is the acceptable spending limit for this level of reliability?



22.02.45 What components are most critical to the business?

22.02.46 What components manage the most expensive/critical business elements?

22.02.47 What functions do customers rely on the most?

22.02.48 What functions do users rely on the most?

22.02.49 What components can be sacrificed, temporarily, for the more critical components?

22.02.50 What are the criteria defining classes of errors?

22.02.51 What tolerance for error is acceptable?

22.02.52 What purchased software and hardware are being used?

22.02.53 What different measures (expectations) exist for the hardware than for the software?

22.02.54 What has been the history of releases from vendors?

22.02.55 What is the history/track record for similar installations of vendor components?

22.02.56 What software and hardware is considered outdated?

22.02.57 What hardware components should be replaced?

22.02.58 What are business consequences when system failure occurs?

22.02.59 What is the trade-off between reliability and efficiency?

22.02.60 What is the trade-off between reliability and availability?

22.02.61 What is the business cost of less than that level of reliability?

22.02.62 What is the cost of achieving that level of reliability?

22.02.63 What else should I be asking about reliability “purpose”?

22.02.64 What is the required interval for system checking?

22.02.65 What is the minimum expected time duration between outages caused by defects?

22.02.66 What is the maximum expected time duration to fix defects?

22.02.67 What is the expected mean time between system failures?

22.02.68 What is the expected mean time to repair the system?



22.02.69 What components must be available during an outage?

22.02.70 During what time period(s) is system reliability most critical?

22.02.71 What else should I be asking about reliability “timing?”

22.02.72 What are the peak periods of usage that vary by location?

22.02.73 What expected users of the application are localized? Dispersed?

22.02.74 What locations require reliability the most?

22.02.75 What users access the system in a location that is susceptible to reliability issues?


22.02.77 What remote access facilities are in place/necessary?

22.02.78 What environmental conditions must be created to simulate the planned installation environment for testing to achieve that level of reliability?

22.02.79 What time periods must be avoided for upgrades and maintenance by business location?


22.02.81 What resources are needed at each business location to restore a system?

22.02.82 What resources are needed at each business location to prevent system failure?

22.02.83 What hardware/software and people resources are needed at each location to perform routine maintainance?

22.02.84 What is the measure of accuracy with which a given algorithm is being implemented for a specific software and hardware environment?

22.02.85 What else should I be asking about reliability “logistics”?

22.02.86 What monitoring tools must be in place?

22.02.87 What measures of reliability need to be tracked?

22.02.88 What ensures the accuracy of range and value checks?

22.02.89 What metrics are used to ensure that all the numeric fields are the right (same) size?

22.02.90 What ensures that all the artificial limits on size and number are eliminated?

22.02.91 What ensures the completeness of test cases?



22.02.92 What escalation procedures are required during an outage?

22.02.93 What alternatives are available during an outage?

22.02.94 What fault-tolerance does the application require?

22.02.95 What off-site redundant implementation procedures are required?

22.02.96 What access control extensions are necessary and permissible to address the problem?

22.02.97 What vendor access is necessary for problem resolution?

22.02.98 What configuration management steps are in place for production control?

22.02.99 What procedures need to be in place to address any failures that occur?

22.02.100 What ensures a high degree of confidence in the accuracy of the information?

22.02.101 What should be in place for the system to detect then prevent unauthorized access?

22.02.102 What procedures are used to ensure that all the data edited properly?

22.02.103 What process steps can be taken to verify information accuracy?

22.02.104 What will show that mathematical functions are within real number tolerances?

22.02.105 What sources of information are available to validate the values for derived data?

22.02.106 What is the measure of adequacy with which the implemented algorithm relates to real-world interactions?

22.02.107 What test plan should the Quality Assurance testing group follow?

22.02.108 What can be done to reduce exposure to components that run for extended periods of time and cannot fail?

22.02.109 What are the appropriate locations and intervals to check critical data elements for accuracy?

22.02.110 What response time to outages is required?

22.02.111 What response time to defects (errors not causing outages) is required?

22.02.112 What functions in the production environment should be replicated in a test environment?

22.02.113 What amount of regression testing is minimal when repairing defects?

22.02.114 What amount of regression testing is minimal when making enhancements?



22.02.115 What are known weak points in the network?

22.02.116 What systematic error detection and correction monitoring is required?

22.02.117 What tools do users need to monitor the system?

22.02.118 What procedures must be in place to ensure that the data are backed up correctly and are recoverable?

22.02.119 What control over vendor software do users have?

22.02.120 What is the plan to manage vendor upgrade releases?

22.02.121 What measures of control are in place on vendor software update releases?

22.02.122 What stress tests can be applied?

22.02.123 What else should I be asking about reliability “processes”?

22.03.00 Where?

22.03.01 Where are known weak points in the network?

22.04.00 When?

22.04.01 When is the system most reliable?

22.04.02 When is the system least reliable?

22.04.03 When are system upgrades and fixes migrated into production?

22.05.00 Why?

22.05.01 Why are there different measures needed for hardware than software?

22.06.00 How?

22.06.01 How much in-house support for purchased software and hardware is necessary?

22.06.02 How would I define “system failure”?

22.06.03 How would I define “repaired”?

22.06.04 How wide is the exposure to error on the network?



22.06.05 How is the monitoring system audited?

22.06.06 How does system reliability vary by business location?

22.06.07 How do users in varying business locations experience system failure more than others?

22.06.08 How does off-site processing help or hurt reliability?

22.06.09 How will system errors and outages be monitored by location?

22.06.10 How should the system respond under stress?

22.06.11 How do releases of production fixes vary by location?

22.06.12 How will the algorithm be tested to confirm it works as intended?

22.06.13 Compared to how it works in the real world, how will users know an algorithm does what it should?

22.06.14 How frequently are system enhancements expected?

22.06.15 How can the known weak points in the network be avoided by this system?

22.06.16 How is system monitored for detection of errors that do not cause outage?

22.06.17 How is system precision and accuracy monitored?

22.06.18 How fail safe is the monitoring system?

22.06.19 How should defects be handled, as “fixed as found” or packaged into releases?

23.00.00 Reusability

23.01.00 Who?

23.01.01 Who may have an issue with providing reusability?

23.01.02 Who may have knowledge of similar projects or similar requirements?

23.01.03 Who else has done a similar project in the past?

23.01.04 Who is onboard with reusability?

23.02.00 What?

23.02.01 What documents from other projects could be useful?

23.02.02 What current presentation standards exist?



23.02.03 What else should I be asking about reusability “data”?

23.02.04 What other projects in the organization are compatible, or that cover substantially the same domains or work areas?

