Government services portal testing checklist

Download the checklistMarkdownCSVBrief (Markdown)

1. 1.release smoke testsDone when: On the release build, a citizen signs in, starts an application, saves it and sees its case status, and sees only their own cases.Risks: data-breach. Tool class: browser automation. Usually run by: QA engineer.
2. 2.penetration testingDone when: A tester signed in as one citizen cannot view another person's case or documents by changing an ID, and cannot bypass identity proofing to file a claim.Risks: data-breach, fraud-abuse. Tool class: proxy. Usually run by: security specialist.
3. 3.end-to-end functional testsDone when: A claim filed with a test identity that fails proofing is held for review, and a claim under an identity already in use is flagged before payment.Risks: fraud-abuse. Tool class: browser automation. Usually run by: QA engineer.
4. 4.compliance checksDone when: A reviewer holds a current accessibility conformance report and a current security authorisation for the release.Risks: accessibility-liability, data-breach. Tool class: test management. Usually run by: product manager.
5. 5.accessibility testingDone when: A screen reader user and a keyboard-only user each complete an application, upload a document and read case status without help.Risks: accessibility-liability. Tool class: accessibility checker. Usually run by: accessibility specialist.
6. 6.security scanningDone when: The scan report for the portal and its admin tools lists no open high-severity finding, and every staff account requires phishing-resistant sign-in.Risks: data-breach. Tool class: DAST scanner. Usually run by: security specialist.
7. 7.performance and load testingDone when: Sign-in and form submission keep working while a load test simulates the opening hours of an enrolment window.Risks: outage-under-load. Tool class: load generator. Usually run by: QA engineer.
8. 8.resilience and failure testingDone when: When the identity or case backend is slowed in a test, applicants see a queue or retry message and no submitted form is lost.Risks: outage-under-load. Tool class: chaos tool. Usually run by: developer.