Non-functional requirements
Non-functional requirements describe how a system performs rather than what it does: its speed, security, accessibility, reliability, usability and similar qualities. 'A page loads within two seconds on a mid-range phone' is one, where 'a user can export a report' is a functional requirement. They set the quality bar the features are judged against.
The longer version
ISO/IEC 25010, the product quality model, gives a recognised list to draw from. Its 2023 edition names nine characteristics, among them performance efficiency, reliability, security, interaction capability (usability, in the 2011 edition it replaced), maintainability and safety, which the revision added. Many teams list accessibility on its own as well, because a standard such as WCAG, often written into a contract or a law, attaches to it directly.
The common failure is a requirement nobody can test. 'The system should be fast' and 'must be secure' read as agreement and settle nothing. A usable one names a measure, a condition and a threshold agreed with the people who will judge it, for example 'a catalogue search returns results in under one second with ten thousand products loaded'.
In agile work these requirements live in two places. Some become acceptance criteria on the individual stories they touch. Others cut across every story, such as the supported browsers or an accessibility standard, and usually sit in the definition of done so that each story is checked against them as it finishes. Testing for them is a discipline of its own, because performance, security, accessibility and compatibility checks each need tools and environments that functional testing does not.
Common questions
What are examples of non-functional requirements?
Examples include page response time under a stated load, support for the last two versions of the major browsers, conformance to a WCAG level, encryption of stored personal data and recovery after a failure within a set time. Each describes a quality of the system.
What is the difference between functional and non-functional requirements?
A functional requirement states a behaviour the system must provide, such as sending a confirmation email. A non-functional requirement states a quality of that behaviour, such as the email arriving within a minute or being readable by a screen reader.
How do you write a testable non-functional requirement?
Name the quality, the condition and a measurable threshold, and agree the figure with the people who will judge it. 'Search is fast' cannot fail a test, while a stated response time under a stated load can.
Who defines non-functional requirements?
Stakeholders set the need, architects and developers say what is feasible, and testers check it can be measured. Many go missing because nobody owns them, so it helps to name an owner for each quality, such as security or accessibility.
Are non-functional requirements part of acceptance criteria?
Some are. Those that affect one story become that story's acceptance criteria, and those that apply to everything belong in the definition of done, where every story is checked against them.
Bug reports that arrive ready to triage.
Collect replay, console, network and browser context with the Free plan.