23.02.05 What other products involve the same users and thus have similar usability requirements?

23.02.06 What other types of uses of the components are expected?

23.02.07 What else should I be asking about reusability “roles”?

23.02.08 What assumptions from other projects apply?

23.02.09 What constraints have already been defined for another project?

23.02.10 What are the advantages of developing software with reusable components?

23.02.11 What expectations are there to expand the system and be able to reuse elements?

23.02.12 What components are company policy?

23.02.13 What other projects have been launched that are similar?

23.02.14 What other uses for similar applications apply?

23.02.15 What specific elements will be used in other applications?

23.02.16 What is the growth potential for similar applications?

23.02.17 What standards have been defined and implemented in previous projects?

23.02.18 What are problems associated with developing software with reusable components?

23.02.19 What industry standard elements can function in isolation?

23.02.20 What are relevant facts from recent projects?

23.02.21 What are possible trade-offs between reusability and portability?

23.02.22 What is the scope of projects for adjacent systems?

23.02.23 What components are so standard they have usability elsewhere?

23.02.24 What components are fundamental to the application domain and thus will be implemented in future projects or have been implanted in previous projects?

23.02.25 What else should I be asking about reusability “purpose”?



23.02.26 What triggering events are the same as in other business processes?

23.02.27 What event triggers could be used in new ways as a result of this project?

23.02.28 What business processes have the same timing of use?

23.02.29 What future business processes could have the same timing of use?

23.02.30 What else should I be asking about reusability “timing”?

23.02.31 What processes are in use in the same locations as the processes from this project?

23.02.32 What future processes may be deployed in the same locations?

23.02.33 What else should I be asking about reusability “logistics”?

23.02.34 What functionality is considered pilot from this project?

23.02.35 What capabilities can be adopted and modified for this project?

23.02.36 What capabilities can be adapted to other processes as a result of this project?

23.02.37 What implementation strategies should be used to develop reusable software?

23.02.38 What similar functionality exists?

23.02.39 What else should I be asking about reusability “processes”?

23.03.00 Where?

23.03.01 Where has the company been successful with past reusability efforts?

23.04.00 How?

23.04.01 How much funding is available for reusability in the project?

23.04.02 How will pilot functionality be monitored?

23.04.03 How will pilot functionality be expanded?

23.04.04 How will pilot functionality be implemented?

23.04.05 How must software processes evolve to incorporate reuse?

23.04.06 How can software components be generalized so that they are usable across a range of systems?



23.04.07 How do application generators support the reuse of domain concepts?

23.04.08 How can entire application systems be reused when making them available on a range of machines?

24.00.00 Scalability

24.01.00 Who?

24.01.01 Who audits system growth and expansion?

24.01.02 Who should receive scalability reports?

24.01.03 Who is responsible for the business architecture?

24.01.04 Who is responsible for monitoring software and hardware expansion?

24.01.05 Who interfaces with the system that is being upgraded?

24.01.06 Who is responsible for the system architecture?

24.01.07 Who should participate in a system inspection/review?

24.01.08 Who monitors growth trends and patterns?

24.02.00 What?

24.02.01 What scalability data history must be stored?

24.02.02 What analysis reporting of history data is needed?

24.02.03 What scalability data are input to the system?

24.02.04 What scalability data are output from the system?

24.02.05 What scalability data do management request?

24.02.06 What scalability data are necessary for audit purposes?

24.02.07 What scalability data is necessary for regulatory and compliance purposes?

24.02.08 What demographic reporting is needed?

24.02.09 What sources could provide analysis data?

24.02.10 What historical data is stored currently?

24.02.11 What volume data is tracked currently?



24.02.12 What data would help to identify growth trends or patterns?

24.02.13 What else should I be asking about scalability “data”?

24.02.14 What regulatory or government agencies must be notified of expansion?

24.02.15 What sources could provide analysis data?

24.02.16 What else should I be asking about scalability “roles”?

24.02.17 What product or feature is most likely to stimulate growth?

24.02.18 What is the extreme scale of system components?

24.02.19 What is the extreme scale of system features?

24.02.20 What is the extreme scale of system functions?

24.02.21 What magnitude of increase in customers is expected?

24.02.22 What magnitude of increase in users is expected?

24.02.23 What magnitude of increase in products is expected?

24.02.24 What magnitude of increase in sales is expected?

24.02.25 What magnitude of increase in transactions is expected?

24.02.26 What magnitude of increase in inputs is expected?

24.02.27 What magnitude of increase in outputs is expected?

24.02.28 What is the current maximum number of: users, customers, accounts, and transactions?

24.02.29 What is the basis for scalability projections?

24.02.30 What business loss would result from not being scalable?

24.02.31 What business could be lost due to expansion?

24.02.32 What feature of the business is most likely to grow the fastest?

24.02.33 What is the most probable source for growth: users, customers, transactions?

24.02.34 What feature of the business is most likely to grow the most?

24.02.35 What will enable an expansion of the software without a disproportionate increase in hardware?



24.02.36 What will enable an expansion of the software without a disproportionate increase in support personnel?

24.02.37 What is the affect of vertical (software) scaling?

24.02.38 What is the affect of horizontal (hardware) scaling?

24.02.39 What indicators of growth should be monitored?

24.02.40 What response time expectations are there for peak periods?

24.02.41 What noticeable difference between peak periods and normal activity is acceptable?

24.02.42 What event could cause that surprise development?

24.02.43 What throughput volumes are expected during peak periods?

24.02.44 What is the average duration of an upgrade install?

24.02.45 What else should I be asking about scalability “timing”?

24.02.46 What locations could be problematic with sudden increase in business volume?

24.02.47 What types of problems could arise due to variances in locations?

24.02.48 What types of organizational structures are needed to be aware of as the system scales?

24.02.49 What area has been the most constrained so far but is building momentum?

24.02.50 What area has been dismissed for growth potential but could be a surprise development?

24.02.51 What could cause volume projections to change in a particular location?

24.02.52 What locations could increase in volume faster than other locations?

24.02.53 What locations appear to have static volume?

24.02.54 What else should I be asking about scalability “logistics”?

24.02.55 In what ways must the system keep performing just as well as it grows?

24.02.56 What component will be the greatest challenge to scale?

24.02.57 What specific features are needed so that the system will continue to be as easy to use as volumes grow?



24.02.58 What specific features cannot degrade as the systems scales?

24.02.59 What aspect of the system needs to be scalable?

24.02.60 What business activity could lead to rapid increase in business volume?

24.02.61 What system component is the most critical to growth of the business?

24.02.62 What processes in which locations are most susceptible to peak volume pressure?

24.02.63 What business processes are vulnerable to volume pressure?

24.02.64 What events could cause sudden increase in business volume?

24.02.65 What will enable an expansion of the software without a disproportionate increase in ancillary system support? (backup, security, restore, recovery)

