Non-Functional Requirements

NFR Category	NFR ID	REQUIREMENT	DEFINITION

NFR Category	NFR ID	REQUIREMENT	DEFINITION
Availability and Resilience	NFR-001	Planned Maintenance Period	A fully operational Electronic Patient Record (EPR) Application may have up to 8 hours offline during a planned application maintenance event.
Availability and Resilience	NFR-002	off-line viewing during planned downtime	The patient data held in the Electronic Patient Record (EPR) Application must be available to users whilst the fully operational application is unavailable. The data should be available read only, in an acceptable format, for the user to view easily.
Availability and Resilience	NFR-003	off-line viewing during incident / unplanned downtime	The patient data held in the Electronic Patient Record (EPR) Application must be available to users whilst the fully operational application is unavailable. The data should be available read only, in an acceptable format, for the user to view easily.
Availability and Resilience	NFR-004	click through access during downtime	Data held and managed in other clinical applications, which is usually accessed through the SPR application, must also be available without using the SPR application.
Availability and Resilience	NFR-005	Communication of Planned Outages	No less than 6 weeks notice must be given to users when system unavailability is expected during a maintenance event
Availability and Resilience	NFR-006	Data Retention Periods	Data collected and/or used by a critical clinical application should be retained according to the Trust data retention policy
Availability and Resilience	NFR-007	Roll Back period	The application data storage solution must be configured to enable full restoration (roll back) to any point in the previous 90 days/15 weeks
Availability and Resilience	NFR-008	Roll forward Replay	The SPR application data storage must be configured to enable replay from any point in the previous 90 days
Availability and Resilience	NFR-009	Hardware Maintenance	Applications must be hosted on supported infrastructure, which is suitable for the availability requirements of the application
Availability and Resilience	NFR-010	SPR - RTO 2 Hour	The SPR Application must be recovered to operational status according to the RTO specified in the "Critical (Essential) Systems" document. This is proposed to be set to "within 2 hours".
Availability and Resilience	NFR-011	SPR - RPO 10 minutes	The SPR Application must be populated with data when it is returned to operational status according to the RPO specified in the "Critical (Essential) Systems" document. This is proposed to be set to "no more than 10 minutes lost".
Availability and Resilience	NFR-012	Affected patient records	Patient records affected by planned and unplanned application downtime events must automatically record that a potential gap in data keeping has occurred (medicolegal perspective as well as usability).
Availability and Resilience	NFR-013	Redundant Network	All SPR infrastructure components (diversity of routes, diversity of suppliers, diversity of points of presence) must have at least 2 separate and independent implementations which can be used interchangeably by the SPR application.
Connectivity	NFR-014	CAP assurance	Applications which connect to PDS must assure that the Common Assurance Process has been completed
Infrastructure	NFR-015	Supported Client Environment	The specification and implementation of the SCM environment must be warranted by the Supplier according to the support arrangements and warranted environment specification provided by the supplier
Infrastructure	NFR-016	warranted environment specification	Suppliers must warrant that the warranted environment specification (WES) is up to date and notify the Trust for any changes to the WES at least 3 months in advance of the change.
Infrastructure	NFR-017	End user devices	End User devices (EUD) must meet the minimum specification as provided by the supplier
Infrastructure	NFR-018	Local Infrastructure	connectivity to local networks (for use by application client) and local network provision must meet the minimum specification as provided by the supplier
Infrastructure	NFR-019	Permitted Types of Storage	The SCM solution requires a minimum of 10,000 iops to be available between the data store and application.
Infrastructure	NFR-020	Bandwidth	The network capacity/bandwidth required for on-prem solution should be 1gbps from the client and at least 10gbps between data centres and within (latency < 5ms) as per Dell EMC requirements for vxrail. The network capacity/bandwidth required for cloud solution must provide equivalence of performance.
Infrastructure	NFR-021	Continuous Operation	The deployed application components must have the ability to use high availability technology and technology patterns to maintain continuous operation.
Infrastructure	NFR-022	Host in a DC	All hardware components of the system not requiring direct access or not providing direct connectivity to the user must be hosted in a data centre.
Infrastructure	NFR-023	Separate Cabinets	The hardware design should house servers which are used to provide resilience in separate chassis and cabinets.
Infrastructure	NFR-024	Separate Data Centre	The hardware design should house servers which are used to provide DR in separate DC
Infrastructure	NFR-025	Production Hardware Less Than 5 Years Old	Solutions must ensure that all production hardware for hosted components remains less than 5 years old.
Infrastructure	NFR-026	Hardware Vendor Support	All hardware and firmware must have a support and maintenance agreement in place whilst it is in active use.
