Skip to main content
CAROClimate Action Regional Offices
Patchwork farmland and hedgerows seen from a hill, rain sweeping across one side and sunlight on the other.

The full programme

Then to now

One page, end to end: what the service is today, what it becomes under the full programme, why each change was necessary and who benefits from it.

ProvenanceEvery “then” statement is an observation from the Stage 0 read-only baseline of the live caro.ie estate and is traceable to docs/current-site-audit.md, docs/migration/*.csv, docs/integration-register.md or docs/risk-register.md. Every “now” statement is either implemented in this prototype or a written commitment recorded in the requirements traceability register.

01

Ten changes that matter

Cosmetic change is the least of it. Each row below states the reason for the change and the group it serves, so the value can be judged independently of taste.

01

Finding anything

Then

Case studies spread over nine paged lists with no filters; site search is a legacy postback with no facets.

Now

One index across pages, projects, plans, events and PDF text, with region, authority, theme and format facets and shareable result URLs.

Why it was needed
Reuse of existing CARO work was blocked by the interface, not by a lack of content.
Who it serves
Local authority officers, researchers, the public
02

Geographic thread

Then

No route from a place to the plan and the projects that serve it; regions and authorities are unconnected page trees.

Now

Region → Local Authority → Climate Action Plan → Projects → Case Studies as one continuous, data-driven path across all 4 regions and 31 authorities.

Why it was needed
Climate action is answered locally; the site has to answer 'what is happening near me'.
Who it serves
Public, elected members, media
03

Portal identity

Then

Local portal accounts, authority chosen as free text at registration, no multi-factor authentication.

Now

Microsoft Entra ID single sign-on, phishing-resistant MFA enforced, authority derived from verified claims, six least-privilege roles re-checked server side.

Why it was needed
The portal was the softest target in the estate and access did not follow the officer's employment lifecycle.
Who it serves
CARO, every participating authority, the NCSC posture of the estate
04

Privacy posture

Then

Analytics and three session-replay tools observed firing before any consent decision, including on the portal login page.

Now

Deny-by-default consent gate, session replay removed entirely, versioned and auditable consent records, withdrawal from every page.

Why it was needed
A live GDPR and ePrivacy exposure on a public-sector service, recording officers as they signed in.
Who it serves
Every visitor; the authority's own data-protection accountability
05

Accessibility

Then

272 images without alt text, duplicate H1s, no documented conformance testing.

Now

WCAG 2.2 AA designed in, alt text a required field that blocks publishing, axe-core gating every merge, independent audit before launch.

Why it was needed
Statutory obligation, and the audience includes people who cannot use the current site at all.
Who it serves
Disabled users, and the authority's legal position
06

Application security

Then

Permissive content security policy allowing inline and evaluated script; no visible dependency or secret scanning.

Now

Strict CSP with no unsafe-inline or unsafe-eval, full header set, secret and dependency scanning in CI, security.txt and coordinated disclosure.

Why it was needed
Defence in depth so a single content or supply-chain mistake cannot become a defacement.
Who it serves
CARO's public reputation
07

Brand integrity

Then

Test pages and placeholder slugs publicly indexed; inconsistent metadata; no structured data on any page.

Now

Review-before-publish workflow, metadata required, JSON-LD for organisation, articles, events and datasets so search and AI surfaces cite CARO accurately.

Why it was needed
Most people meet CARO in a search result or an AI answer before they ever reach the site.
Who it serves
CARO communications, national visibility
08

Ownership and lock-in

Then

Coupled CMS and presentation on a legacy stack; no published content model; single-vendor operational dependency.

Now

Standard Git repository, headless CMS behind an adapter interface, documented pipelines, environments and runbooks — retenderable or bringable in-house at any point.

Why it was needed
A 96-month term must not become a 96-month dependency.
Who it serves
Mayo County Council as contracting authority
09

Continuity

Then

Recovery objectives undocumented; no evidence of restore rehearsal.

Now

Documented RPO/RTO, automated backups with rehearsed restores, immutable deploy artefacts, rollback in minutes.

Why it was needed
Outage during a climate event is exactly when the service matters most.
Who it serves
CARO operations
10

Migration safety

Then

679 public URLs with established inbound links, citations and bookmarks.

Now

Every URL mapped, 683 redirect rules drafted and tested automatically against the legacy list, zero-404 gate before DNS change.

Why it was needed
A redevelopment that breaks existing citations destroys years of accumulated authority.
Who it serves
Everyone who has ever linked to caro.ie

02

The path from then to now

  1. Baseline, 21 Aug 2026

    Then

    The measured position of the live service: 679 URLs, 1,526 recorded issues, 3 session-replay tools, 0 pages with structured data, no MFA on the portal. Captured read-only; nothing on the live site was altered.

  2. Weeks 1–6

    Award to Stage 2

    Discovery is already complete and handed over on day one. Information architecture, content model and design system are confirmed with CARO, with an approval gate before any build begins.

  3. Weeks 7–16

    Stage 3–4

    Build of components, CMS adapter and portal shell, then integration of Entra ID with MFA, faceted search, consent and analytics. Each merge passes accessibility, security and performance gates.

  4. Weeks 17–24

    Stage 5–6

    Forensic content migration with per-section sign-off, independent WCAG 2.2 AA audit, external penetration test, redirect verification and performance budgets held in CI.

  5. Cutover

    Launch

    Rehearsed switchover with monitoring, rollback path and a zero-404 gate. Old URLs keep working; the change is visible to visitors as an improvement, not a disruption.

  6. Months 1–96

    Now, and for the term

    Patching, accessibility regression testing, quarterly reporting, content support and annual DR rehearsal — with documentation, training and an exit plan maintained continuously, not written at the end.

03

Go deeper