24.02.66 What third-party components are in use/planned for use that will have scalability issues?

24.02.67 What architectural feature could be the most difficult to scale?

24.02.68 What is the difference between peak maximum and “normal” volumes in a process cycle?

24.02.69 What specific features are needed by the system to help it be scalable?

24.02.70 What else should I be asking about scalability “processes”?

24.03.00 Where?

24.03.01 Where are the weak points in the architecture?

24.03.02 Where will additional software/hardware be needed to expand the business?

24.03.03 Where will additional maintenance and administering be needed to expand the business?

24.03.04 Where can software be installed on an existing machine?

24.03.05 Where can software be upgraded on an existing machine?

24.03.06 Where might corporate restructuring take place to accommodate growth?

24.04.00 When?

24.04.01 When do peak processing volumes occur?

24.04.02 When are additions or upgrades typically implemented?



24.04.03 When should system expansions be avoided if possible?

24.04.04 When have upgrades been scheduled in the past?

24.04.05 When are specific periods when additions or upgrades should be avoided?

24.05.00 Why?

24.05.01 Why is this level of scalability needed?

24.06.00 How?

24.06.01 How elastic is the anticipated scalability?

24.06.02 How easy must it be to expand the system?

24.06.03 How rapidly might business volume increase?

24.06.04 How might business spurts be one-time events or sustainable?

24.06.05 How might business spurts be sporadic or on-going occurrences?

24.06.06 How can the system scale and continue to meet performance and reliability requirements?

24.06.07 How soon after implementation might business volume increase?

24.06.08 How long does the peak volume last?

24.06.09 How are peak usage volumes measured?

24.06.10 How fast could a surprise happen?

24.06.11 How fast does the volume change from peak to normal levels?

24.06.12 How dynamically can the system be expanded?

25.00.00 Security

25.01.00 Who?

25.01.01 Who is authorized to perform what functions?

25.01.02 Who/what provides inputs to this system?

25.01.03 Who will write security procedures and documentation?

25.01.04 Who/what receives outputs from this system?



25.01.05 Who will want to monitor usage?

25.01.06 Who gives authorization and under what circumstances?

25.01.07 Who has the authority to grant access to the system function?

25.01.08 Who is ultimately responsible for each system function?

25.01.09 Who should be notified when unauthorized access is recognized?

25.01.10 Who/what should not be interacting with the system?

25.01.11 Who needs access to perform non-routine maintenance or emergency fixes?

25.01.12 Who needs access to perform routine maintenance?

25.01.13 Who will be allowed to use the system when it is first installed?

25.02.00 What?

25.02.01 What information must be guarded against unauthorized update or tampering?

25.02.02 What information must be kept confidential?

25.02.03 What information is considered “secret”?

25.02.04 What information must be guarded against unauthorized disclosure?

25.02.05 What would be the impact to the user/customer if data or processing were lost due to a security breach?

25.02.06 What would be the impact to the company if data or processing were lost due to a security breach?

25.02.07 What public data are accessed by the application?

25.02.08 What conditions are associated with authorization?

25.02.09 What delegation rights exist to cover periods of absence by managers or administrators of security?

25.02.10 What user actions require approval?

25.02.11 What are the conditions to deny user/customer access?

25.02.12 What criteria must authentication (for example, password) satisfy to be acceptable?

25.02.13 What user session information should be stored?

25.02.14 What are the sources of external data used by the application?



25.02.15 What safeguards must be put in place for operational (production or run-time operation) information?

25.02.16 What safeguards must be put in place for developmental (development stages) information?

25.02.17 What safeguards must be put in place for information that resides internally?

25.02.18 What user session information is stored currently?

25.02.19 What supplemental authentication information is needed?

25.02.20 What is expected of the database system when the application is no longer in control of the data?

25.02.21 What else should I be asking about access security “data”?

25.02.22 What access privileges are permitted?

25.02.23 What level of access is made available without user/customer authorization and authentication?

25.02.24 What is there a unique identifier for each user class?

25.02.25 What makes the user classes different?

25.02.26 What internal users interface with the system?

25.02.27 What external users interface with the system?

25.02.28 What security concerns do the customers have that must be addressed?

25.02.29 What levels of security apply to inactive users?

25.02.30 What level of security is expected for access to data from outside the application?

25.02.31 What kinds of user classes are impacted by security?

25.02.32 What functions does each user class need to access?

25.02.33 What security clearance level is required of the individuals who are constructing, enhancing, or installing the system?

25.02.34 What else should I be asking about access security “roles”?

25.02.35 What business policies are in place with regard to access security?

25.02.36 What business policies pertain to access security?

25.02.37 What business rules apply to access security?

25.02.38 What business rules exist for privacy of information?



25.02.39 What privacy policy has the company declared with regard to the data and its use?

25.02.40 What privacy laws are applicable with regard to the data?

25.02.41 What local, state, federal, and international laws affect access security?

25.02.42 What happens when access expires?

25.02.43 What security audits are required to monitor application security?

25.02.44 What data protection laws affect access security?

25.02.45 What expectations do the customers have about information privacy?

25.02.46 What promises and assurances have been made to the customers about access security?

25.02.47 What promises and assurances have been made to the customers about information privacy?

25.02.48 What measures for managing hardcopy security are necessary?

25.02.49 What security measures must be extended beyond basic company security?

25.02.50 What keeps the users awake at night with regard to access security?

25.02.51 What access security issues do the users have?

25.02.52 What will provide the users with the required level of confidence in security?

25.02.53 What are the access security concerns of the customers?

25.02.54 What expectations do the customers have about security?

25.02.55 What must be done to demonstrate sound security to the customers?

25.02.56 What system failures could cause significant economic damage to the business?

25.02.57 When do users/customers get blocked from access?

25.02.58 What other security issues should be addressed?

25.02.59 What security issues were experienced in the past?

25.02.60 What system failures could cause some mission to be unaccomplished (mission failure)?

25.02.61 What breach of security attempts have been thwarted in the past?

25.02.62 What is the financial cost to the company of a data security breech?



25.02.63 What is the cost of misuse of the data or product?

25.02.64 What is the effect on competitive advantage due to misuse?

25.02.65 What if a competitor obtained any data?

25.02.66 What is the public perception cost to the company of a data security breech?

25.02.67 What rules are in place for establishing and managing user/customer authentication?

25.02.68 What design and development methods are required to ensure the entire application meets security requirements?

25.02.69 What events make the authorization conditional?

25.02.70 What measures have been taken to detect access security design flaws?

25.02.71 What security measures must be taken to protect the environment?

25.02.72 What hardware and equipment are the users of the system allowed to install?

25.02.73 What software are the users of the system allowed to install?

25.02.74 What security concerns are greater/less than those on other projects? Why?

25.02.75 What else should I be asking about access security “purpose”?

25.02.76 What authorized users are authorized for access at all times?

25.02.77 Under what conditions are more than one approval required?

25.02.78 Under what conditions could locked sessions be broken?

25.02.79 What system components must be locked up when not in use?

25.02.80 What else should I be asking about access security “timing”?

25.02.81 What are different levels of security at the location where disaster recovery hardware, software, and other business artifacts are stored?

