req-doc-template.md

{{Project / Product Name}} — Requirements Specification

Status: Draft · In Review · Approved · Superseded Version: {{0.1}} Last updated: {{YYYY-MM-DD}}

---

Document Control

Field	Value
Document owner	{{Name, role}}
Author(s)	{{Names}}
Reviewers	{{Names / roles}}
Approvers	{{Names / roles}}
Classification	{{Public / Internal / Confidential}}
Related documents	{{Links to design docs, PRDs, tickets}}

Revision History

Version	Date	Author	Summary of changes
0.1	{{YYYY-MM-DD}}	{{Author}}	Initial draft

Approvals

Role	Name	Decision	Date
{{Product owner}}		☐ Approved ☐ Changes requested
{{Eng lead}}		☐ Approved ☐ Changes requested
{{QA lead}}		☐ Approved ☐ Changes requested

---

1. Introduction

1.1 Purpose

{{Describe what this specification covers and its intended audience.}}

1.2 Background & Problem Statement

{{State the problem in user/business terms before any solution language.}}

1.3 Goals & Objectives

• {{Goal 1}}
• {{Goal 2}}

1.4 Success Metrics

Metric	Baseline	Target	How measured
{{e.g. Task completion rate}}	{{current}}	{{target}}	{{source / tool}}

1.5 Definitions, Acronyms & Glossary

Term	Definition
{{Term}}	{{Meaning}}

1.6 References

• {{Link — description}}

---

2. Scope

2.1 In Scope

• {{Capability / area explicitly included}}

2.2 Out of Scope

• {{Explicitly excluded item, and why if useful}}

2.3 Assumptions

• {{Assumption}}

2.4 Dependencies

ID	Dependency	Owner	Needed by	Status
DEP-001	{{e.g. Auth service v2 API}}	{{team}}	{{date}}	{{Pending}}

2.5 Constraints

ID	Constraint	Type	Rationale
CON-001	{{e.g. Must run on existing on-prem infra}}	Technical	{{why}}

---

3. Stakeholders & Users

3.1 Stakeholders

Stakeholder	Interest / Concern	Involvement
{{Role}}	{{What they care about}}	{{Consulted / Informed / Sign-off}}

3.2 User Personas / Roles

Persona	Description	Primary needs
{{Persona}}	{{Who they are}}	{{What they need to accomplish}}

---

4. Functional Requirements

4.1 Requirements List

ID	Requirement	Priority	Source	Acceptance criteria ref
FR-001	The system MUST {{do X}}	Must	{{Goal 1.3 / Ticket}}	AC-FR-001
FR-002	The system SHOULD {{do Y}}	Should		AC-FR-002

4.2 Detailed Requirements

FR-001 — {{Short title}}

• Description: {{Full statement of the requirement.}}
• Priority: Must
• Rationale: {{Why this is needed.}}
• Acceptance criteria (AC-FR-001):
  • Given {{precondition}} when {{action}} then {{expected result}}.
  • {{Additional scenario, including edge/failure cases.}}
• Dependencies: {{FR / DEP IDs}}
• Notes / open questions: {{...}}

4.3 User Stories (optional alternative or supplement)

As a {{persona}}, I want {{capability}}, so that {{benefit}}. Acceptance: {{Given/When/Then bullets}}

---

5. Non-Functional Requirements (NFRs)

ID	Category	Requirement (with measurable target)	Priority
NFR-001	Performance	{{P95 response < 300 ms at 1k concurrent users}}	Must
NFR-002	Scalability	{{Handle 10× current load without redesign}}	Should
NFR-003	Availability	{{99.9% monthly uptime, excl. planned maintenance}}	Must
NFR-004	Reliability	{{RTO < 1h, RPO < 15 min}}	Must
NFR-005	Security	{{Data encrypted at rest and in transit; MFA required}}	Must
NFR-006	Privacy / Data	{{PII retained max 24 months; right-to-erasure supported}}	Must
NFR-007	Accessibility	{{WCAG 2.2 AA conformance}}	Must
NFR-008	Usability	{{New user completes core task in < 3 min unaided}}	Should
NFR-009	Compatibility	{{Supports last 2 major versions of {{browsers/OS}}}}	Should
NFR-010	Maintainability	{{Test coverage ≥ 80%; documented public APIs}}	Should
NFR-011	Observability	{{Structured logs, metrics, and traces for all services}}	Should
NFR-012	Localisation	{{UI supports {{languages}}; dates/currency locale-aware}}	Could
NFR-013	Compliance	{{Meets {{GDPR / HIPAA / SOC 2 / ...}}}}	Must

---

6. Data Requirements

Data entity	Key fields	Source	Sensitivity	Retention
{{Entity}}	{{fields}}	{{origin}}	{{PII / Confidential}}	{{period}}

• Data migration needs: {{...}}
• Data quality rules: {{validation, uniqueness, referential integrity}}

---

7. Interfaces & Integrations

ID	Interface	Direction	Protocol / Format	Notes
INT-001	{{Payment gateway}}	Outbound	{{REST / JSON}}	{{SLA, rate limits}}

• UI / UX references: {{Links to designs, wireframes, prototypes}}

---

8. Risks & Mitigations

ID	Risk	Category	Likelihood	Impact	Score	Mitigation	Contingency	Owner	Status
RISK-001	{{Third-party API changes without notice}}	Technical	3	4	12	{{Version pinning + contract tests + monitoring}}	{{Fallback provider / manual process}}	{{Name}}	Open
RISK-002	{{Key requirement unclear at build time}}	Requirements	3	3	9	{{Spike + stakeholder sign-off before dev}}	{{Timebox and flag as assumption}}	{{Name}}	Open
RISK-003	{{Scope creep erodes timeline}}	Delivery	4	3	12	{{Change-control process; frozen scope per milestone}}	{{Re-baseline; defer to next release}}	{{Name}}	Open

8.1 Open Issues & Questions

ID	Question	Raised by	Needed by	Owner	Resolution
Q-001	{{...}}	{{Name}}	{{date}}	{{Name}}	{{Open}}

---

9. Acceptance & Definition of Done

The release is complete when:

• All Must requirements met and independently verified.
• All acceptance criteria pass.
• NFR targets validated (performance, security, accessibility).
• Test coverage and quality gates met.
• Documentation and runbooks updated.
• Sign-off obtained from approvers listed in Document Control.

---

10. Validation & Testing Approach

Requirement type	Verification method	Owner
Functional	{{Automated tests / manual QA}}	{{QA}}
Non-functional	{{Load test / pen test / a11y audit}}	{{...}}
Acceptance	{{UAT with {{stakeholder}}}}	{{...}}

---

11. Timeline & Milestones

Milestone	Deliverable	Target date	Dependencies
{{M1}}	{{...}}	{{YYYY-MM-DD}}	{{DEP-001}}

---

12. Traceability Matrix

Requirement ID	Business goal	Design ref	Test case	Status
FR-001	{{Goal}}	{{Design}}	{{TC-001}}	{{Not started}}

---

Appendices

Appendix A — {{e.g. Detailed diagrams}}

{{...}}

Appendix B — {{e.g. Regulatory references}}

{{...}}