Guide to CMS Requirements Template

8/12/2019 Guide to CMS Requirements Template

1/82

Guide to

CMS Requirements

Specification

Choose the right CMS

M.Sc. Thesis byJan Keller Pedersen & Miriam Tang

[email protected] [email protected]

http://www.cusix.dk/cmsguide

August 2007, IT University of Copenhagen


2/82


3/82

1

Table of Contents

1 How to assess and select a CMS...................21.1 Why a CMS............................................................2

1.2 Basis of the report...................................................41.3 How to use this document...................................... 41.4 Send requirements specification.............................4

1.5 !a"uate rep"ies...................................................... 5

2 Manual for CMS requirements template....6

A Guidance to the supplier...............................6

B High leel demands......................................1!

C "or# areas and tas#s..................................2!C.1 Mana#e temp"ates................................................. 21

C.2 $dd%edit%de"ete content item.................................23

C.3 &e!iew and appro!e content ................................2'

C.4 (u)"ish content .....................................................2*

C.5 Mana#e media "i)rary...........................................2*C.+ ,in- chec-in#....................................................... 3C.' Mana#e site structure............................................31

C./ Mana#e news"etter types.......................................32C.* Mana#e news"etter su)scriptions..........................32

C.1 Mana#e news"etter su)scriptions from frontend.33C.13 Browse news.......................................................35

C.14 Mana#e course e!a"uation form..........................3+C.15 &ep"y to course e!a"uation form.........................3'

C.1+ Search content.....................................................3/

$ $ata to present.............................................%!0.1 orm......................................................................42

0.2 uestion................................................................42

0.3 ype......................................................................420.4 ption...................................................................420.5 &ep"y.....................................................................43

0.+ $nswer..................................................................43

& 'ther functional requirements...................%%.1 Comp"e ca"cu"ations and ru"es............................ 45

.2 (rint6outs7 statistics and reports............................ 45

.3 0ynamic content components...............................45.4 pansion of the system....................................... 4'

.5 Search en#ine optimisation...................................4'.+ ther functiona" requirements.............................. 4/

.+ ther functiona" requirements.............................. 4*

( S)stem integration with e*ternal s)stems..+!.1 0irectory ser!ice................................................... 51

.2 $na"ytics software 6 8oo#"e $na"ytics................. 51.3 Course enro"ment system...................................... 51

.4 9nte#ration with new eterna" systems..................53

G ,echnical -, architecture...........................+%8.1 Hardware and software requirements...................55

H Securit).........................................................+6H.1 $ccess ri#hts for users..........................................5'

H.2 Security mana#ement........................................... 5'

H.3 (rotection a#ainst data "oss...................................5*H.4 (rotection a#ainst unintended user actions...........5*

H.5 (rotection a#ainst threats .....................................+1

- sa/ilit) and design......................................6%9.1 ,earnin# and efficiency in dai"y use......................+5

9.2 $ccessi)i"ity and ,oo-6and6fee"............................ +'

0 'ther requirements......................................6:.1 ther standards to )e fo""owed.............................. +*

:.2 rainin#..................................................................+*:.3 ;ser 0ocumentation.............................................. +*

:.4 0ata con!ersion and import...................................+*:.5 9nsta""ation..............................................................'

Customer deliera/les................................ 324 'perations5 support and maintenance.......3%

,.1 &esponse times......................................................'5

,.2 $!ai"a)i"ity............................................................'+,.3 Support..................................................................''

,.4 Maintenance..........................................................'*

Glossar)........................................................!

his specification is )ased on &equirements emp"ate S,6' ren ,auesen7 2'?


4/82

2

1 How to assess and select a CMS

More and more organisations are facing the process of a CMS acquisition, and many

organisations find themselves on shaky ground, because they do not know where to begin or

what to expect of a CMS. Even people with knowledge of CMSs, might use a lot of resourceson clarifying needs, requirements and not least on structuring them in a way, that makes therequirements manageable to the organisation as well as to consultants selling CMS solutions.

!his document contains a CMS requirements specification template and a guide that will helpidentifying needs and requirements and convert them into a requirements specification that

solution providers can use to respond with uniform replies, making the comparison ofproposals easier. !hereby time and resources can be released for "! governance andcommunication strategies that are important factors as well, but are outside the scope of thisCMS #equirements !emplate.

1.1 Why a CMS

$ebsites have gone from simple business card style static %!M& to dynamic extensions of acompanys image. ' website is much more now than ever before. ' website can be critical toattracting and keeping customers as well as it can bethe business for a company.