Infrastructure	NFR-027	Operating System Vendor Support	All operating system software must have a valid and current support agreement in place whilst it is in use
Infrastructure	NFR-028	Hypervisor and Virtualisation Service Vendor Support	All infrastructure software must have a valid and current support agreement in place whilst it is in use
Infrastructure	NFR-029	Application gateway	Cloud hosted applications must use an approved application gateway in addition to firewalls monitoring network traffic at the Trust security boundary
Infrastructure	NFR-030	Health and Social Care network	The solution design must show how applications will be able to interact with and access HSCN (Health and Social Care Network), to access services such as PDS, NEMS, NRL
Application Management	NFR-031	Automated Deployment	SPR Application updates must be applied to all application clients at the same time (within a period of 1 hour / during down time?)
Application Management	NFR-032	Verified Deployment	Verification that the update has been applied successfully must be obtained and available for audit
Performance and Scalability	NFR-033	Network Traffic Prioritisation	The design of the solution must include Quality of Service (QoS) components and apply best practice to enable the management of data traffic (network prioritisation) to reduce packet loss, latency and jitter on a network
Performance and Scalability	NFR-034	Network monitoring	Networks hosting the system must be actively monitored by automated systems to ensure correct operation and which must provide alarms where a device or group of devices has a fault.
Performance and Scalability	NFR-035	Peak user volume	The SPR application must be able to support 7000 concurrent users at peak times
Performance and Scalability	NFR-036	sustained user volume	The SPR application must be able to sustain application performance for 3500 concurrent users at any time
Performance and Scalability	NFR-037	data volume	The SPR application must be able to effectively access and search 20TB of data
Performance and Scalability	NFR-038	user response time	System response to a user request must not be longer than 2 seconds in normal use
Performance and Scalability	NFR-039	application processing time	SCM processing time for activity in accessing data and image must be less than 1 second.
Performance and Scalability	NFR-040	action cancelation	Requests which will take longer than 5 seconds must provide the user with a cancel option
Performance and Scalability	NFR-041	Increased Capacity	The design of the solution must support the future state architecture and enterprise growth considerations and apply best practice to enable the implementation of the SPR application
Performance and Scalability	NFR-042	Increases in demand	The solution must provide timely response to changes in demand for on prem - this is set at maintaining a 20% capacity headroom which can be used within 24 hours for on cloud - this is set at service agreements in place and the ability to scale the infrastructure within 24 hours
Regulations	NFR-043	Regulatory/Legislative Conflicts	All variances between system specification and legal or professionally accepted best practice relating to cyber security and Information Governance must be fully documented and approved by the Trust before they are implemented.
Regulations	NFR-044	Information Standards Compliance	ICT Applications must not prevent a trust complying with all relevant information standards as defined in the following: Data Protection Act 1998 (incl. GDPR) Human Rights Act 1998 Common Law Duty of Confidentiality Health and Social Care Act 2012 NHS Codes of Confidentiality and Information Security
Regulations	NFR-045	Information Standards Compliance	ICT Applications must comply with NHSD Clinical risk management standards as defined in the following: DCB0129 DCB0160 see https://digital.nhs.uk/services/clinical-safety/clinical-risk-management-standards
Regulations	NFR-046	IG Assessments	A revised "DSP Assertions and Evidence Statement" as specified by the DSP Toolkit assessment process must be completed before the introduction of an application, or a change is made to an existing application, in the production environment.
Security	NFR-047	Implement Authentication	All users of an ICT Application must be authenticated before they are permitted to use the application. User Authentication must use the highest security model available to the application and align with any single sign-on solution in place at the Trust.
Security	NFR-048	End-User Authentication permitted methods	User authentication must use a permitted method from this list: User is authenticated via Spine and electronically holds a verified Spine identifier User id and Password User id and a pre-authorised second factor User id and Password and a pre-authorised second factor biometric algorithms (optional user id) smart card
Security	NFR-049	Security Policy Compliance	All ICT applications must have a data protection impact assessment (DPIA) on record which is reviewed whenever a major change is made. New applications must submit a DPIA before implementation to any production environment
Security	NFR-050	Asset Owner	any new app must have an asset owner identified and they must provide a risk report to the SIRO at least once every 12 months.
Security	NFR-051	Session Timeout	Applications must ensure that access to the system functionality is prevented when the authenticated user has stopped using the application. This rule is subject to consideration on a per area basis e.g. outpatient consultation vs. surgery/theatres.
Security	NFR-052	End point to End Point Authentication	All connections between ICT applications must be configured to authenticate end points before data is shared.
Security	NFR-053	Approved PEN Testing Provision	Penetration testing must be completed for both infrastructure and application by one of the Trust’s approved providers before the ICT application is implemented in the production environment.
Security	NFR-054	Role Based Access Controls (RBACS)	All users of an ICT Application must be assigned an approved Role for that application. Configuration of the Role definition, and rules for role allocation, must be specified by the IAO and approved the SIRO via an information asset risk report.
