Non-Functional Requirements: A 2026 Buyer's Playbook (ISO/IEC 25010, Templates, NFR Matrix)

Why Fora Soft wrote this playbook

Fora Soft has been shipping video, AI and real-time products since 2005 — 625+ delivered software products across telemedicine, e-learning, video surveillance, live streaming and B2B SaaS. Most of those products had a moment when an analyst, a CTO or a buyer pulled out a non-functional requirements document and decided whether we were the right partner. We’ve seen what works and what gets a vendor cut on slide 3.

This playbook condenses what we use internally for products like BrainCert (large-scale e-learning with strict uptime SLAs), TransLinguist (real-time video interpretation, sub-300 ms latency targets), MyOnCallDoc (HIPAA-grade telemedicine) and Sprii (live video shopping, peak-traffic spikes). It’s written for the person who has to brief a development partner — product owner, head of product, founding engineer, procurement — not for academic completeness.

If you’re hiring a partner now, the fastest way to test their NFR maturity is the conversation, not the proposal. Below is the structure we use to lead it.

What is a non-functional requirement, in one paragraph

A non-functional requirement (NFR) describes how well a system must do its job, not what it does. Functional requirements describe behaviour (“The user can publish a post”). NFRs describe quality attributes around that behaviour (“Publishing a post completes within 800 ms p95, survives a single-AZ outage, and stores the post encrypted at rest”). NFRs are also called quality requirements, technical user stories or, in the ISO/IEC 25010:2023 vocabulary, quality characteristics.

A useful mental model: a functional requirement is the verb. A non-functional requirement is every adverb you’d ever attach to that verb — quickly, securely, reliably, accessibly, cheaply, in any time zone, on any device. Without those adverbs, “the user can log in” is true even if logging in takes 14 seconds, leaks the password, and only works in Chrome.

NFR vs functional requirement — the side-by-side

Most teams confuse the two because their backlog tools force everything into the same template. Here’s the difference put bluntly.

The last row is the one buyers under-weight. Adding a feature is a sprint. Adding HIPAA-grade audit logging or pulling latency from 4 s down to 800 ms after launch is usually a rewrite of the data layer or the transport.

The ISO/IEC 25010:2023 spine — eight characteristics every NFR maps to

ISO/IEC 25010 is the international standard for software product quality. The 2023 revision keeps the eight top-level characteristics — use them as the table of contents for your NFR document. If a stakeholder requests a requirement that doesn’t map to any of these, it’s probably not an NFR.

1. Functional suitability

Completeness, correctness, appropriateness. The bridge between functional and non-functional. Example: “The platform shall support every workflow listed in section 2.1 with zero P1 defects in production.”

2. Performance efficiency

Time behaviour (latency, throughput), resource use (CPU, memory, bandwidth), capacity (max concurrent users, max data volume). Express in percentiles, not averages: p50/p95/p99. Averages hide the bad afternoons.

3. Compatibility

Co-existence with other systems on the same infrastructure, and interoperability through documented APIs and data contracts (OpenAPI 3.1, AsyncAPI, gRPC, webhooks).

4. Usability

Learnability, operability, accessibility (WCAG 2.2 AA is now the default, EAA mandatory in the EU from June 2025), error protection, UI aesthetics, helpfulness. Yes, accessibility is an NFR. No, “intuitive UI” is not.

5. Reliability

Maturity (low defect rate), availability (uptime%), fault tolerance (graceful degradation), recoverability (RTO/RPO). The hardest characteristic to fake under audit and the easiest to over-promise on a sales call.

6. Security

Confidentiality (encryption, RBAC), integrity (input validation, signed events), non-repudiation (immutable audit logs), accountability, authenticity (MFA, device binding). This is also where most compliance frameworks bite.

7. Maintainability

Modularity, reusability, analysability, modifiability, testability. The NFR your CFO will care about three years in. Good maintainability spec keeps the second team productive.

8. Portability (Transferability)

Adaptability across environments, installability, replaceability. Express as deployment targets (containers, K8s, specific cloud regions) and exit guarantees (data export, infra-as-code parity).