25.02.82 What access security is needed for employees that work from home or other remote locations?

25.02.83 What access restrictions are necessary to the work areas where this application will be used?

25.02.84 What security measures must be taken when accessing the application using public computers?



25.02.85 What resources are needed to secure each location?

25.02.86 What reasons are there for this application to run on computers not connected to the internet?

25.02.87 What hardware/software is needed to secure each location?

25.02.88 What security measures are necessary as interfaces pass control through the system?

25.02.89 What else should I be asking about access security “logistics”?

25.02.90 What is the process flow of hardcopy from receipt to destruction?

25.02.91 After denying access, what steps should be taken when a security breech is detected?

25.02.92 What should be done when unauthorized access is recognized?

25.02.93 What procedures need to be in place to safely dispose of confidential documents, files, electronic storage devices, and other media?

25.02.94 What happens when an approver denies approval?

25.02.95 What metrics of security need to be put in place?

25.02.96 If multiple means of authentication are offered, what is the preferred or primary method?

25.02.97 What different security measures must be developed?

25.02.98 What routine audits are performed to detect improper usage, either by authorized or non-authorized users?

25.02.99 What integrity checks prevent unintentional misuse by authorized users?

25.02.100 What security is in place to guard against abnormal events and conditions?

25.02.101 What means of authentication should be offered?

25.02.102 What security conventions apply to the development stages? Testing stages?

25.02.103 What additional precautions should be taken with the hardware/software of the system?

25.02.104 What Quality Assurance (QA) measures must be followed to ensure proper security of the system?

25.02.105 What else should I be asking about access security “processes”?

25.02.106 What users should have limited availability (access) to the system?

25.03.00 Where?



25.03.01 Where is information from the vendors of supplies for this system maintained?

25.03.02 Where is regulatory information maintained?

25.04 00 When?

25.04.01 When should the system provide a user/customer lock session?

25.04.02 When are the periods of high or low usage by the user classes?

25.04.03 When is it possible for any computers to be connected without following all company security policies?

25.04.04 When (at what points during use of the application) should users re-authenticate themselves?

25.05.00 How?

25.05.01 How many levels of data access exist?

25.05.02 How secure are infrequently used data?

25.05.03 How secure are infrequently used hardware/software?

25.05.04 How would I describe the different security levels used.

25.05.05 How many members of each user class are estimated to use the system each month of the first year the system is operational?

25.05.06 How many levels of user/customer access are necessary?

25.05.07 How could a user collaborate with another authorized user to gain access?

25.05.08 How should actions requiring levels of approval be managed?

25.05.09 How are user classes determined?

25.05.10 How is access authorized?

25.05.11 How often are audits conducted by internal staff? External?

25.05.12 How is this project different from other projects with regard to security?

25.05.13 How soon should the system time-out because of inactivity?

25.05.14 How would I specify conditions or circumstances that limit user authorization to access the system?

25.05.15 How long shall access be granted?



25.05.16 How promptly is approval needed?

25.05.17 How will access security be the same at all business locations?

25.05.18 How is access security different for customers accessing information remotely?

25.05.19 How does access depend on the time of day or location of the user at the time of access?

25.05.20 How is access reset?

25.05.21 How do users provide identification (indicate to the system who they are)?

25.05.22 How do users provide authentication (indicate to the system that users are in fact who they claim to be)?

25.05.23 How are users/customers authenticated?

25.05.24 How do the users purge confidential information?

25.05.25 How is hardcopy security monitored?

25.05.26 How do the users dispose of unused software? Hardware?

25.05.27 How must the security measures be implemented?

25.05.28 How do new users/customers self-enroll?

25.05.29 How are users/customers removed from the system?

25.05.30 How will this application be used on computers connected to a network or the internet?

25.05.31 How can the system recognize legitimate users/customers?

25.05.32 How do new users/customers get added to the system?

26.00.00 System Recovery

26.01.00 Who?

26.01.01 Who can validate the calculations?

26.01.02 Who should receive notification when there are system faults?

26.01.03 Who should receive notification when there are system recoveries or repairs?

26.01.04 Who needs to be notified when there are serious damages?



26.01.05 Who is authorized to perform recovery procedures?

26.01.06 Who should receive warning messages when system faults are encountered?

26.01.07 Who will be allowed to restore or recover the system?

26.01.08 When default values are substituted for invalid data, who needs to be alerted?

26.02.00 What?

26.02.01 What is the most likely source of corrupt data?

26.02.02 What measures can be taken to reduce, eliminate, or cleanse corrupt data?

26.02.03 What is the predictability of corrupt data?

26.02.04 What is the expected level of precision on calculations?

26.02.05 What ranges of valid values are known?

26.02.06 What are the applicable limitations for the formulas?

26.02.07 What validation edits are in place for the calculation variables?


26.02.09 What date, time, date and time attributes must be enforced consistently?

26.02.10 What time standard has been established?

26.02.11 What time zone is the standard for the system?

26.02.12 What are the data type attributes that must be enforced consistently?

26.02.13 What default values must be applied for variables when invalid/missing data are found?


26.02.15 What check digit routines will be used by the system?

26.02.16 What volatile interfaces can be eliminated?

26.02.17 What are the test plans for the calculations?

26.02.18 What else should I be asking about survivability “data”?

26.02.19 What is the expected growth rate of the number of users, customers, transactions, and products?



26.02.20 What authorization is necessary to use default values?

26.02.21 What is the source of calculation formulas?

26.02.22 What are the user expectations for system survivability?

26.02.23 What are the customer expectations for system survivability?

26.02.24 What are the conditions under which more than one approval is required?

26.02.25 What faults, conditions, or events make the authorization conditional?

26.02.26 What types of extreme user behaviors can be expected?

26.02.27 What is the cost to the company if there are some failures due to survivability issues?

26.02.28 What aspects must be “fool resistant”?

26.02.29 What is the impact of a failed device?

26.02.30 What extreme conditions of implementation can be expected?

26.02.31 What is the expected operating environment of the system?

26.02.32 What technology is planned for this project?

26.02.33 What is the acceptable trade-off between survivable and available?

26.02.34 What is the acceptable trade-off between survivable and maintainable?

26.02.35 What is the acceptable trade-off between survivable and reliable?

26.02.36 What is the acceptable trade-off between survivable and flexible?

26.02.37 What else should I be asking about survivability “purpose”?

26.02.38 What types of preventative maintenance schedule need to be established for the software and hardware?

26.02.39 What hardware and software must be locked up when not in use?

26.02.40 What else should I be asking about survivability “timing”?

26.02.41 What are the different levels of security at the location where disaster recovery hardware, software, and other business artifacts are stored?

