Delivery standards.

Standards

The procedures

1. ST-1 Written scope

   No build starts without a scope document listing deliverables, assumptions, exclusions and acceptance criteria, agreed by both sides.

2. ST-2 Change control

   Any change to scope is described in writing with its effect on time and cost, and proceeds only after your approval.

3. ST-3 Ownership

   Code, design files, domains, hosting and store accounts are registered to your organisation. Credentials are shared through a password manager, never email.

4. ST-4 Security baseline

   Two-factor authentication on all accounts, least-privilege access, dependency scanning, secrets kept out of repositories, OWASP guidance followed.

5. ST-5 Accessibility

   Interfaces designed and tested against WCAG 2.2 AA, including keyboard-only and screen-reader testing on key journeys.

6. ST-6 Review and test

   Every change is peer-reviewed; critical paths have automated tests; releases are tested on real devices and browsers.

7. ST-7 Reporting

   A weekly written status — done, next, blocked, risks — and a shared tracker you can read at any time.

8. ST-8 Data protection

   Collect only what is needed, document why, and support your UK GDPR obligations including records of processing.

9. ST-9 Handover

   A runbook covering build, deploy, rollback, monitoring and contacts, sufficient for another supplier to continue.

Self-check

Hold any supplier to this

Use this list to check any proposal — ours or anyone else’s. If a supplier cannot show how they meet a standard, ask why.