The 12 NFR categories that actually appear in real specs

ISO is the spine; this is the body. In production specs we hand to engineering, NFRs collapse to twelve categories. Each one needs a metric, a threshold, an owner, a verification method.

Performance & latency

p50, p95, p99 latencies for every critical path. Web pages: 1 s p95, 2.5 s p99 is the modern bar (Largest Contentful Paint <2.5 s is Google’s Core Web Vitals threshold). API calls: <500 ms p95 for B2B SaaS, <100 ms for high-frequency endpoints. Real-time video: <300 ms glass-to-glass for conferencing, <500 ms for live commerce.

Scalability

Concurrent users at peak, peak-to-average ratio, growth horizon (12–24 months), and the degradation curve (“at 10× load, p95 stays under 1.5 s”). “Supports 100k users” is meaningless without specifying load shape and degradation tolerance.

Availability & reliability

Uptime SLO, MTBF, MTTR, error budget. Pick a number you can defend with infrastructure spend (see the next section).

Recoverability (RTO & RPO)

RTO = how long until service is back. RPO = how much data loss is acceptable. Tested in real drills, not paper runbooks.

Security & privacy

Encryption (AES-256 at rest, TLS 1.3 in transit), MFA, RBAC, secret rotation, vulnerability SLAs, dependency-scan thresholds. See the Fora Soft WebRTC security primer for the real-time-comms angle.

Compliance

GDPR, HIPAA, PCI DSS 4.0, SOC 2 Type II, ISO 27001, FedRAMP, EU AI Act — pick the ones your market actually demands and translate them into concrete controls.

Usability & accessibility

WCAG 2.2 AA conformance, EAA compliance for EU, task-completion benchmarks, supported languages and locales, supported assistive technologies (VoiceOver, NVDA, TalkBack).

Compatibility

Browsers (named versions, the last two of Chrome, Safari, Firefox, Edge), OS (iOS 16+, Android 11+ etc.), device classes (low-end Android, iPad, desktop), screen sizes, integrations (specific CRMs, SSO providers, payment processors).

Maintainability & engineering quality

Test coverage thresholds (typically 70–85%), code review SLAs, doc freshness, dependency vulnerability SLAs, on-call rotation expectations, runbook coverage. A pre-takeover code audit is the cheapest insurance you’ll buy.

Observability

Metrics, logs, traces, dashboards, alerts. “p95 latency, error rate, saturation, traffic per service, all visible in <30 s, alert thresholds documented, on-call paged within 2 min of breach.”

Localization & geography

Languages, locales, time zones, currencies, data residency (EU data in Frankfurt, KSA data in Riyadh, etc.), CDN coverage, latency targets per region.

Cost & efficiency

Unit economics targets (cost per active user, cost per stream-minute, cost per stored GB), infra cost ceiling, autoscaling rules, idle-resource SLAs. Worked example for a video platform here.

The NFR matrix — metric, threshold, owner, test

Print this and put it next to your backlog. The thresholds in column 3 are reasonable defaults for a B2B SaaS — tune to your domain.

How to write a non-functional requirement that holds up in court (or procurement)

A good NFR has six fields. If any are missing, it’s a wish.

1. Subject. Which part of the system — the API, the playback layer, the admin console, “all user-facing endpoints”.

2. Quality attribute. Latency, availability, encryption, accessibility — mapped to one ISO/IEC 25010 characteristic.

3. Metric. What you’re measuring (p95 ms, monthly uptime%, WCAG level).

4. Threshold. The number, with a unit.

5. Condition. The load, region, or scenario in which the threshold must hold (“at 1k RPS, 95% from EU regions”).

6. Verification method. How you’ll prove it — load test, audit, monitoring, manual screen-reader pass.

A reusable NFR template

NFR-ID:        PERF-API-001
Subject:       Public REST API
Attribute:     Performance efficiency / time behaviour
Metric:        p95 latency
Threshold:     <500 ms
Condition:     1,000 RPS sustained, 70/30 read/write, EU+US traffic
Verification:  k6 nightly load test, dashboards in Grafana
Owner:         Platform team (lead: @eng-lead)
Review cadence: Quarterly

The cost of nines — what each uptime tier really buys you

Buyers love nines. Architects know each one roughly multiplies cost. Pick the lowest tier you can defend — and revisit it as you scale.