26.02.42 What access security is needed for employees that work from home or other remote locations?



26.02.43 What access restrictions are necessary to the work areas where this application will be used?

26.02.44 What security measures must be taken when accessing the application using public computers?

26.02.45 What resources are needed to recover/restore each location?

26.02.46 What else should I be asking about survivability “logistics”?

26.02.47 What alternatives exist for processing without the corrupt data?

26.02.48 What does the current technology prohibit or hinder?

26.02.49 What recovery capability from errors is expected?

26.02.50 What is the practical minimum number of transactions and events the system must handle?

26.02.51 What is the practical minimum number of users and customers the system must handle?

26.02.52 What procedures are necessary to “show your work” on calculations?

26.02.53 What processes must continue to function or survive with reduced capability when faults occur?

26.02.54 What processes should terminate gracefully when faults occur?

26.02.55 What should the process do to terminate gracefully?

26.02.56 If there are failures due to unexpected corrupt data or hardware failures, what lost business can be recovered?

26.02.57 What workaround is available for a failed hardware device?

26.02.58 What processes performed by the system have manual workarounds?

26.02.59 What types of error conditions might the system encounter?

26.02.60 What can be done to make the hardware devices more robust?

26.02.61 What software and hardware has a history of failures?

26.02.62 What alternatives exist for software and hardware that have a history of failures?

26.02.63 What alternatives exist for any devices currently used?

26.02.64 What design considerations should be made to reduce the impact of anticipated trouble spots?

26.02.65 What design considerations should be made to improve the robustness of anticipated trouble spots?

26.02.66 What hardware fault tolerance is acceptable?



26.02.67 What hardware redundancy is necessary?

26.02.68 What hardware devices must be the most robust?

26.02.69 What is the response plan for a failed device?

26.02.70 What interfaces have the highest degree of volatility?

26.02.71 What alternates are there for the volatile interfaces?

26.02.72 What is the cause of volatility in any interfaces?

26.02.73 What measures are in place to safeguard software and hardware from natural disasters?

26.02.74 What measures are in place to safeguard software and hardware from unauthorized access?

26.02.75 What interfaces are critical to business continuity when faults occur?

26.02.76 What measures are in place to recover software and hardware from natural disasters?

26.03.00 Where?

26.03.01 Where is regulatory information maintained?

26.03.02 Where is backup software and hardware kept?

26.03.03 Where is backup information stored?

26.03.04 In similar applications, where have there been points of failure that should have been more robust?

26.03.00 When?

26.03.01 When are the periods of high or low usage by the user classes?

26.03.02 When are the periods of high or low occurrences of system faults?

26.03.03 When can system restores be run?

26.03.04 When are disaster recovery plans tested?

26.03.05 When can system backups be run?

26.04.00 How?

26.04.01 How can the calculations be validated?

26.04.02 How much data can be recovered when problems occur?



26.04.03 How much data can be lost when problems occur?

26.04.04 How should the system correct/reject nonconforming data?

26.04.05 How many attempts at resolution of bad data should be provided?

26.04.06 How much can be afforded to make the system as sturdy as requested?

26.04.07 How frequently should fault detection processes run?

26.04.08 How often are inspections of hardware and software conducted?

26.04.09 How frequently are repairs migrated into production?

26.04.10 How much time is required to recover the system?

26.04.11 How much time is required to do a system restore?

26.04.12 How will access security be the same at all business locations?

26.04.13 How is access security different for users accessing information remotely?

26.04.14 When extreme input is encountered, how fast must the system respond and recover?

26.04.15 How should the system respond to input errors?

26.04.16 How should the system react to unusual error conditions?

26.04.17 How should the system respond to extreme conditions?

26.04.18 How can the system predict a hardware device failure?

26.04.19 How can the volatile interfaces be reduced in priority?

27.00.00 Testing

27.01.00 Who?

27.01.01 Who are the best testers?

27.01.02 Who loves to beat the system?

27.01.03 Who can supply validation models?

27.01.04 Who will validate help information?

27.01.05 Who would like to see the project/system fail?



27.01.06 Who will do user acceptance testing?

27.01.07 Who will be signing off the system for promotion into production?

27.01.08 Who must perform the test, perform the analysis or demonstration, or inspect the system?

27.01.09 Who gets what hardware?

27.01.10 Who gets what software?

27.01.11 Who will validate that necessary training occurred?

27.01.12 Who will users contact for system support?

27.01.13 Who will validate that the system works at an acceptable level to be implemented?

27.01.14 Who will create a testing traceability model?

27.01.15 Who is responsible for the Quality Assurance (QA) test plan?

27.01.16 Who should participate in reviews?

27.01.17 Who can validate the information during a test?

27.02.00 What?

27.02.01 What defined validation exists for each data element?

27.02.02 What test data must be recorded and how fast must the system output this data?

27.02.03 What test beds of data exist?

27.02.04 What data elements are unique?

27.02.05 What bounds, limits, and ranges of data elements are known?

27.02.06 What data elements have a one-time use?

27.02.07 What data elements can be reused?

27.02.08 What data or special reports are required by the regulatory agencies?

27.02.09 What test data are needed to simulate all user classes?

27.02.10 What classifications of defects are suitable for this system?

27.02.11 What simulated data streams will be needed to test the system?



27.02.12 What is the source of the calculations used in the system?

27.02.13 What purchased hardware/software can be obtained to start the population of information?

27.02.14 What licenses are required with the purchase of hardware/software?

27.02.15 What defects are documented from the design and development team?

27.02.16 What information does each team member need to build and test the system?

27.02.17 What defined data patterns, formats, and presentation styles are there?

27.02.18 What else should I be asking about verifiability “data”?

27.02.19 What customer involvement will be needed to test the system?

27.02.20 What user involvement will be needed to test the system?

27.02.21 What agency has jurisdiction over this product line?

27.02.22 What extra reviews from outside experts or inspectors and liability insurance will be required before the product meets standards?

