NFR Catalogue

The requirements that get discovered late and expensively.

Format.md
Length61 lines
Includesnone

The source

61 lines of Markdown, with nothing to install. Copy it, or open the template inside Gnomon and render it as it is.

# NFR Catalogue: <System name>

- **Owner:** <name>
- **Last reviewed:** YYYY-MM-DD

## Performance

| Metric                       | Target          | Measured at        |
|------------------------------|-----------------|--------------------|
| API latency p50              | < 50 ms         | edge               |
| API latency p95              | < 200 ms        | edge               |
| API latency p99              | < 500 ms        | edge               |
| Background job duration p95  | < 30 s          | worker             |
| Cold-start                   | < 2 s           | first request      |

## Scale

| Dimension         | Today      | Target (12mo) | Headroom strategy        |
|-------------------|------------|---------------|--------------------------|
| Sustained RPS     | …          | …             | …                        |
| Peak RPS          | …          | …             | …                        |
| Storage (TB)      | …          | …             | …                        |
| Concurrent users  | …          | …             | …                        |

## Availability

- **SLO:** 99.9% monthly (≈ 43m/month error budget).
- **Critical paths:** list the routes/flows that count toward the SLO.
- **Degraded mode:** what still works when downstream X is down?
- **RPO / RTO:** <recovery point / time objectives>.

## Security

- **AuthN:** <OIDC / JWT / mTLS …>
- **AuthZ:** <RBAC / ABAC / scopes …>
- **Data classification:** Public / Internal / Confidential / Restricted.
- **Encryption:** in transit (TLS 1.2+), at rest (KMS-managed keys).
- **Secrets:** vault, rotation cadence.
- **Threat model:** link to STRIDE / attack tree.

## Compliance Targets

| Regime           | Applicable? | Controls owner | Audit cadence |
|------------------|-------------|----------------|---------------|
| SOC 2 Type II    | Yes / No    |                |               |
| GDPR             | Yes / No    |                |               |
| HIPAA            | Yes / No    |                |               |
| PCI-DSS          | Yes / No    |                |               |
| ISO 27001        | Yes / No    |                |               |

## Operability

- **Deploys per day:** target & current.
- **Mean time to recover (MTTR):**
- **Change failure rate:**
- **On-call response:** ack within 5 min, mitigation within 30 min.

## Cost

- **Budget envelope:** $X / month.
- **Unit economics:** cost per 1k requests, cost per active user.

Render this offline

This template ships in Gnomon and renders on your machine, with no account and nothing sent to a server. The browser editor is free and needs no install.

Get Gnomon Open the browser editor

Others in Architecture document templates

ADR — Architecture Decision RecordContext, decision, consequences. The alternatives section is the valuable one.
RFC — Request for CommentsFor proposing a change and inviting disagreement before building.
HLD — High-Level DesignHigh-level design: the shape, the constraints, the risks.
Tech Spec / LLDLow-level design. What an implementer needs that the HLD does not say.
RunbookWhat to do at 3am. Written for someone tired and unfamiliar.
Discovery / Spike ReportFindings from a time-boxed investigation, including the dead ends.
Post-Mortem / Incident ReviewBlameless incident review. Timeline first, conclusions second.
Solution One-PagerA solution summary for people who will not read the HLD.