6.9 Non-Functional Requirements & Solution Constraints
Key Takeaways
- Non-Functional Requirements (NFRs) specify environmental conditions, operational performance thresholds, and quality attributes under which functional requirements must operate.
- Core quality attribute domains include Performance, Scalability, Availability, Reliability, Security, Usability, and Maintainability.
- Service Level Agreements (SLAs) transform qualitative stakeholder desires into legally binding, quantifiable operational metrics.
- Solution Constraints restrict design options and implementation freedom based on business boundaries (budget, dates) or technical environments (legacy hardware, cloud policies).
- Unquantified or omitted NFRs represent a primary driver of production system failures and unexpected operational maintenance costs.
6.9 Non-Functional Requirements & Solution Constraints
Understanding Non-Functional Requirements (NFRs)
While functional requirements specify what a system must do (e.g., "Calculate tax on purchase"), Non-Functional Requirements (NFRs)—also known as Quality of Service (QoS) requirements or Quality Attributes—specify how well the system must perform its functions under operational conditions. NFRs define environmental characteristics, operating constraints, performance benchmarks, and governance policies.
Failing to elicit, specify, and verify NFRs early in the requirements lifecycle frequently leads to project failure. A software system can possess 100% of its required functional capabilities, yet be rendered completely unusable if it takes 45 seconds to load a page, crashes under 100 concurrent users, or exposes confidential customer data to security breaches.
Taxonomy of Solution Quality Attributes
BABOK® Guide v3 categorizes non-functional quality attributes into core operational domains:
| Quality Attribute Domain | Standard Definition | Measurable Specification Standard |
|---|---|---|
| Performance Efficiency | Response time, throughput, and resource utilization speed under specified workload conditions. | "The system shall return search results within 300 milliseconds for database queries under a load of 2,500 concurrent users." |
| Scalability | The ability of a solution to handle increasing workload volume without degrading performance. | "The architecture shall automatically auto-scale to support a 400% increase in peak black-Friday transaction volume within 60 seconds." |
| Availability | The percentage of time a solution is operational and accessible to end users. | "The platform shall achieve 99.99% uptime ('four nines'), allowing no more than 52.6 minutes of unscheduled downtime per calendar year." |
| Reliability / MTBF | Probability that a solution will perform specified functions without failure over a set time period. | "Mean Time Between Failures (MTBF) shall exceed 1,800 operational hours." |
| Security & Privacy | Protection of data and capabilities against unauthorized access, data loss, or cyber threats. | "All customer PII data at rest must be encrypted using AES-256 standards, and access control enforced via multi-factor authentication (MFA)." |
| Usability & Accessibility | Ease with which users learn, operate, and navigate the solution, including WCAG compliance. | "First-time users shall complete checkout in under 3 minutes without training, complying fully with WCAG 2.1 Level AA standards." |
| Maintainability | Ease with which software components can be modified, updated, debugged, or enhanced. | "Modular microservices unit test code coverage shall exceed 85% to enable automated continuous integration deployment." |
Service Level Agreements (SLAs) & Operational Metrics
Business analysts transform qualitative business expectations into quantifiable Service Level Agreements (SLAs). An SLA is a formal, measurable performance contract established between solution providers and business owners.
SLA QUANTIFICATION METRICS
┌─────────────────────────┬─────────────────────────┬─────────────────────────┐
│ RESPONSE TIME (LATENCY)│ UPTIME AVAILABILITY │ RECOVERY TIMELINE (RTO) │
├─────────────────────────┼─────────────────────────┼─────────────────────────┤
│ • Peak Load: < 500ms │ • 99.9% Uptime │ • RTO: < 2 Hours │
│ • Average Load: < 200ms │ • Max Downtime: 8.76 hrs│ • RPO: < 15 Minutes │
│ • API Call: < 100ms │ • Scheduled Maintenance │ • Zero Data Loss Sync │
└─────────────────────────┴─────────────────────────┴─────────────────────────┘
Critical Disaster Recovery Metrics
- Recovery Time Objective (RTO): The maximum acceptable duration of system downtime following an outage before severe business damage occurs (e.g., "System restored within 2 hours of disaster declaration").
- Recovery Point Objective (RPO): The maximum acceptable age of unbacked-up data loss following a system failure (e.g., "Data loss shall not exceed 15 minutes of transactional updates").
Defining Solution Constraints
Constraints are non-negotiable limitations imposed on solution design options by the business, technical, or regulatory environment. Unlike functional requirements (which can be negotiated or phased), constraints restrict implementation choices.
| Constraint Category | Environmental Driver | Example Solution Constraint |
|---|---|---|
| Business Constraints | Budget, fixed dates, resource availability, organizational policy. | "The total solution deployment cost must not exceed $1.2M, and must launch prior to the Q4 regulatory reporting deadline." |
| Technical Constraints | Legacy hardware, enterprise database standards, network infrastructure. | "The application must run strictly within the enterprise's existing on-premises Oracle 19c database cluster." |
| Regulatory Constraints | Federal laws, international privacy standards, industry compliance rules. | "All payment processing modules must comply with PCI-DSS 4.0 standards and store customer records strictly within EU data boundaries." |
Practical Example: Specifying NFRs for a Regional Banking Platform
A senior BA drafts NFR specifications for a mobile banking platform:
- Performance NFR: "Account balance lookup API calls shall execute in under 250ms for 95% of requests during peak hours (8:00 AM - 10:00 AM EST)."
- Security NFR: "All mobile banking sessions shall automatically terminate after 5 minutes of inactivity and require biometric re-authentication."
- Technical Constraint: "The solution must interface with the legacy mainframe via IBM MQ middleware without modifying core COBOL transaction scripts."
CBAP Exam Strategy & Distractor Analysis
- NFR vs. Constraint Distractor: Remember that an NFR specifies a quality attribute metric ("99.9% uptime"), whereas a Constraint limits design options ("Must use AWS cloud infrastructure").
- Quantify Everything: On the exam, any requirement statement containing un-quantified subjective terms (e.g. "highly secure", "fast", "reliable") is unverified. Verified NFRs must state exact numbers and metrics.
- RTO vs. RPO Distinction: RTO measures downtime duration (clock time to recover), whereas RPO measures data loss duration (amount of transactional data lost).
A business analyst is drafting requirements for an online trading platform. The specification states: 'The system must respond to user stock purchase requests within 100 milliseconds and achieve 99.99% availability during trading hours.' How should the BA classify these requirements?
During solution design, a software architect notes that the enterprise IT governance policy mandates that all cloud databases must run exclusively on AWS GovCloud within the continental United States due to federal security regulations. In BABOK Guide v3, what is this limitation called?
An enterprise e-commerce system experiences a major database server crash. The IT operations team restores system hardware within 4 hours, and data recovery logs reveal that customer transaction records created during the 10 minutes prior to the crash were lost. Which metric measures the 10 minutes of lost data?
A senior business analyst is evaluating a draft BRD for a hospital patient management system and identifies the following statement: 'The application interface should be easy to use and look attractive to nurses.' What change should the BA make during verification?