{
  "standards": [
    {
      "id": "OFQ-00001",
      "title": "Writing a principle",
      "url": "http://localhost:8080/standards/writing-a-principle/",
      "date": "2025-10-31T00:00:00.000Z",
      "tags": [
        "Guide",
        "Meta"
      ],
      "requirements": [
        {
          "title": "A principle MUST have a title",
          "id": "#a-principle-must-have-a-title"
        },
        {
          "title": "A principle MUST have a description",
          "id": "#a-principle-must-have-a-description"
        },
        {
          "title": "A principle MUST have a rationale",
          "id": "#a-principle-must-have-a-rationale"
        },
        {
          "title": "A principle MUST state expected applications and implications",
          "id": "#a-principle-must-include-applications-and-implications"
        },
        {
          "title": "A principle MUST have tags",
          "id": "#a-principle-must-have-tags"
        },
        {
          "title": "A principle MUST show the role of the person that owns the principle",
          "id": "#a-principle-must-show-the-role-of-the-person-that-owns-the-principle"
        },
        {
          "title": "A principle MUST show when it was last updated",
          "id": "#a-principle-must-show-when-it-was-last-updated"
        }
      ]
    },
    {
      "id": "OFQ-00002",
      "title": "Writing a standard",
      "url": "http://localhost:8080/standards/writing-a-standard/",
      "date": "2025-10-31T00:00:00.000Z",
      "tags": [
        "Guide",
        "Meta"
      ],
      "requirements": [
        {
          "title": "A standard MUST have an ID",
          "id": "#a-standard-must-have-an-id"
        },
        {
          "title": "A standard MUST have a Title",
          "id": "#a-standard-must-have-a-title"
        },
        {
          "title": "A standard MUST have a Description",
          "id": "#a-standard-must-have-a-description"
        },
        {
          "title": "A standard MUST have one or more Requirements",
          "id": "#a-standard-must-have-one-or-more-requirements"
        },
        {
          "title": "A standard MUST have Tags",
          "id": "#a-standard-must-have-tags"
        },
        {
          "title": "A standard MUST show when it was Last Updated",
          "id": "#a-standard-must-show-when-it-was-last-updated"
        }
      ]
    },
    {
      "id": "OFQ-00003",
      "title": "Security In First Party Software",
      "url": "http://localhost:8080/standards/security-in-first-party-software/",
      "date": "2026-03-09T00:00:00.000Z",
      "tags": [
        "Security",
        "Digital"
      ],
      "requirements": [
        {
          "title": "Developers MUST scan their code using security scanning tools before merging code",
          "id": "#developers-must-scan-their-code-using-security-scanning-tools-before-merging-code"
        },
        {
          "title": "Developers MUST attempt to fix security issues at first sight",
          "id": "#developers-must-attempt-to-fix-security-issues-at-first-sight"
        },
        {
          "title": "Vulnerabilities MUST be reviewed on a monthly basis by the Security Team",
          "id": "#vulnerabilities-must-be-reviewed-on-a-monthly-basis-by-the-security-team"
        },
        {
          "title": "Developers MUST undertake security training on a regular basis",
          "id": "#developers-must-undertake-security-training-on-a-regular-basis"
        }
      ]
    },
    {
      "id": "OFQ-00004",
      "title": "Build Pipelines for Digital Infrastructure",
      "url": "http://localhost:8080/standards/build-pipelines/",
      "date": "2025-10-01T00:00:00.000Z",
      "tags": [
        "Digital",
        "Infrastructure"
      ],
      "requirements": [
        {
          "title": "Build pipelines MUST run SAST Analysis before building artifacts",
          "id": "#build-pipelines-must-run-sast-analysis-before-building-artifacts"
        },
        {
          "title": "Build pipelines MUST run automated tests before building artifacts",
          "id": "#build-pipelines-must-run-automated-tests-before-building-artifacts"