!he task of managing a website has grown in si(e as well, going from an "! supporter with flair

for %!M& managing a handful of pages to do(ens or hundreds of non)"! practitioners adding,editing, deleting and arranging content on multiple domains simultaneously.

"t is therefore no surprise that the demands for systems to manage the web content havegrown, too. !oday, content management systems *CMSs+ can be as vital to a companys web

strategy as the E# system is to the internal running and management of the company itself.

1.1.1 CMS distinctionCMSs can be categorised on many parameters and groupings. $e have chosen a distinctionbased on functionality and flexibility, visualised in "llustration -, where a curve describes thetypical range of CMSs.



5/82

3

!he illustration has five points of interest

-. /ut)of)the)box $eb CMS 0 'ble to manage web page content within certain limitsimposed by the system. 1ew ways for the customer or a third party to customise thesystem beyond changing the frontend design.

2. 1lexible $eb CMS 0 Content is still web pages within certain limits, but the

customisability and extendibility is increased. Customer or a third party can makeextensive changes to the behaviour of the system.

3. 4evelopment tool 0 More of a platform to build on than a ready)to)use system. !hecustomer or a third party will have few if any restrictions on how to use the system and

instead the system will facilitate common functionality through standard libraries.%owever, practically nothing is working out)of)the)box and will have to be defined ordeveloped by the CMS developers or an experienced third party, meaning that thecustomer relies heavily on their knowledge and skill with the CMS.


-llustration 17 Basic CMS categories


6/82

4

5. 1lexible Enterprise CMS 0 Content is no longer web specific, but can be any contentfrom any system, published through the CMS and made available to internal as well as

external viewers based on the access rules defined in the CMS. 's with the 1lexible $ebCMS, a wide range of possibilities exists for modifying and customising the system.

6. /ut)of)the)box Enterprise CMS 0 More specific functionality than the 1lexible EnterpriseCMS and more functionality directly upon installation and configuration. !his type of

CMS aims at supplying everything needed by the customers so customisations areunnecessary.

/ne type of CMS is not better than the other. $hich CMS is the right one for a customerdepends on the customers needs. 7enerally speaking, the closer the CMS is to a development

tool, the more flexible is the system and the higher are the costs of customisations andmodifications will be in the implementation process.

1.2 Basis of the report

!he report is based on investigations on common needs and experiences collected from ten

CMS costumer organisations, five CMS consultants and one CMS developers, with the aim ofsupporting the decision making in customer companies. !he report helps defining customerneeds and finding the right CMS to fulfil them in the process of *re)+defining their websites.

!he result is a template for CMS requirements specifications that can be used by companies ororganisations with a frequently updated website.

1.3 How to use this document

!his document is a guide of how to customise the CMS #equirements !emplate into a specificrequirements specification for a specific CMS acquisition pro8ect.

1or each requirement in the template, it should be considered, whether it is a requirement that

is relevant to the organisation or not. "f relevant, the requirement can be used as)is or refinedwith further details or by filling in the solution example columns.

/nce the requirements specification is finished, it can be sent to candidate suppliers to fill in

the solution parts and their replies can be evaluated and compared.

1.4 Send requirements specification

$ith a requirements specification finished with all left)hand side columns filled and some right)hand side column solution examples, it is time to send it to a range of suppliers and evaluatethe replies.

Screening candidate suppliers can be done in several ways



7/82

5

Scenario -. Start /) selecting suppliers --. Start /) selecting s)stems ---. & tender

Step 1 ind competent supp"iers ind interestin# systems Ca"" for tenders

Step 2 Send requirements specification


8/82

+

2 Manual for CMS requirements template

!he manual for the CMS requirements template consists of the directions and advice on how to

use the template. !he chapters in the manual follow the chapters in the template.

!he template and this guide can be downloaded from http::www.itu.dk:people:8ankp:CMS.

Some requirements and solution examples are in italic, meaning that it is purely an examplefor illustrating purposes and that it is highly unlikely to be usable directly.

# $uidance to the supplier

his chapter #i!es information to the supp"ier on how to read the requirements and is copied in fu""

from the correspondin# chapter in &equirements emp"ate S,6' ren ,auesen7 2'?

# $uidance to the supplierhis chapter ep"ains the requirements format and how the supp"ier descri)es his so"ution.he requirements are or#anised in chapters accordin# to their -ind7 e.#. Chapter C a)out the user tas-s to )e

supported. Within each chapter7 the requirements are written in ta)"es7 e.#. a ta)"e with requirements re"atin# toa specific tas-. he ta)"es ha!e three co"umns. he "eft co"umn descri)es the customer@s demand7 the midd"e

co"umn an eamp"e of a so"ution or the proposed so"ution. he ri#ht co"umn specifies when the so"ution isde"i!ered and whether it wi"" )e part of a CS system.