27.02.23 What liability concerns does the legal department have?

27.02.24 What liability concerns does the insurance provider have?

27.02.25 What customer acceptance testing will be necessary?

27.02.26 What is the known skill level of the development team and their ability to unit test?

27.02.27 What access is required at start-up?

27.02.28 What stakeholders and team members need special access during development?

27.02.29 What stakeholders and team members need special access during testing?

27.02.30 What stakeholders and team members need special access to promote to production?

27.02.31 What else should I be asking about verifiability “roles”?

27.02.32 What are currently common points of failure with the systems and the users?

27.02.33 What is the acceptance criterion for decision regarding promotion to production?

27.02.34 What requirements are there for the origination of every factor?

27.02.35 What requirements will have to be developed in parallel for testing?



27.02.36 What industry standards and any other standards mandated by regulatory agencies apply?

27.02.37 What levels of defect are acceptable?

27.02.38 What level of confidence in the system is required to promote into production status?

27.02.39 What verification requirements will the government, regulatory agencies, and/or insurance carriers place on the product?

27.02.40 What industry product standards apply to product certification?

27.02.41 What tests must be done to satisfy marketing claims?

27.02.42 What tests will validate that the product meets contractual agreements?

27.02.43 What requirements may be difficult to verify and increase risk?

27.02.44 What additional verification costs must be considered?

27.02.45 What is the history of defects from the quality assurance (QA) team?

27.02.46 What is the history of defects from the development team?

27.02.47 What business policies apply to the developers and testers of the system?

27.02.48 What specific design constraints on size and complexity of components should be considered to facilitate testing?

27.02.49 What is the cost of testing versus the cost of defect?

27.02.50 What else should I be asking about verifiability “purpose”?

27.02.51 What customers/users need to be available during design?

27.02.52 What customers/users need to be available during coding and development?

27.02.53 What customers/users need to be available for testing in the quality assurance (QA) environment?

27.02.54 What customers/users need to be available during promotion to production?

27.02.55 What customers/users need to be available during system roll-out?

27.02.56 What additional time is required to verify the system?

27.02.57 What equipment needs to be purchased for roll-out?

27.02.58 What data will need to be populated at start-up?



27.02.59 What functions of the system must be verified during design?

27.02.60 What functions of the system must be verified during coding and development?

27.02.61 What functions of the system must be verified prior to production implementation?

27.02.62 What functions of the system must be verified after roll-out to production?

27.02.63 What types of combinations of activity are expected to happen concurrently?

27.02.64 What else should I be asking about verifiability “timing”?

27.02.65 What extreme environment simulations should be considered?

27.02.66 What regulatory agencies and standards apply to each business location?

27.02.67 What different power, cooling or heating, software or hardware support will the system require during development than it will require in operation?

27.02.68 What prototypes must be developed?

27.02.69 What various places must be included during system testing?

27.02.70 What features must be testable in isolation from the rest of the system?

27.02.71 What calculations are used in multiple locations?

27.02.72 What special facilities or equipment will be needed to test the system?

27.02.73 What additional testing resources (software, hardware, and/or people) are needed?

27.02.74 What else should I be asking about verifiability “logistics”?

27.02.75 What test cases will be written at the requirements level?

27.02.76 What features of the system can expect the most frequent changes or enhancements?

27.02.77 What proof of quality, beyond functional requirements testing, is required to make promotion decisions?

27.02.78 What conditions outside the normal usage must be tested?

27.02.79 What are the most critical functions to test?

27.02.80 What processes have similar or predecessor systems that have run into error conditions?

27.02.81 Due to complexity or criticality, what elements of the system need to be isolated?



27.02.82 What are the highest risk areas to test?

27.02.83 What internal and external interfaces must be tested in addition to the system?

27.02.84 What purchased hardware/software can be obtained to perform specific events?

27.02.85 What test support equipment or software will be needed?

27.02.86 What need is there for a defect tracking tool?

27.02.87 What test scripts have been used in the past?

27.02.88 What are the classification levels of defects/faults?

27.02.89 What features must be testable in combination?

27.02.90 What simulators need to be developed for testing?

27.02.91 What special testing tools will the Quality Assurance (QA) team need?

27.02.92 What could be used from the development and testing environments for verifying the production system?

27.02.93 What else should I be asking about verifiability “processes”?

27.03.00 Where?

27.03.01 Where are the particularly complex elements in this system?

27.03.02 Where will system development be done?

27.03.03 Where will quality assurance (QA) testing be done?

27.03.04 Where (business locations) will the system be implemented?

27.03.05 Where is equipment for rollout needed?

27.03.06 Where will system testing occur?

27.04.00 When?

27.04.01 When is equipment for roll-out needed?

27.04.02 When will development begin?

27.04.03 When will system testing occur?



27.05.00 How?

27.05.01 How are the calculations validated?

27.05.02 How are the factors used in the calculations traced to their origins?

27.05.03 How valid is the test bed of data?

27.05.04 How important is “cost/time to repair” as an evaluation criteria for going to production with known defects?

27.05.05 How important is probability as an evaluation criteria for going to production with known defects?

27.05.06 How important is the degree of impact as an evaluation criteria for going to production with known defects?

27.05.07 How important is risk as an evaluation criteria for going to production with known defects?

27.05.08 With regard to requirements quality criteria, how are the requirements going to be validated?

27.05.09 With regard to requirements quality criteria, how are the requirements going to be verified?

27.05.10 With regard to requirements quality criteria, how are the design components going to be tested?

27.05.11 How will user manuals be available and distributed?

27.05.12 How will defects/faults be classified?

27.05.13 How will the requirements for this system be verified?

28.00.00 Trade-offs

28.01.00 What?

28.01.01 What are the known constraints/restrictions imposed by the system?

28.01.02 What time-accuracy trade-offs have been considered?

28.01.03 What time-space trade-offs have been considered?

28.01.04 What is the trade-off between efficiency and scalability?

28.01.05 What is the trade-off between efficiency and maintainability?

28.01.06 What is the trade-off between efficiency and reliability?

28.01.07 What is the trade-off between efficiency and flexibility?



28.01.08 What else should I be asking about efficiency “purpose”?

29.00.00 Usability

29.01.00 Who?

29.01.01 Who is the intended audience of the system?

29.01.02 Who is the expected user audience?

29.02.00 What?

29.02.01 What is the expected level of precision on calculations?

29.02.02 What are the institutional shorthand notations for common data elements?

29.02.03 What natural clustering of information exists in the business area?

29.02.04 What confirmation of progress is expected?

29.02.05 What levels of user help are necessary?

29.02.06 What levels of user interactive help are expected?

29.02.07 What degree of interactive help is expected?

29.02.08 What level(s) of error message information is expected?

29.02.09 What options should be available to turn on or turn off help features?

29.02.10 What is the maximum number of keystrokes and presentation controls acceptable during data input?

29.02.11 What informative warning messages and error messages are needed?

29.02.12 What input/output devices will be supported?

29.02.13 What sort of input/output devices for the human interface is available and what are their characteristics?

29.02.14 What specific terms, symbols, or expressions are commonly needed to be incorporated?

29.02.15 What “help” facilities or features are needed?

29.02.16 What expectations are there for error messages, descriptions, and definitions in varying lengths depending upon user?