Security	NFR-055	Implement IG Baseline	Access to data held within ICT systems should be allowed for Informatics, supplier and trust operational users according to need.
Security	NFR-056	Physical Location Hosting	All hosting infrastructure must be physically located in countries with applied UK Data Protection legislation
Security	NFR-057	Appropriate Monitoring Functionality	All ICT applications used in the provision of Trust services must enable scheduled audit and real time protective monitoring at least equal to the risk profile identified within the risk assessment. Monitoring must include: User specific activity System Commands ‘Significant’ Commands Privilege Commands Information exchanges initiated outside of the organization Information releases to outside of the organization
Security	NFR-058	Secure Audit Trail	All ICT applications used in the provision of Trust services must secure the audit trail of data changes such that it is tamper proof, events are uniquely attributable to a user and non repudiable by both system and user.
Security	NFR-059	Minimum Auditable Events	All ICT applications used in the provision of Trust services must include the following events in audit logs and other data stores as required to satisfy the secure audit trail requirement: High priority events Repeated TLS authentication failures from a single IP address. Any forbidden access attempt recorded between security tiers Account lockouts (due to multiple failures) via the service providing operational access. Any OSSEC level 071 alert or higher upon any internal server. Detection of any denial of service attack such as XML, DNS, NTP Any login failure on a live server. Any change in the configuration or code. Any unexpected connection attempt on an internal firewall2 Any CRITICAL log level raised within the application. An attempt to use a revoked certificate or simultaneous use of a certificate from multiple addresses. Other interesting events Any TLS authentication failure. Port scans of external addresses. Excessive content lengths to content consumers/listeners. A high3 volume of OSSEC level 04 alerts (or higher). High volume of unexpected connection attempts on any external firewall.
Security	NFR-060	Malware Protection	The ICT production environment used to host any application must incorporate protection from malware.
Security	NFR-061	User Input Minimal	The SCM application must be deployed in a consistent way for all Trust users and not require any user interaction with the update process itself
Security	NFR-062	Patch Management Provision	ICT applications implemented in the production environment must be updated within 14 days of the release of any security patch by the vendor
Security	NFR-063	Deployment of Critical Patch	ICT applications implemented in the production environment must be updated within 24 hours of the release of a critical security patch by the vendor
Security	NFR-064	Security Updates Available	ICT applications implemented in the production environment must not use any subsystem, or rely on any component, which is no longer supported by the supplier
Security	NFR-065	Trusted Applications	All applications and application add-ons must be certified for use and approved for implementation before they are installed in the ICT production environment
Security	NFR-066	Minimum Functionality	Additional functionality without a verified business use, which is available from an authorised ICT application, should be made inoperable through configuration before the application is implemented in the production environment
Security	NFR-067	Automated Deployment & Configuration	Trust environment owners should ensure that operating software for all devices providing the environment are deployed and configured automatically.
Security	NFR-068	Data Management on external devices	Data required by Trust ICT applications operating on mobile devices where the device is not owned by the Trust must encrypt data to a standard not less than AES during the session and delete it at the end of the session.
Security	NFR-069	Data Management on internal devices	Data required by Trust ICT applications operating on any device owned by the Trust must encrypt data to a standard not less than Triple DES or AES during the session. These devices can cache the encrypted data for offline use but must delete the data if it has not been refreshed within a 24 hours period.
Usability	NFR-070	Training Strategy	No major application change should be implemented without a user training strategy
Usability	NFR-071	Application monitoring	Application should enable the ability to monitor user interface failures, navigation failures and incomplete data management transactions.
Usability	NFR-072	User feedback	Application should enable user reporting of user interface issues
Usability	NFR-073	Applications Support notification	Applications should support the ability to configure alerts and enable notifications to the application support team accordingly
Usability	NFR-074	Understanding User behaviour	Applications should provide the ability to monitor the time spent on the "In focus" screen object
Usability	NFR-075	Monitoring applications	Applications should provide the ability to measure the performance of screen loading and screen content refresh (eg changing patient context) activities from the user experience perspective.
Usability	NFR-076	Continuous Usability	Each application must have a usability review whenever a major upgrade or significant change occurs to the system
Accessibility	NFR-077	disabilities and impairments	Applications must make provision for all users' needs, which include (but not limited to) needs described by the GDS "understanding disabilities and impairments user profiles" https://www.gov.uk/government/publications/understanding-disabilities-and-impairments-user-profiles
Accessibility	NFR-078	Web browser content	Applications providing content via a web browser must ensure the presentation of the content is WCAG 2 compliant
Accessibility	NFR-079	Clinical User Interface	Application user interfaces must be certified compliant with the NHS Digital Service Manual - https://service-manual.nhs.uk/accessibility/design
Interoperability	NFR-080	External data transfers	All internal and external data transfer must use agreed semantics as appropriate to the data destination