Table S1
Delivery standard
| S1 Brief | Written scope, exclusions, risks and decision owners before build. |
|---|---|
| S2 Architecture | Diagrams and notes describing components, data flows and hosting. |
| S3 Review | Every change reviewed by a second engineer. |
| S4 Testing | Automated tests on critical paths, run on every change. |
| S5 Accessibility | WCAG 2.2 AA target, checked manually and with tools. |
| S6 Security | Updated dependencies, secrets management, least privilege, HTTPS. |
| S7 Data | A data inventory: what is stored, where, for how long, who can see it. |
| S8 Ownership | All accounts and repositories in the client's name. |
| S9 Backups | Automated backups with a tested restore procedure. |
| S10 Handover | Runbooks, training session and a documented support route. |
Note
Exceptions are written down
Sometimes a standard cannot be met in full, for example when integrating with a legacy system that cannot be changed. When that happens we record the exception, the risk and the mitigation in the brief before work starts.
Note
Reporting during delivery
A written weekly update covering progress, next steps, risks and decisions needed. A demonstration at the end of every stage.