29.02.17 What are the different lengths of error message, description, and definitions?

29.02.18 What data elements are repetitive and may be shortcut during data input?

29.02.19 What “help” documentation is available to the user?

29.02.20 What information or materials do the end users need in order to do their jobs?

29.02.21 What history records of user injuries exist?

29.02.22 What clues for use are the users accustomed to having in their applications?

29.02.23 What historical data are never retrieved by users?

29.02.24 What duplication of input could be eliminated or reduced?

29.02.25 What data labels are inconsistent or confusing?

29.02.26 What data and functions does the help desk get repeated calls about from users?

29.02.27 What additional data could be pre-populated for the user and reduce data entry time and amount?

29.02.28 What data are most frequently retrieved by each user class?

29.02.29 What data are viewed the most by each user class?

29.02.30 What else should I be asking about usability “data”?

29.02.31 What type of users are the end users?

29.02.32 What prior experience are users expected to have?

29.02.33 What is the range in years of experience of the end users?

29.02.34 What is the range in education level of the end users?

29.02.35 What different access levels will be offered to power users and casual users?

29.02.36 What are the data throughput expectations per user role in the department?

29.02.37 What aspects of the system must be foolproof?

29.02.38 What are the expectations regarding training on the new system?

29.02.39 What level of training will be provided, offered, or made available?

29.02.40 What are the expectations for allowing users to alter their presentation format?



29.02.41 What user access control preferences must be retained?

29.02.42 What user access control profiles must be retained?

29.02.43 What experience do we have in developing solutions for users with specific needs?

29.02.44 What is the skill level of the target user group?

29.02.45 What is the skill level of the majority of the primary users?

29.02.46 What percentage of users will have specific needs?

29.02.47 What training will be necessary before using the system?

29.02.48 What is the accessibility for handicapped users?

29.02.49 What are the expectations for allowing users to filter out data?

29.02.50 What do the users consider to be “stressful” aspects of their work?

29.02.51 What do users commonly express as “frustrations” with using the system?

29.02.52 What other interfaces are similar to that used in this system with which the users are familiar?

29.02.53 What similar systems do the users complain about?

29.02.54 What other system could be used as a model for “ease of use”?

29.02.55 What other system could be used as a model for “easy to learn”?

29.02.56 What recognizable system can be used as a model or pattern?

29.02.57 What are examples of good designs to emulate?

29.02.58 What must be included beyond company usability design standards?

29.02.59 What current company usability standards are not adequate?

29.02.60 What usability laws or standards must be adhered to?

29.02.61 What usability improvements have been implemented in the past?

29.02.62 What is the importance that the system is easy to learn?

29.02.63 What is an allowable amount of time needed before users can successfully use the product?

29.02.64 What metrics for user productivity are used?



29.02.65 What are entry rate requirements?

29.02.66 What productivity gains are expected from using the system?

29.02.67 What productivity rate increase, in what timeframe, is expected from the system?

29.02.68 What are handling or error rate requirements?

29.02.69 What error rate decrease, in what timeframe, is expected from the users of the system?

29.02.70 What is an acceptable user error rate when working at normal speed?

29.02.71 What reduction rate of user errors is expected?

29.02.72 What is the rate of errors by the users?

29.02.73 What standards/guidelines for navigation apply?

29.02.74 What complaints are heard most often from the users about systems they use on a regular basis?

29.02.75 What is the trade-off between “easy to use” and “easy to learn”?

29.02.76 What standards/guidelines for amount of data on a presentation or the number of presentations apply?

29.02.77 What government or other regulatory compliance standards must be applied regarding user safety?

29.02.78 What style guidelines should be followed?

29.02.79 What will it take to make a successful system for the user?

29.02.80 What conventions and standards that have been developed for the human-to-machine interface must be applied?

29.02.81 What accident prevention requirements must be considered?

29.02.82 What global safety requirements or constraints must the system satisfy?

29.02.83 What safety issues and concerns must users be educated about?

29.02.84 What are examples of bad designs to avoid?

29.02.85 What will aid in user orientation and recognition when first exposed to the new system?

29.02.86 What safety risks need to be addressed?

29.02.87 In terms of usability, what would make this system better than a competing one?



29.02.88 What is the user trying to achieve by using the system?

29.02.89 What advanced technology could help users be more productive?

29.02.90 What usability design changes are recommended?

29.02.91 What could be done to improve usability?

29.02.92 In what way does training hinder usability?

29.02.93 In what way do user help components hinder usability?

29.02.94 In what way do current system features hinder usability?

29.02.95 What business policies put constraints on usability design?

29.02.96 What design standards constrain usability design?

29.02.97 What usability issues are potential business risks?

29.02.98 What design standards must be applied to ensure consistency?

29.02.99 What else should I be asking about usability “purpose”?

29.02.100 What is the rate of acceptance by the users?

29.02.101 What is a typical learning curve?

29.02.102 What duration of time is an acceptable learning period?

29.02.103 What amount of time is required for a reply?

29.02.104 What on-going user training must be provided?

29.02.105 What incremental user training should be provided?

29.02.106 What timing constraints are there on completion of a transaction?

29.02.107 What tasks are performed infrequently?

29.02.108 What else should I be asking about usability “timing”?

29.02.109 What are user needs for switching between multiple currencies?

29.02.110 What multiple currencies must be supported?

29.02.111 What expectations are there for the system to be used by people who do not speak the language of the country where the system is used?