        },
        {
          "title": "Build pipelines MUST build and publish an appropriate artifact",
          "id": "#build-pipelines-must-build-and-publish-an-appropriate-artifact"
        }
      ]
    },
    {
      "id": "OFQ-00005",
      "title": "Release Pipelines in Digital Services",
      "url": "http://localhost:8080/standards/release-pipelines/",
      "date": "2025-10-01T00:00:00.000Z",
      "tags": [
        "Digital",
        "Infrastructure"
      ],
      "requirements": [
        {
          "title": "Release pipelines MUST have a Dev stage that deploys automatically",
          "id": "#release-pipelines-must-have-a-dev-stage-that-deploys-automatically"
        },
        {
          "title": "Release pipelines MUST have a Preprod stage that deploys manually",
          "id": "#release-pipelines-must-have-a-preprod-stage-that-deploys-manually"
        },
        {
          "title": "Release pipelines MUST have a Prod stage that requires managerial approval",
          "id": "#release-pipelines-must-have-a-prod-stage-that-requires-managerial-approval"
        }
      ]
    },
    {
      "id": "OFQ-00006",
      "title": "VIPER-Style Architecture in C# Front-Ends",
      "url": "http://localhost:8080/standards/viper-architecture-in-c-sharp-front-ends/",
      "date": "2026-03-09T00:00:00.000Z",
      "tags": [
        "Digital"
      ],
      "requirements": [
        {
          "title": "C Sharp Front-ends MUST use Views",
          "id": "#c-sharp-front-ends-must-use-views"
        },
        {
          "title": "C Sharp Front-ends MUST use Interactors (Services, Mappers and Clients)",
          "id": "#c-sharp-front-ends-must-use-interactors-%28Services%2C-mappers-and-clients%29"
        },
        {
          "title": "C Sharp Front-ends MUST use Presenters (ViewModels)",
          "id": "#c-sharp-front-ends-must-use-presenters-%28viewmodels%29"
        },
        {
          "title": "C Sharp Front-ends MUST use Entities (Models)",
          "id": "#c-sharp-front-ends-must-use-entities-%28models%29"
        },
        {
          "title": "C Sharp Front-ends MUST use Routers (Controllers)",
          "id": "#c-sharp-front-ends-must-use-routers-%28controllers%29"
        }
      ]
    },
    {
      "id": "OFQ-00007",
      "title": "Secret Management",
      "url": "http://localhost:8080/standards/secret-management/",
      "date": "2025-09-16T00:00:00.000Z",
      "tags": [
        "Digital",
        "Infrastructure",
        "Data"
      ],
      "requirements": [
        {
          "title": "Managed Identites MUST be used over secrets where possible",
          "id": "#managed-identities-must-be-used-over-secrets-where-possible"
        },
        {
          "title": "Secret information MUST be stored in Key Vaults when Managed Identities is unavailable",
          "id": "#secret-information-must-be-stored-in-key-vaults-when-managed-identities-is-unavailable"
        },
        {
          "title": "Secrets MUST be revoked when deemed compromised",
          "id": "#secrets-must-be-revoked-when-deemed-compromised"
        }
      ]
    },
    {
      "id": "OFQ-00008",
      "title": "Data Driven Architecture",
      "url": "http://localhost:8080/standards/data-driven-architecture/",
      "date": "2026-03-09T00:00:00.000Z",
      "tags": [
        "Digital",
        "Data"
      ],
      "requirements": [
        {
          "title": "Developers MUST start design with data modelling where appropriate and involve data engineers",
          "id": "#developers-must-start-design-with-data-modelling-where-appropriate-and-involve-data-engineers"
        },
        {
          "title": "Developers MUST prioritise creating systems that leverage databases",
          "id": "#developers-must-prioritise-creating-systems-that-leverage-databases"
        },
        {
          "title": "Developers MUST leverage alternate data-driven solutions where databases are not suitable",
          "id": "#developers-must-leverage-alternate-data-driven-solutions-where-databases-are-not-suitable"
        }
      ]
    },
    {