Compliance, mapped to NFRs (GDPR, HIPAA, PCI, SOC 2, EU AI Act)

Each framework looks like a legal document and lands in your repo as a list of NFRs. The shortlist below covers what we see in 2026 procurement.

GDPR (EU)

Encryption at rest and in transit; data minimisation; data residency in the EU for personal data when contracted; data subject access response within 30 days; deletion within 30 days of valid request; breach notification to the DPA within 72 hours; documented DPIAs for high-risk processing.

HIPAA (US healthcare)

PHI encrypted (AES-256 at rest, TLS 1.2+ in transit); RBAC with least-privilege; immutable audit logs retained 6+ years; signed BAAs with every sub-processor; incident response within 60 days. Hosting on a HIPAA-eligible provider (AWS, GCP, Azure healthcare-eligible services). We design MyOnCallDoc against this baseline.

PCI DSS 4.0

Don’t store PAN if you can avoid it — tokenise via Stripe, Adyen, Braintree. If you must, network segmentation, quarterly ASV scans, annual pentest, MFA on cardholder-data-environment access. Most product teams should aim to be SAQ-A or SAQ-A-EP, not full PCI Level 1.

SOC 2 Type II

Five Trust Service Criteria (security mandatory; availability, confidentiality, processing integrity, privacy optional). Type II requires evidence of controls operating over 6–12 months. Implies vendor management, change-management, access-review, incident-response policies — expressed as NFRs in product backlog (e.g., “Production access reviewed quarterly, evidence in Vanta”).

EU AI Act (phased from 2026)

If your product uses AI in “high-risk” categories (HR, education, biometrics, critical infrastructure, justice, etc.), you owe risk assessments, training-data documentation, human oversight, accuracy and robustness reporting, post-market monitoring. Bake these into NFRs early — retrofitting is expensive.

ISO/IEC 27001:2022

An information security management system, not a product checklist — but its Annex A controls (93 in the 2022 revision) translate into concrete NFRs: change management, asset inventory, vulnerability management, business continuity.

A real NFR spec for a video communication platform

Below is the kind of NFR list we hand to engineering when we kick off a video product — trimmed for readability. Use it as a starting template, not a religion.

For a real-time video build like TransLinguist or a high-traffic e-learning platform like BrainCert, the same skeleton expands to 60–100 line items.

MVP vs scale-up vs enterprise — spec for the stage you’re in

Spec the NFRs you can pay for — and architect so you can tighten them later without a rewrite. More on MVP scoping here.

Mini case — how a tightened NFR list saved a Fora Soft client a quarter of rework

A mid-market healthcare client came to us with a partly-built telemedicine product. Functional spec was thorough — appointments, video visits, e-prescriptions. NFR section was four bullets: “HIPAA, fast, 99.9%, mobile-friendly.” Three weeks before pilot, their pentester flagged that audit logs were stored alongside PHI in the same Postgres, with no segregation, no immutability and 90-day retention.

We re-wrote the NFRs first, build plan second. Twelve weeks: split logs into a write-once store, added KMS-CMK encryption with rotation, set RTO/RPO to 30 min/5 min, formalised the BAA chain, and rebuilt the load profile against a defended 99.9% SLO. Pilot launched on schedule with HIPAA-acceptable evidence. The pentest took eight days instead of an estimated five weeks because every control had a written, testable NFR behind it.

The lesson isn’t “hire Fora Soft.” It’s that the cost of writing the NFRs properly was about 1% of the cost of fixing them under a deadline.

A decision framework — choose your NFRs in five questions

Q1. What does your worst customer outage cost in dollars per hour? If it’s <$1k, 99.9% is fine. If it’s $50k+, you’re paying for 99.95% whether you spec it or not.