#.1 %unctional requirements & constructed e'ampleHere is a constructed eamp"e without re"ation to the present de"i!ery. he purpose is on"y to i""ustrate the

requirements format. he hi#h6"e!e" requirement is that the system must support a num)er of tas-s7 inc"udin#C57 and prefera)"y e"iminate the current pro)"ems.

C.+ Handle a request

. . .

sers7 Ca""6center staff7 often temporari"y emp"oyed.

&nironment7 pen6p"an7 noisy office where users sit c"ose to each other.

(requenc)7 9n tota" around 5 ca""s per day7 and a maimum of 1 ca""s per user.. . .

0emandA So"utionA Code

1. &ecei!e the ca"" throu#h mai"7 phone or emai".9t may )e a new request or information a)out

an eistin# request.2. ind the request fi"e . . . 9n case of an emai" ca""7 the system automatica""y

transfers data from the emai" to the search screen.

2a. Create a new request fi"e.

2p. (ro)"emA he request fi"e may )e hard to

"ocate7 e.#. )ecause the ca""er doesn@t -now the

request 90 or cannot remem)er his persona"90.

he system shows possi)"e matches with the

ca""er@s name or parts of it.

. . .

http://www.itu.dk/people/jankp/CMShttp://www.itu.dk/people/jankp/CMS


9/82

'

he ta)"e "ists the su)tas-s of tas- C5. here is thus a requirement to support each of the su)tas-s to someetent. he information a)out Users7EnvironmentandFrequencyis not in the ta)"e7 so it is not requirements7

)ut assumptions )ehind the requirements. 9t means that the tas- must )e supported for this -ind of users7en!ironment7 etc.


10/82

/

#.3 )he supplier*s reply9n the rep"y7 the supp"ier fi""s in the midd"e and ri#ht6hand co"umns to specify the so"ution he proposes. He may

show a"ternati!e so"utions and specify de"i!eries in se!era" sta#es or re"eases. Here is a possi)"e rep"y to thefirst eamp"e a)o!eA

C+. Handle a request

. . .

Su)tas-s and !ariantsA (roposed so"utionsA Code

1. &ecei!e the ca"" throu#h mai"7 phone or emai".

9t may )e a new request or information a)outan eistin# request.


11/82

*

(ro)"em 2p i""ustrates one more comp"eity of the proposa". he supp"ier offers two a"ternati!es that thecustomer can choose )etween. $"ternati!e $ has a traditiona" search feature that can )e de"i!ered in sta#e 1.

$"ternati!e B has ad!anced phonetic search that can )e de"i!ered in sta#e 3. Both features are co!ered )yordinary maintenance


12/82

1

B Hi+h le"el demands

B.1 Business +oals

!he business goals are important. ;oth as a communication tool towards the rest of theorganisation *why are we doing this


13/82


14/82


15/82


16/82


17/82

15

B.3 ,mplementation time framehe system de"i!ery steps as epected )y the customer. Missin# steps can )e added )y the supp"ier. he !ariousdates shou"d )e estimated )y the supp"ier as if the decision to si#n the contract is done two wee"s aterthe

su##ested date for proof of concept I pre6contract proof.

$elier) $ate

1. (roof of concept I pre6contract proof 20070#!1

2. (roof of concept I remainin# proof

3. 0esi#n app"ied

4. est set up I usa)i"ity and functiona"ity tests

5. 0ata con!ersion and import

+. ducation materia"

'. ducation of users

/. System documentation

*. (roduction set up I acceptance tests

1. ,aunch 200712!1

B.4 Selection criteriahe customer chooses the so"ution that is best rom an economic point o view. ach criteria is #i!en a wei#ht)etween 1 and 1 to indicate the importance of this criteria. he supp"ier@s so"ution wi"" )e #i!en a score )etween

and 4 for each criteria and this score is mu"tip"ied )y the wei#ht. $ddin# the wei#hted scores for a"" criteria#i!es the tota" score for the so"ution. $dditiona""y7 each criteria has a minimum score assi#ned that wi"" resu"t in

so"ution disqua"ification re)ardless o the scores in other criteria7 shou"d the so"ution score "ess.

Criteria Wei#ht Min. score

1. ;sa)i"ity requirements in chapter 9 and C !

