Skip to main content
CAROClimate Action Regional Offices
Patchwork farmland and hedgerows seen from a hill, rain sweeping across one side and sunlight on the other.

Stage 3 — Upgrade evidence

Before and after, measured

Every claim below is set against the Stage 0 read-only baseline of the current service. Counts are observations from the crawl; targets are design commitments for the proposed build.

ProvenanceBaseline captured during Stage 0 discovery of the live caro.ie estate. Nothing on the live service was altered. Full evidence, screenshots and CSV inventories are held in the programme documentation.

01

The numbers

Measured Stage 0 baseline compared with proposed targets
MeasureCurrent siteProposedHow it is achieved
Public URLs crawled679679 preservedEvery legacy URL mapped to a destination; 683 redirect rules drafted.
Images without alt text2720 publishableAlt text is a required CMS field; publishing is blocked without it.
Session-replay tools loaded30FullStory, Mouseflow and Smartlook observed firing before consent.
Non-essential scripts before consent40Deny-by-default consent gate; nothing optional loads until a choice is recorded.
Pages using structured data (JSON-LD)0All content typesOrganisation, Article, Event and Dataset schemas emitted from the content model.
MFA coverage on portal accounts0%100%Entra ID single sign-on with phishing-resistant factors; no local passwords.
Clicks to a filtered case study9 paged lists, no filters1 faceted queryRegion, authority, theme and format facets over a single shared index.
Test/placeholder pages publicly indexed2 observed0Editorial review before publish, plus a pre-launch index hygiene gate.

02

Six lenses on the same upgrade

Functional

Today

  • Case studies paged nine deep with no filtering, sorting or saved views.
  • Events and recordings held in separate trees with no relationship to projects.
  • No way to move from a place to the plan and projects that serve it.

Proposed

  • Region → Local Authority → Climate Action Plan → Projects → Case Studies as one continuous thread.
  • Faceted, keyboard-operable filtering with results counts and shareable URLs.
  • One index spanning pages, projects, plans, events and PDF text.

ValueOfficers and the public reach the relevant material in a single step instead of browsing a page tree, which reduces support queries and increases reuse of existing CARO work.

Technical

Today

  • Coupled CMS and presentation on a legacy ASP.NET WebForms stack.
  • No observable CI/CD, dependency scanning or documented content model.
  • Recovery objectives undocumented; single-vendor operational dependency.

Proposed

  • Edge-rendered front end with a headless CMS behind an adapter interface — the CMS can be replaced without rewriting the site.
  • Standard Git repository, reproducible builds, automated tests, accessibility and dependency gates in CI.
  • Documented RPO/RTO, rehearsed restores, immutable artefacts and minute-scale rollback.

ValueThe authority owns a system any competent supplier can operate, tender again, or bring in-house — no lock-in to this vendor or to any single tool.

Security

Today

  • Local portal accounts with a free-text authority name at registration.
  • No multi-factor authentication on portal sign-in.
  • Content Security Policy permitting inline and evaluated script.

Proposed

  • Organisational identity via Entra ID with conditional access and phishing-resistant MFA.
  • Authority membership derived from verified claims; least-privilege roles re-checked server side on every request.
  • Strict CSP, full security header set, tamper-evident audit log, coordinated disclosure via security.txt.

ValueThe portal stops being the softest target in the estate. Access follows the officer's own employment lifecycle, so leavers lose access the moment their organisation disables them.

Privacy

Today

  • Analytics and three session-replay tools firing before any consent decision.
  • Replay tooling active on the portal login page.
  • Consent management platform present but unconfigured.

Proposed

  • Nothing optional loads until an explicit, granular choice is recorded.
  • Session replay removed entirely; no behavioural recording of officers or the public.
  • Auditable, versioned consent records with one-click withdrawal from every page.

ValueRemoves a live GDPR and ePrivacy exposure on a public-sector service, and gives the authority a defensible record of exactly what was consented to and when.

Brand integrity

Today

  • Test pages and placeholder slugs indexed publicly.
  • Inconsistent page metadata; no structured data; unverified PDF estate.
  • Stock-styled presentation indistinguishable from generic templates.

Proposed

  • Review-before-publish workflow with metadata and alt text as required fields.
  • Structured data on every content type, so search and AI surfaces cite CARO accurately.
  • A bespoke Irish visual system — commissioned photography, restrained typography, the existing CARO mark refined rather than replaced.

ValueProtects how CARO appears in search results, social previews and AI answers — the places most people meet the brand before they ever reach the site.

Visual & experience

Today

  • Template-driven layouts with dense link lists and little visual hierarchy.
  • Imagery used decoratively, frequently without alt text.
  • Limited contrast discipline; no documented design tokens.

Proposed

  • Landscape-led pages where photography carries the subject of the page and every image has meaningful alt text.
  • A documented token set — colour, type scale, spacing, motion — themed once and inherited everywhere.
  • Contrast, focus states, target sizes and reduced-motion behaviour designed to WCAG 2.2 AA from the first screen.

ValueA service that reads as authoritative and distinctly Irish, and remains consistent as content grows because the design is systematised rather than hand-styled per page.

03

How the upgrade is proven, not asserted

Baseline held in evidence

Rendered screenshots, crawl data and header captures from the current service are retained so any claim can be re-checked at award and at go-live.

Independent accessibility audit

WCAG 2.2 AA conformance verified by a third party before launch, with automated axe-core checks gating every merge in between.

Penetration test before go-live

External test of the public site and the authority portal, with findings tracked to closure and a retest before switchover.

Redirect verification

Every one of the drafted redirect rules is tested automatically against the legacy URL list, with a zero-404 gate before DNS change.

Performance budgets in CI

Core Web Vitals budgets enforced on each build; a regression fails the pipeline rather than reaching the public.

Handover pack

Repository, content model, runbooks, DR procedures and architecture decision records transferred to the authority as standard artefacts.