29.02.112 What multiple languages must be supported?

29.02.113 What is the sound quality of the system?

29.02.114 What special environmental conditions must be considered?

29.02.115 What special lighting needs are there?

29.02.116 What multiple currencies must be available in the same instance of the system?

29.02.117 What external devices must be used in concert to provide accessibility?

29.02.118 What geographical or logistical constraints impact the user’s ability to use the system?

29.02.119 What textual and graphical visual interfaces are needed?

29.02.120 What level of user support is needed at each business location?

29.02.121 What usability issues vary by business location?

29.02.122 What different levels of help information are needed at different locations?

29.02.123 What could be done to improve usability at each location?

29.02.124 What locations can accommodate user training?

29.02.125 What else should I be asking about usability “logistics”?

29.02.126 What features of the current technology constrain usability?

29.02.127 What characteristics are needed to make the system “easy” to use?

29.02.128 What features/functions are critical to enabling users to perform their jobs?

29.02.129 What features are used for high volume data input?

29.02.130 What makes the product safe to use? Unsafe?

29.02.131 What must be put in place to avoid hazards?

29.02.132 What must be put in place to minimize accidents if hazards arise?

29.02.133 What is necessary to ensure safe operation?

29.02.134 What makes the information easy to read?



29.02.135 What procedures must be taken in the event of an accident?

29.02.136 What are the routines (process flow) followed in the business area?

29.02.137 What user tasks show the highest incidences of accidents?

29.02.138 What workers compensation claims have been made in the past?

29.02.139 What hazard identification and analysis is needed?

29.02.140 What should the system do to “remember” where users have been and assist in their return?

29.02.141 What different components have specific access procedures?

29.02.142 What benchmark system or metric will be used?

29.02.143 What user-defined control functions are needed?

29.02.144 What are the expectations for multiple ways to complete the same task?

29.02.145 What type of navigation is expected?

29.02.146 What current workarounds are performed to improve usability?

29.02.147 What user workarounds are performed to offset system deficiencies?

29.02.148 What processes should be changed to improve usability?

29.02.149 What process areas experience the most date entry errors?

29.02.150 What processes or procedures affect usability?

29.02.151 What manual workarounds could be automated?

29.02.152 What functions will be used the least frequently?

29.02.153 What processes are typically performed by novice users? Expert users?

29.02.154 What are procedures for users to get help?

29.02.155 What are learning rate requirements?

29.02.156 What sequencing of activities is common to the business area?

29.02.157 What are procedures for users to get help desk support?

29.02.158 What processes present user safety concerns?



29.02.159 What processes or procedures require the most user training?

29.02.160 What else should I be asking about usability “processes”?

29.03.00 Where?

29.03.01 Where can the specific wording for the error messages, descriptions, and definitions be obtained?

29.03.02 Where do the users typically look first for help?

29.03.03 When processing work, where are the breaks in sequence?

29.03.04 Where do the users expect to find help?

29.03.05 Where does each user class do its work?

29.04.00 When?

29.04.01 When is it acceptable to use the common shorthand notations?

29.04.02 When is it not acceptable to use the common shorthand notations?

29.04.03 When do most data entry errors occur?

29.04.04 When does the help desk receive the most calls?

29.04.05 When (during which peak periods) is usability critical?

29.05.00 How?

29.05.01 How interactive is the process for data entry between data input and data contained in the system?

29.05.02 How frequently do current help features get used?

29.05.03 How many types of help are expected?

29.05.04 How appealing is the presentation of the information?

29.05.05 How complex is the combination of data during data entry?

29.05.06 How much data must be presented in common presentations?

29.05.07 How much training is expected?

29.05.08 How does using the system change between skill levels of the users?

29.05.09 How would I describe the typical usage of a novice user?



29.05.10 How would I describe the typical usage of an expert user.

29.05.11 How rapidly are users expected to advance from one category to the next?

29.05.12 How important is it for the system to be understandable by the users?

29.05.13 How many categories of user types are there? (novice, experienced, power)

29.05.14 How would I describe the usability of the proposed system with other state-of-the-art systems that the user community knows and likes?

29.05.15 How would I specify the required training time for users to become minimally productive (able to accomplish simple tasks) and operationally productive (able to accomplish normal day-to-day tasks)?

29.05.16 How will learning rate be measured?

29.05.17 How will I describe characteristics to measure “easy to learn.”

29.05.18 How are users measured on “ability to learn quickly”?

29.05.19 Once users have been trained to perform routine tasks, how long should it take them to perform a typical task or transaction?

29.05.20 How will the usability of the system be evaluated?

29.05.21 How will entry rate be measured?

29.05.22 How will I specify measurable task times for typical tasks or transactions.

29.05.23 How should acceptance of usability be measured?

29.05.24 How will user satisfaction be measured?

29.05.25 How is “likability” measured?

29.05.26 How are user errors measured?

29.05.27 How will error rate be measured?

29.05.28 How important is it to develop the system so that it minimizes user errors? What is the importance that users be protected from making errors?

29.05.29 How long should it take to complete a process?

29.05.30 While entering data, how much time do the users spend reviewing, analyzing, or verifying the data?

29.05.31 How important is it to complete a process quickly and easily?



29.05.32 How long before re-prompt and time out?

29.05.33 How long should it take first-time users to learn the system to a proficient level?

29.05.34 How long should it take experienced users to learn the system?

29.05.35 How frequently will most functions be used?

29.05.36 When there are breaks in the sequence of the work, how long are the breaks?

29.05.37 When there are breaks in the sequence of the work, how is the system expected to resume processing?

29.05.38 How quickly must the users learn to use the most frequented features?

29.05.39 How should users be trained?

29.05.40 How long would it take the average user to get up to speed?

29.05.41 How often is user help updated?

29.05.42 How would you describe the work environment adjacent to the specific area being considered?

29.05.43 How would you describe the typical environment in which the users do their work?

29.05.44 How many different ways are expected in order to accomplish the same function?

29.05.45 How would you describe the ergonomic usage of the system?

29.05.46 How necessary is it for the system to lead users through the task?

29.05.47 How many variations in presentation exist within user roles?

29.05.48 How does the business area react to disruption of their normal routine?

29.05.49 How does the system conform to any established user interface standards?

29.05.50 How would I describe unacceptable or undesirable system behavior.

30.00.00 Users

30.01.00 Who?

30.01.01 Who owns the existing information?



30.02.00 What?

30.02.01 What system settings could be added at the user level?

30.02.02 What source can provide an accurate count of existing end users?

30.02.03 What source can provide an accurate count of existing customers?

30.02.04 What business locations interface with the system?

30.02.05 What users spread across time zones?

30.02.06 What users spread across the world?


30.02.08 What do internal users need to do their jobs?

30.02.09 What information is each user looking for?

30.03.00 Where?

30.03.01 Where is the greatest concentration of users?

30.04.00 How?

30.04.01 How diverse are individual users allowed to make their system profile?

30.04.02 How widely spread are the system users?

31.00.00 Workflow

31.01.00 What?

31.01.01 What alternatives are there to this process?

31.01.02 What other processes are there?

31.01.03 What specific processing limits need to apply to each user class?

31.01.04 What conditions must be met for this event to occur?

31.01.05 What happens if the conditions are not met?

31.01.06 What would users like changed in the current workflow?

31.01.07 What are exceptions to the normal workflow?



31.02.00 When?

31.02.01 When is the process reusable?

31.03.00 How?

31.03.01 How does the process vary by use?

Documents

Non-functional Requirements Elicitation Question Bank