CFT 8878529 · Adherence statement
Requirement by requirement, with the evidence attached
This page exists so that adherence can be assessed by inspection rather than assertion. Each published requirement is paired with the capability that satisfies it, the artefact that evidences it, and the method by which it can be independently verified.
19
Requirements mapped
14
Already implemented
5
Committed with method
0
Unevidenced claims
Requirement wording below is a faithful working restatement of the scope published on eTenders for CFT 8878529 (Mayo County Council, on behalf of the four Climate Action Regional Offices). Where the published documents use different numbering, the references here map to the master traceability register at docs/tender/MASTER-REQUIREMENTS-TRACEABILITY.csv and will be renumbered to the authority’s own references in the submitted response.
01
Scope of the contract
What the authority asked to be delivered, and what is delivered against it.
| Ref | Published requirement | How this solution satisfies it | Evidence | Verified by |
|---|---|---|---|---|
| SC-01 | Design, build and deliver a redeveloped CARO.ie website for the four Climate Action Regional Offices. | Complete working platform, not a mock-up: 4 regions and 31 local authorities modelled, with region, authority, climate action plan, project, knowledge and event templates implemented and navigable. | src/lib/caro-data.ts · /regions · /local-authority-climate-action | Automated integrity test asserts 4 regions and the official 5/5/4/17 authority split on every build. |
| SC-02 | Migration of existing content from the current website. | Forensic inventory of 679 live URLs with a per-URL disposition (migrate, rewrite, merge, archive, retire) and a 683-rule single-hop redirect map produced before any design work began. | docs/migration/content-inventory.csv · migration-matrix.csv · redirect-map.csv | Redirect map is machine-checkable; cutover test asserts every legacy URL returns a single 301 to a live target. |
| SC-03 | Content management system enabling CARO staff to maintain the site without supplier dependency. | Structured content model behind a typed CMS adapter interface, with draft → review → approve → schedule → publish workflow, per-field version history and one-click rollback. | /proposal/technology §02 | Contract tests run against the adapter; editor training recorded and handed over. |
| SC-04 | Secure area for local authority users (the existing portal function). | Portal rebuilt on federated identity: Microsoft Entra ID (OIDC), enforced MFA, Conditional Access, six least-privilege roles, authority scoping enforced server-side and again at row level. | /portal/roles · /proposal/security §01 | Independent penetration test before go-live; CI assertion that portal content never enters the public index. |
| SC-05 | Ongoing support, hosting and maintenance across the contract term (96 months). | Defined service model: 99.95% public availability, P1–P4 response targets, monthly service/security/accessibility reporting, quarterly restore rehearsal, annual penetration test and DR exercise. | /proposal/technology §08 · /proposal/programme | Measured by independent synthetic monitoring; reported monthly to the contracting authority. |
| SC-06 | Data processing carried out on behalf of the contracting authority (CPV 72300000 / 72500000 scope). | EU-only residency, documented ROPA, DPIA, retention schedule and sub-processor register; processor obligations mirrored in the service agreement. | /privacy · /cookies · docs/risk-register.md | Artefacts issued for DPO review before go-live; consent decisions logged and auditable. |
02
Mandatory technical requirements
Accessibility, security, privacy, language, hosting, portability, search and SEO.
| Ref | Published requirement | How this solution satisfies it | Evidence | Verified by |
|---|---|---|---|---|
| M-01 | Accessibility: WCAG 2.2 AA and EN 301 549 conformance, and S.I. 358/2020 obligations. | Accessibility designed in from Stage 0: semantic landmarks, visible focus, 24×24 targets, no keyboard traps, reduced-motion support, contrast-checked OKLCH token system, published statement with named contact and feedback route. | /accessibility · axe-core CI gate | Automated axe checks fail the build; independent audit before launch, re-audited annually. |
| M-02 | Security of the platform and of local authority user data. | Six-layer control stack (perimeter, application, identity, authorisation, data, supply chain), strict nonce CSP with no unsafe-inline, HSTS preload, signed SBOM per release, tamper-evident audit log. | /proposal/security · public/.well-known/security.txt | Header and TLS posture checks in CI; SAST/SCA/secret scanning on every commit; annual pen test. |
| M-03 | GDPR and ePrivacy compliance, including cookie consent. | Deny-by-default granular consent with no pre-consent tags. The three session-replay tools observed on the live estate at Stage 0 are removed entirely; analytics is consent-gated and disabled on authenticated views. | src/components/site/ConsentManager.tsx · docs/integration-register.md | Network capture on a clean profile shows zero third-party requests before consent. |
| M-04 | Irish language obligations under the Official Languages Act. | Bilingual architecture from day one: locale-aware routing, hreflang alternates, field-level translation workflow and fada-tolerant search. No re-platforming required to publish Irish content. | /gaeilge · src/lib/search-index.ts | Search tests assert diacritic-insensitive matching; locale routes render server-side. |