      "id": "OFQ-00008",
      "title": "Static Web Applications",
      "url": "http://localhost:8080/standards/static-web-apps/",
      "date": "2026-03-09T00:00:00.000Z",
      "tags": [
        "Digital",
        "Infrastructure",
        "Product",
        "UX"
      ],
      "requirements": [
        {
          "title": "Static Apps MUST only be used for simple websites",
          "id": "#static-apps-must-only-be-used-for-simple-websites"
        },
        {
          "title": "Static Apps MUST use Node with an approved build and deployment tools",
          "id": "#static-apps-must-use-node-with-an-approved-build-tool"
        }
      ]
    },
    {
      "id": "OFQ-00009",
      "title": "Developer Testing",
      "url": "http://localhost:8080/standards/developer-testing/",
      "date": "2025-10-10T00:00:00.000Z",
      "tags": [
        "Digital",
        "Quality Assurance"
      ],
      "requirements": [
        {
          "title": "Tests must be clear, purposeful, and maintainable",
          "id": "#tests-must-be-clear-purposeful-and-maintainable"
        },
        {
          "title": "Tests must be run automatically in the CI/CD pipeline",
          "id": "#tests-must-be-run-automatically-in-the-cicd-pipeline"
        },
        {
          "title": "Tests must cover new features and bug fixes",
          "id": "#tests-must-cover-new-features-and-bug-fixes"
        },
        {
          "title": "Tests must be documented and reviewed in the PR",
          "id": "#tests-must-be-documented-and-reviewed-in-the-PR"
        },
        {
          "title": "Tests must be designed to reduce maintenance effort",
          "id": "#tests-must-be-designed-to-reduce-maintenance-effort"
        },
        {
          "title": "Tests must include effectiveness metrics",
          "id": "#tests-must-include-effectiveness-metrics"
        },
        {
          "title": "Tests must consider edge cases",
          "id": "#tests-must-consider-edge-cases"
        }
      ]
    },
    {
      "id": "OFQ-00010",
      "title": "Infrastructure as Code",
      "url": "http://localhost:8080/standards/iac-standards/",
      "date": "2025-11-12T00:00:00.000Z",
      "tags": [
        "Digital",
        "Infrastructure"
      ],
      "requirements": [
        {
          "title": "IaC must be written using Microsoft Bicep",
          "id": "#iac-must-be-written-using-microsoft-bicep"
        },
        {
          "title": "IaC must be considered first",
          "id": "#iac-must-be-considered-first"
        },
        {
          "title": "IaC must be modular",
          "id": "#iac-must-be-modular"
        },
        {
          "title": "IaC must be hosted in Azure DevOps",
          "id": "#iac-must-be-hosted-in-azure-devops"
        }
      ]
    },
    {
      "id": "OFQ-00011",
      "title": "Back-end development",
      "url": "http://localhost:8080/standards/back-end-development/",
      "date": "2026-03-09T00:00:00.000Z",
      "tags": [
        "Digital"
      ],
      "requirements": [
        {
          "title": "All repositories MUST be set up in a consistent manner",
          "id": "#all-repositories-must-be-set-up-in-a-consistent-manner"
        },
        {
          "title": "All exceptions MUST be handled and logged",
          "id": "#all-exceptions-must-be-handled-and-logged"
        }
      ]
    },
    {
      "id": "OFQ-00012",
      "title": "Front-end Development",
      "url": "http://localhost:8080/standards/front-end-development/",
      "date": "2026-03-09T00:00:00.000Z",
      "tags": [
        "Digital",
        "Data"
      ],
      "requirements": [
        {
          "title": "All repositories MUST be set up in a consistent manner",
          "id": "#all-repositories-must-be-set-up-in-a-consistent-manner"
        },
        {
          "title": "All exceptions MUST be handled and logged",
          "id": "#all-exceptions-must-be-handled-and-logged"
        }
      ]
    },
    {
      "id": "OFQ-00013",
      "title": "Shutter page content",
      "url": "http://localhost:8080/standards/shutter-page-content/",
      "date": "2025-11-13T00:00:00.000Z",
