Identifying functional and non-functional requirements

Definition of Quality Attributes and Performance Metrics

When designing cloud systems, architects must define how well the system should work, not just what it does. These quality attributes are measured by Service Level Indicators (SLIs), which are specific metrics like request latency or error rate. To set clear targets, teams define Service Level Objectives (SLOs), which are goals for those metrics, such as 99.9% availability. These SLOs connect business needs, like keeping customers happy, to technical performance.

A useful framework for monitoring is the Four Golden Signals. These four key metrics give a complete picture of a service's health. They are latency (response time), traffic (demand), errors (failure rate), and saturation (how full resources like CPU are). Watching these signals helps teams spot problems before users do.

Observability is the practice of using all available data—metrics, logs, and traces—to understand the system's internal state. Tools like Cloud Monitoring help gather this data. To handle failures, systems should be designed for Graceful Degradation, meaning essential functions keep working even if some parts fail. Techniques like the Circuit Breaker Pattern can isolate failing components to prevent a single problem from crashing the entire system.

Translation of Business Processes into Functional Requirements

Functional requirements are the specific tasks a system must do, like "process a payment." They come from analyzing business use cases and user stories. For example, a bank's need for risk management translates into requirements for data validation and audit logging. This translation helps identify the necessary data flows, application logic, and which Google Cloud services to use.

A key part of implementing these requirements is designing data pipelines. These pipelines move and transform information. A common pattern is ETL (Extract, Transform, Load), which prepares data for analysis. Architects choose between batch processing (for scheduled reports) and streaming processing (for real-time insights) based on business needs. Services like BigQuery and Dataflow are tools that execute this logic.

Non-functional requirements define how the system performs these functions, focusing on quality aspects like security and reliability. Security is a major non-functional concern, often addressed with a zero-trust model where no user or device is trusted by default. This approach, supported by frameworks like BeyondProd, integrates security directly into the service infrastructure.

Finally, supporting business goals requires automation. CI/CD pipelines enable continuous delivery of software updates, allowing the system to adapt quickly to changing organizational needs. Implementing automated approval gates in these pipelines ensures that all changes align with business policies and security standards.

Assessment of Security, Compliance, and Operational Constraints

Businesses must assess a cloud provider's ability to meet regulatory compliance and security standards. This due diligence involves reviewing the provider's certifications, such as ISO/IEC 27001 for security management or PCI DSS for handling payment data. These audits provide assurance that the provider's controls meet industry mandates and help define non-functional requirements for data protection.

A core security model is zero-trust, which treats every access request as a potential threat. Instead of relying on a network firewall, it uses context-aware access to evaluate the user's identity, device security, and request context before granting permission. This model is essential for protecting against modern threats and is a key non-functional requirement for system reliability.

Operational constraints around safety and consistency are managed through automation. Tools like Binary Authorization ensure that only approved and verified software can be deployed to production. This creates a verifiable build process that reduces human error, increases security coverage, and maintains system performance during deployments.

Assessing data governance involves determining requirements for data residency (where data is stored), encryption standards, and privacy. A dedicated privacy team ensures product designs comply with laws. Organizations must also balance these needs with budgetary constraints by choosing cost-optimization strategies that don't compromise security, ensuring the solution remains both compliant and affordable.