| M-05 | Hosting within the EU with defined resilience and recovery. | EU data residency, encrypted at rest and in transit, continuous PITR backups with immutable retention. RPO 15 minutes, RTO 60 minutes, rehearsed quarterly. | /proposal/technology §07–§08 | Restore rehearsal evidenced in the service report; DR runbook handed over. |
| M-06 | No supplier lock-in; the authority must be able to operate and transfer the solution. | Standard Git repository in the authority's own organisation, standard Node/Vite toolchain, CMS behind a replaceable adapter, no proprietary runtime and no hidden platform dependency. | /proposal/technology §10 · repository history | Clean-room rebuild from the repository performed and evidenced at handover. |
| M-07 | Search and findability across the content estate. | Typed faceted index replacing WebForms postback search: region, authority, theme, type, funding stream, year and format facets, URL-addressable filters, fada tolerance and fuzzy matching. | /search · src/lib/search-index.test.ts | Unit tests cover ranking, diacritics and index separation. |
| M-08 | SEO continuity and preservation of existing link equity. | Per-route titles, descriptions and structured data; canonical URLs; single-hop 301 redirects retained for at least 24 months; XML sitemap and Search Console monitoring at cutover. | docs/migration/redirect-map.csv · route head() metadata | Pre/post crawl comparison and index-coverage monitoring for 90 days after cutover. |
03
Award criteria
Where the response earns marks, and the evidence that supports each.
| Ref | Published requirement | How this solution satisfies it | Evidence | Verified by |
|---|---|---|---|---|
| A-01 | Quality of technical solution and architecture. | A published, inspectable reference architecture with named technologies, boundaries, data flows, environments and branching model — assessable rather than asserted. | /proposal/technology §01, §06, §07 | Every claim is either implemented in this prototype or stated explicitly as a commitment. |
| A-02 | Understanding of CARO's remit and content estate. | Stage 0 discovery produced a 13-section readiness report, an integration register of 13 third-party services and a remediation log of 1,526 content issues before a single design decision. | docs/current-site-audit.md · docs/integration-register.md | Findings are screenshot-backed against a dated read-only baseline. |
| A-03 | User experience, design quality and geographic discovery. | Region → Local Authority → Climate Action Plan → Project → Case Study is a first-class navigational model, not a menu. Bespoke, documentary-photography-led design with a locked token system. | /regions · /projects · /local-authority-climate-action | Navigable in this prototype today at every level of the chain. |
| A-04 | Project management, methodology and risk control. | Stage-gated delivery (Stage 0–9) with client approval between stages, a live risk register with owners, and a readiness dashboard that declares open gates instead of hiding them. | /proposal/programme · /proposal/readiness · docs/risk-register.md | Stage 0 artefacts already delivered and dated. |
| A-05 | Support, maintenance and value over the contract term. | Defined SLAs, monthly reporting, patch SLAs, access recertification, annual audits and a written exit plan — all costed as service, not discretionary effort. | /proposal/technology §08, §10 | Obligations drafted for inclusion in the service agreement. |
04
Why this stands up to scrutiny
The rules this response holds itself to, so that any statement can be checked.
Every factual claim about the current site is dated and screenshot-backed
Stage 0 inspection was read-only and recorded on 21 August 2026. Nothing on the live estate was altered, and no credential was used.
Observations are separated from conclusions
The audit distinguishes confirmed facts, observations, assumptions and recommendations. Technical observations are never presented as legal findings.
No fabricated data anywhere
No invented statistics, funding values, quotes, dates or outcomes appear in this prototype. Items that require CARO confirmation are listed as open clarifications.
Prototype auth is labelled MOCK
Portal screens demonstrate the model only. They perform no authentication and hold no data.
Commitments are labelled as commitments
Availability, RPO/RTO and performance budgets are offered targets for negotiation, clearly distinguished from measurements.
Traceability is machine-readable
Requirement → response → evidence → verification is maintained as a CSV in the repository so the authority can audit coverage without reading prose.
05
Declared open items
Facts that cannot be generated. Declaring them is part of being defensible.
- Formal tender documents were not available for download at the time of writing; requirement wording is restated from the published eTenders notice and will be reconciled clause-by-clause on receipt.
- Comparable-contract references, insurance certificates and financial standing evidence are supplied by the bidding entity at selection stage — tracked on the readiness dashboard.
- Any CARO statistic, funding value or programme outcome shown in the public prototype must be supplied and signed off by CARO before publication.
- Integration purposes observed at Stage 0 (analytics ownership, mailing list, mapping and data feeds) require confirmation from CARO before removal or replacement.
ProvenanceStatements about the live caro.ie estate are traceable to the dated, read-only Stage 0 inspection recorded in docs/current-site-audit.md. Service targets are offered commitments, not measurements. All portal screens in this prototype are MOCK.