      "tags": [
        "Infrastructure",
        "Digital",
        "UCD"
      ],
      "requirements": [
        {
          "title": "You SHOULD follow the GOV.UK design system pattern",
          "id": "#you-should-follow-the-govuk-design-system-pattern"
        },
        {
          "title": "You MUST be as specific as possible without being confusing",
          "id": "#you-must-be-as-specific-as-possible-without-being-confusing"
        },
        {
          "title": "You MUST choose a template based on which service is unavailable",
          "id": "#you-must-choose-a-template-based-on-which-service-is-unavailable"
        },
        {
          "title": "You MUST choose content sections based on the facts to hand",
          "id": "#you-must-choose-content-sections-based-on-the-facts-to-hand"
        },
        {
          "title": "You SHOULD update the page as the facts change",
          "id": "#you-should-update-the-page-as-the-facts-change"
        }
      ]
    },
    {
      "id": "OFQ-00014",
      "title": "Commit Messages",
      "url": "http://localhost:8080/standards/commit-messages/",
      "date": "2025-11-13T00:00:00.000Z",
      "tags": [
        "Digital",
        "Data",
        "Infrastructure"
      ],
      "requirements": [
        {
          "title": "Commit message format MUST follow this structure",
          "id": "#commit-message-format-must-follow-this-structure"
        },
        {
          "title": "Components you MUST use in commits",
          "id": "#components-you-must-use-in-commits"
        },
        {
          "title": "Examples",
          "id": "#examples"
        }
      ]
    },
    {
      "id": "OFQ-00015",
      "title": "IaC Build Configuration Standard",
      "url": "http://localhost:8080/standards/standard-iac-bicep-configuration/",
      "date": "2025-11-10T00:00:00.000Z",
      "tags": [
        "Guide",
        "Meta",
        "IaC",
        "Infrastructure"
      ],
      "requirements": [
        {
          "title": "IaC must follow a standard folder structure",
          "id": "#infrastructure-as-code-folder-structure"
        },
        {
          "title": "The name of the bicep configuration file must follow the defined format",
          "id": "#the-configuration-file-name-follows-a-standard"
        },
        {
          "title": "The bicep configuration file must be in the form of our template",
          "id": "#bicep-configuration-file-template"
        },
        {
          "title": "The bicep configuration file must define the tags",
          "id": "#bicep-configuration-tags"
        },
        {
          "title": "The bicep configuration file must define the environment variables",
          "id": "#bicep-configuration-environment-variables"
        },
        {
          "title": "The bicep configuration file must map the secrets being used",
          "id": "#bicep-configuration-secrets"
        },
        {
          "title": "The bicep configuration file must define the docker container image to be deployed",
          "id": "#bicep-configuration-image-name"
        },
        {
          "title": "the bicep configuration file must define the runtime machine",
          "id": "#bicep-configuration-processor"
        },
        {
          "title": "the bicep configuration file must define the environment; dev/pprd/prd",
          "id": "#bicep-configuration-enviroment"
        }
      ]
    },
    {
      "id": "OFQ-00016",
      "title": "Naming Conventions",
      "url": "http://localhost:8080/standards/naming-conventions/",
      "date": "2026-03-09T00:00:00.000Z",
      "tags": [
        "Digital",
        "Data",
        "Infrastructure"
      ],
      "requirements": [
        {
          "title": "Azure Resources",
          "id": "#azure-resources"
        },
        {
          "title": "Service Principal Names",
          "id": "#service-principle-names"
        },
        {
          "title": "SQL Database Objects",
          "id": "sql-database-objects"
        },
        {
          "title": "Azure Data Factory Objects",
          "id": "#azure-data-factory-objects"
        }
