1. Performance. Reviewed by Annie
1.1. Web page loading time
1.1.1. ABLE online web pages should load in <5 seconds 95% of the time. D= L, I= H
1.2. Data latency
1.2.1. Minimize data latency of storing and retrieving data from DB to 100 ms D=M, I=H
1.2.1.1. Customer
1.3. Transaction throughput
1.3.1. At peak load, the system should be able to complete 100 transactions per second. D = M, I = H
1.4. Payment transaction timeout
1.4.1. Transaction will be closed after 5 mins of inactivity 95% of the time. D=L, I=M
1.5. New product categories
1.5.1. Product updates from the main server to the online store must be < 7 seconds. D=L, I=H
1.6. Order processing time
1.6.1. Orders are processed in < 7 seconds @2 Mbps, 95% of the time. D= H, I= H
2. Availability
2.1. Hours of availability
2.1.1. The ABLE online store will be available 24/7 for all customers including the peak season such as new year and christmas. D= H, I= H
2.2. Reliability
2.2.1. The system should be reliable 99.95% of the time per year. D= H, I=H
2.3. Scheduled downtime
2.3.1. Scheduled downtime will always on the first Monday of the month with less than 2 hours a month and 1.83 days a year. D=H, I=H
3. Monitoring
3.1. Use of Cookies
3.1.1. When a user is searching for products, the cookies keep track of the user's preference for targeted advertisement. D = L, I = H
3.2. Web and mobile server rates
3.2.1. Web server monitored by built-in monitoring services which report the status in real-time or in 2 minute intervals. D= M, I= H
3.3. Product sales
3.3.1. Sales of the product from both online and not online transactions will be stored to the database in order to be analysed for the market trend. D=H, I=H
4. Archiving/Backup
4.1. Customer order history record
4.1.1. Customer order histories will be stored for a 12 month period of time. D=M, I=M
4.2. Web server configurations
4.2.1. Web server configuration must be maintained and checked for every 3 days. D=M, I=H
4.3. Web server configuration snapshot
4.3.1. Every 3 days. D=L, I=L
5. Auditability
5.1. Online transactions
5.1.1. Confirmation email of transactions must be send to the customer after the payment in <= 5 seconds . D=M, I=H
5.2. Phone orders
5.2.1. Conversations via telephone will be recorded, unless customers requests otherwise. Whilst customer's payment details are being collected (eg via credit card), the recording must be stopped, and only resumed after collection of such details. D=L, I=H
5.3. Call Centre operations
5.3.1. Activity on office computers will be recorded via screen capture software. D=M, I=H
5.4. Web server administrative actions
5.4.1. Log of administrative actions is required, where log must include timestamp, user involved, and action taken. D=L, I=H
6. Security
6.1. Password retrieval
6.1.1. By email verification link sent to customer's email. D=L, I=M
6.1.2. SMS authentication using a one-time password. D=L, I=H
6.2. Confidentiality
6.2.1. Credit card transaction are secured 99.999% of the time. D=M, I=H
6.3. Authentication
6.3.1. Authentication access must be single factor authentication for customers and ABLE staff. D=M, I=H
6.3.2. System will lock out users who enter the wrong login details more than 5 times. D=M, I=H
6.4. Integrity
6.4.1. Customer database authorisation work 99.999% of the time. D=M, I=H
6.5. Credit card security standard
6.5.1. PCI DSS compliant. D=M, I=H
6.6. DDoS attack resilience
6.6.1. Use of NetScaler device. D=M, I=H
6.7. Online financial transaction network timeout
6.7.1. <180 seconds. D=L, I=M
6.8. Encryption policy
6.8.1. Minimum SSL 2.0 required. D=L, I=H
6.9. Regulation on information collected by cookies
6.9.1. Appropriate disclaimers must be displayed to the customer, in a clear and straightforward manner. D=L, I=M
7. Recovery Objectives
7.1. Recovery time objective
7.1.1. The time it takes for the system to recover should be < 3 hours. D= H, I= H
7.2. Recovery point objective (Customer profile information)
7.2.1. Customer Database Server goes down in the peak hours and when the database server recovers, it must not lose any customer profile information )zero data loss). D=H, I=H
7.3. Acceptable outage time
7.3.1. The acceptable outage time for the system should be less than 2 hours within 3 months. D=M, I=M
7.4. Recovery point objective (Customer order history)
7.4.1. Order database goes down in the peak hours and when the database server recovers from a fault, it must not lose any order history information. D= H, I= H