Delivery
Redevelopment programme
Stage-gated delivery with approval between stages, and an evidence trail that shows exactly why this is an upgrade rather than a reskin.
Before and after
Discovery
Current
Case studies spread across nine paged lists with no region, theme or format filter.
Proposed
Faceted discovery on region, authority, theme and format, with a shared index across projects, plans and knowledge topics.
Information architecture
Current
Knowledge Hub nested up to five levels deep; events and recordings structurally disconnected.
Proposed
Four intent-led pillars, metadata-driven relationships, every legacy URL preserved by 301 redirect.
Authentication
Current
Local portal accounts, self-declared free-text authority name, no multi-factor authentication.
Proposed
Microsoft Entra ID single sign-on with MFA enforced, authority derived from verified identity, role-based least privilege.
Privacy
Current
Analytics and three session-replay tools firing before consent, including on the portal login page.
Proposed
No replay tooling at all; analytics gated behind explicit granular consent and never on authenticated views.
Application security
Current
Permissive content security policy allowing inline and evaluated script.
Proposed
Strict CSP without unsafe-inline or unsafe-eval, full security header set, dependency and secret scanning in CI.
Brand integrity
Current
Test pages and placeholder slugs indexed publicly; inconsistent metadata and no structured data.
Proposed
Editorial workflow with review before publish, per-page metadata as a required field, JSON-LD for organisation, articles and events.
Accessibility
Current
272 images without alt text, duplicate H1s, no documented conformance testing.
Proposed
WCAG 2.2 AA designed in, alt text mandatory in the CMS, axe-core gating CI, independent audit before launch.
Maintainability
Current
Coupled CMS and presentation on a legacy stack, no visible CI/CD or content model documentation.
Proposed
Standard Git repository, headless CMS behind an adapter interface, documented pipelines, environments and runbooks — operable by any competent supplier.
Resilience
Current
Single-vendor hosting arrangement, recovery objectives undocumented.
Proposed
Documented RPO/RTO, automated backups with restore rehearsals, immutable deploy artefacts and rollback in minutes.
Stage gates
- Stage 0 — Discovery and readiness (complete)
- Stage 1 — Define: IA, content model, design direction
- Stage 2 — Prototype: design system and key templates
- Stage 3 — Build: components, CMS adapter, portal shell
- Stage 4 — Integrate: identity, search, analytics, consent
- Stage 5 — Migrate: forensic content transfer with sign-off
- Stage 6 — Assure: accessibility, security and performance testing
- Stage 7 — Launch: redirects, monitoring, cutover rehearsal
- Stage 8 — Operate: support, patching, reporting
- Stage 9 — Handover: documentation, training, exit plan
ProvenanceEvery “current” statement above is traceable to a Stage 0 artefact: docs/current-site-audit.md, docs/migration/*.csv, docs/integration-register.md and docs/risk-register.md, with rendered baseline screenshots retained under docs/evidence/. Nothing in the before column is inferred without evidence.