      ]
    },
    {
      "id": "OFQ-00017",
      "title": "Networking",
      "url": "http://localhost:8080/standards/networking/",
      "date": "2025-11-14T00:00:00.000Z",
      "tags": [
        "Digital",
        "Infrastructure"
      ],
      "requirements": [
        {
          "title": "Access to all environments must be restricted",
          "id": "#access-to-all-environments-must-be-restricted"
        },
        {
          "title": "Preprod must aim to mirror production",
          "id": "#preprod-must-aim-to-mirror-production"
        },
        {
          "title": "Cloud First",
          "id": "#cloud-first"
        }
      ]
    },
    {
      "id": "OFQ-00017",
      "title": "Defining a Service in Ofqual",
      "url": "http://localhost:8080/standards/Defining-a-Service-in-Ofqual/",
      "date": "2025-12-01T00:00:00.000Z",
      "tags": [
        "Digital",
        "Product",
        "UCD",
        "Service"
      ],
      "requirements": [
        {
          "title": "Be defined by the outcome they deliver to users",
          "id": "#be-defined-by-the-outcome-they-deliver-to-users"
        },
        {
          "title": "Include all channels through which users interact (digital and non-digital)",
          "id": "#include-all-channels-through-which-users-interact-digital-and-non-digital"
        },
        {
          "title": "Include all components required to deliver the outcome (systems, processes, people, infrastructure)",
          "id": "#include-all-components-required-to-deliver-the-outcome-systems-processes-people-infrastructure"
        },
        {
          "title": "Be designed around user needs, not organisational structures",
          "id": "#be-designed-around-user-needs-not-organisational-structures"
        },
        {
          "title": "Be assessed and improved using the Service Standard",
          "id": "#be-assessed-and-improved-using-the-service-standard"
        }
      ]
    },
    {
      "id": "OFQ-00018",
      "title": "Identity broker usage",
      "url": "http://localhost:8080/standards/identity-broker-usage/",
      "date": "2026-03-09T00:00:00.000Z",
      "tags": [
        "Digital"
      ],
      "requirements": [
        {
          "title": "Use Keycloak as an identity broker for authentication and authorisation",
          "id": "#use-keycloak-as-an-identity-broker-for-authentication-and-authorisation"
        }
      ]
    },
    {
      "id": "OFQ-00019",
      "title": "APIM usage",
      "url": "http://localhost:8080/standards/apim-usage/",
      "date": "2026-03-09T00:00:00.000Z",
      "tags": [
        "Digital"
      ],
      "requirements": [
        {
          "title": "Azure APIM MUST be used as an API Gateway to provide a single entry-point into Ofqual APIs.",
          "id": "#azure-apim-must-be-used-as-an-api-gateway-to-provide-a-single-entry-point-into-Ofqual-APIs"
        },
        {
          "title": "Each environment MUST contain an Azure APIM instance within its own subnet - leveraging network isolation and secure controlled access for internal and external API consumers.",
          "id": "#each-environment-must-contain-an-azure-apim-instance-within-its-own-subnet-leveraging-network-isolation-and-secure-controlled-access-for-internal-and-external-api-consumers"
        }
      ]
    },
    {
      "id": "OFQ-00020",
      "title": "Use of AI Agents",
      "url": "http://localhost:8080/standards/use-of-ai-agent-copilot/",
      "date": "2026-03-09T00:00:00.000Z",
      "tags": [
        "Infrastructure",
        "Digital",
        "Data"
      ],
      "requirements": [
        {
          "title": "Each Use Case Must Be Assessed Before Starting Work",
          "id": "#Each-Use-Case-Must-Be-Assessed-Before-Starting-Work"
        },
        {
          "title": "AI Agents Must Only be Used on Internal Systems",
          "id": "#AI-Agents-Must-Only-be-Used-on-Internal-Systems"
        },
        {
          "title": "AI Agents Must Use Compliant Data Sources and Connectors",
          "id": "#ai-agents-must-use-compliant-data-sources-and-connectors"
        }
      ]
    }
  ]
}