What are non-functional requirements?
Non-functional requirements (NFRs) describe how a system performs its functions rather than what functions it performs. They define quality attributes — how fast, how reliable, how secure, how scalable, and how usable the system must be.
Why NFRs fail
NFRs fail for one of three reasons. They are too vague to implement ("the system must be performant"). They are discovered too late — after architecture decisions have been made that make them impossible to achieve. Or they conflict with each other — maximum security often conflicts with maximum usability, and both conflict with minimum cost.
The six categories of NFRs every BA must know
1. Performance
How fast must the system respond, and under what conditions? Performance requirements must specify three things: the operation being measured, the response time target, and the load conditions under which it applies.
The system must respond quickly under normal load.
The product search page must return results within 1.5 seconds at the 95th percentile under a load of 500 concurrent users, as measured by Lighthouse on a standard broadband connection.
2. Availability
What percentage of the time must the system be accessible? 99% availability sounds good until you calculate that it allows 87.6 hours of downtime per year — over three and a half days. 99.9% allows 8.76 hours. 99.99% allows 52.6 minutes. Know which one your business actually needs, and the difference in cost.
3. Scalability
How must the system handle growth? Specify the current baseline (1,000 active users today), the 12-month target (10,000 users), and the 3-year stretch target (50,000 users). Also specify whether growth is steady or spiky — a payroll system that processes 10,000 payslips on one day per month has very different scalability requirements from a customer portal with consistent daily usage.
4. Security
What standards must the system meet? Reference specific frameworks: OWASP Top 10, ISO 27001, PCI-DSS Level 2, SOC 2 Type II. Vague security requirements produce vague security. Specific standards produce auditable controls.
All API endpoints must validate authentication tokens before processing any request. Token validation must use RS256 signed JWTs with a maximum 24-hour expiry. Failed authentication must return HTTP 401 without revealing whether the email or password was incorrect. After 5 consecutive failed login attempts from the same IP, that IP must be locked out for 15 minutes.
5. Usability
What accessibility and usability standards must be met? Usability NFRs are the most frequently ignored category. Minimum standard: WCAG 2.1 Level AA compliance for all user-facing interfaces. Beyond accessibility, usability NFRs can specify task completion rates (a new user must be able to complete the core workflow without training), error rates (less than 5% of form submissions should result in validation errors), and learnability (a user who has not used the system for 30 days should be able to complete their primary task within 5 minutes of returning).
6. Compliance
What regulations, standards, or policies must the system comply with? List each applicable requirement with the specific clause or section, not just the regulation name. "Must comply with GDPR" is a starting point. "Must comply with GDPR Article 17 (right to erasure) — deletion requests must be processed within 30 days and confirmed to the data subject in writing" is a requirement.
How to elicit NFRs from stakeholders
Stakeholders rarely volunteer NFRs. Ask these questions explicitly: What is the maximum time a user should wait for any screen to load? What happens to the system if it receives twice the expected number of users simultaneously? Who should not be able to see this data? What are the consequences if the system is unavailable for one hour? Two hours? One day? Are there regulatory audits that this system must support?
⚡ NFR template in SmartPrompt
SmartPrompt includes a Non-Functional Requirements template covering all six categories with measurable criteria and expert guidance.
Open NFR Template →