Q2. What regulation, if any, will be applied to your product in the next 18 months? Don’t guess — ask sales which deals are blocked on SOC 2 / HIPAA / FedRAMP. That’s your answer.

Q3. What is your realistic peak load 12 months from now? Multiply current peak by 3×. If that breaks your stack, you have an NFR gap. If it’s 30×, re-architect now — you can’t scale into it.

Q4. Where do your users physically sit? EU-only means data residency; global means CDN, regional latency targets, time-zone-aware ops. Don’t inherit Silicon Valley assumptions.

Q5. Who will run this in two years? If it’s a different team, prioritise maintainability and observability NFRs hard. If it’s you, you can defer some doc requirements but still log everything.

Five pitfalls we see in real NFR specs

1. “Fast,” “secure,” “scalable” with no number. If a vendor accepts those words, they’ll deliver whatever’s easy. The spec is the only place to win this argument.

2. NFRs without owners. “Performance” without a name on it ends up nobody’s problem. Tag every NFR to a team and a person.

3. Compliance treated as a sticker. “HIPAA-compliant” on a marketing page is not a control. The control is “PHI encrypted with customer-managed keys, audit logs immutable for 6 years, BAAs on file with every sub-processor.”

4. Over-spec for the current stage. Demanding 99.99% uptime for a 200-user MVP burns runway you need for product–market fit. Spec what your contracts demand plus a small headroom; revisit quarterly.

5. NFRs disconnected from monitoring. If you spec a p95 latency, the dashboard for it must exist on day one of production. Targets without telemetry are wishes.

KPIs to track NFR health in production

Quality KPIs. p95 / p99 latency per critical path; error rate (4xx, 5xx, dropped media frames); accessibility scan score; mean test coverage. Thresholds: latency within budget >95% of measurement windows; error rate <0.5% on production traffic.

Reliability KPIs. Monthly uptime vs SLO; error budget burn rate; MTTD / MTTA / MTTR; failed DR drills count. Thresholds: error budget burn <100% of monthly budget; MTTA <5 min; zero failed DR drills per year.

Business KPIs tied to NFRs. Conversion impact of latency (every 100 ms of added p95 latency on key user paths costs measurable conversion — track it); SLA credits paid; security incidents and time-to-resolve; compliance audit findings count and severity.

When you should not write a 60-page NFR document

A pre-launch validation prototype, a one-month trade-show demo, an internal tool used by 12 people — these don’t need the full ISO/IEC 25010 treatment. Two pages of NFRs (“HTTPS only, no PII stored, can be deployed to a single ECS task, accessibility deferred”) is plenty. Optimise for shipping, not for procurement.

The trigger to upgrade is the first paying customer who asks for a security questionnaire. That afternoon, you write a real NFR document.

Using NFRs to choose a software development partner

If you’re evaluating outsourced engineering or augmenting your team, NFR fluency is the cleanest filter we know.

Five questions to ask candidates. Have them walk you through (1) the NFR taxonomy they use; (2) one production system with its real SLOs and how they were chosen; (3) a war story where an NFR was missed and what changed; (4) how they hand-off NFRs from spec to monitoring; (5) what they refuse to over-promise. The vendors who can’t answer (3) honestly are the ones who’ll surprise you in month four. Our hiring bar for engineers exists precisely so we can answer (3) honestly.

A useful test: ask for a fixed-fee NFR-gap audit on your current product. A two-week, ~$5k–15k written audit is a small commitment that surfaces the architectural truth. We do them constantly — our estimation playbook is here.

FAQ

What to Read Next

Ready to turn your NFR list into a real engineering plan?

Non-functional requirements are the quietest determinant of whether your product gets reviewed, renewed and recommended. Spec them with numbers, owners and verification — mapped to ISO/IEC 25010 — and treat them as living. Tighten as paying customers demand it; soften when you’re burning cash on perfection nobody asked for.

If you want a partner that takes NFRs seriously from week one — not as a procurement form to fill in at the end — that’s the bar Fora Soft has held for 21 years. Bring us a draft, an inherited mess, or just a hypothesis. We’ll tell you what’s realistic, what’s missing, and what we’d build first.