2. Business !a"ue of the so"ution. $ssessed as a num)erfor each of the )usiness #oa"s


18/82

1+

Wei+htin+s

"t is not easy to set the weightings, and it can be done in different ways. !he optimal way to

set the weights would be on basis of a cost)benefit analysis. "n some situations, like when arequirement specification is the basis of an E9 tender, it actually is a requirement that the

selection criteria have weightings, but this is a large area, on which information can be foundat various websites-. !he weightings are set in proportion to the estimated business value, so

there are no upper limitation on the weightings to be set. !he potential suppliers should beinformed of the selection criteria and their weightings.

Score

$hen receiving proposals of suppliers on basis of the requirement specification, the proposals

should be evaluated one by one. 1or each of the proposals, the criteria are given scoresbetween > and 5, stating how well the proposal handles each criteria, as shown in the table

below.

Score Meaning

ot hand"ed

1 ot as #ood as today % ,ess than epected

2 he same as today % ,itt"e "ess than epected

3 $s epected

4 Better than epected

,a/le 27 Score

' criteria can also have set a minimum score to disqualify unacceptable proposals no matter

their score in other criteria as shown in the table below in the columns with the header Min..!he total score of each proposal can be calculated by summarising the criteria value multipliedwith the weight.

CMS7 proposal < proposal = proposal > ...

Selection criteria "eight Min. Score "eighted Score "eighted Score "eighted ... ...

1. ;sa)i"ity / 3 4 32

2. Business !a"ue 1 4 4 4

3. &is-s + 2 3 1/

4. 0e"i!ery time 2 1 1 25. (rice 3 2 3 *

+. Mar-et ro)ustness ' 2 2 14

'. tendi)i"ity + 2 3 1/

/. Community 1

,otal score7 133 ...

,a/le 7 &aluation of proposals

- !he E9 directive 2>>5:-:EC is a good term in search engines when looking for information and can be found infull, legal text at http::europa.eu.int:eur)lex:pri:en:o8:dat:2>>5:lD-35:lD-352>>5>53>en>--5>25>.pdf

http://europa.eu.int/eur-lex/pri/en/oj/dat/2004/l_134/l_13420040430en01140240.pdfhttp://europa.eu.int/eur-lex/pri/en/oj/dat/2004/l_134/l_13420040430en01140240.pdf


19/82

1'

!he scores should be used to indicate which proposals are simply not good enough comparedto the others. !he proposal with the highest total score is not always the best proposal, but it

is recommended to select a proposal with a high total score.

-saility

9sability can be measured in the pre)contract signing proof)of)concept phase as described in-.5 assigning scores depending on the number of issues and their severity.

Business /alue

!he business value is an estimation of how well the proposal will fulfil the business goals.

0iss

!he risk is a measurement of how convinced the customer is on whether the supplier deliversthe expected CMS. !he earlier the proof)of)concept risks can be proven, the better. /therindicators of low risks could be, that the right side of the tables are filled in with goodsolutions, it could also be, that the supplier has solved similar problems before as well, as it

can be experiences from previous deliveries from the supplier. !he more indicators of low risk,the better should the score of the proposal be in this criteria.

eli"ery time

!he rule of thumb is naturally =the sooner, the better@. %owever, be careful not to apply toohigh weightings to this criteria, ending up with poor system functionality delivered quickly. /neway of evaluating delivery times is to set an expected date for the system launch. /ffersdelivering around this date gets a score of three 0 as expected 0 with earlier offers achieving ascore of four and later offers two, one or (ero, depending on the difference to the expecteddate.

rice"f the price of the CMS acquisition is above a certain amount, there must be an E9 tender, an

open proposal evaluation to avoid corruption and nepotism. !his requires ob8ective selectioncriteria. !here are two different ways to choose a proposal in an E9 tender.

-. !he cheapest proposal is simply the proposal with the lowest price. "f the requirementsare met, it will not be taken into account that one of the proposals might have a higher

business value.

2. !he economically most attractive proposal is the proposal that gives most value perprice unit, i.e. the highest coefficient. !here might be cheaper proposals, but the focusis the value compared to the amount of money spent, as shown in the coefficient

calculation example

Business !a"ue I &is-

(riceJKL

47 I 17

17K

3

!he risk is estimated as a quantification of the risks involved with the suppliers bid, theamount of functionality that will need to be developed and the amount of functionality that isavailable for a proof)of)concept session. "f the cheapest proposal has to be chosen, the

suppliers reservation about requirements, which are described in the requirementsspecification, can be estimated as a quantification of the risks and added to the price, when

finding the cheapest proposal.



20/82


21/82

1*

B. rice and deli"erales9n this "ist7 the supp"ier sha"" input the prices for the !arious de"i!era)"es in as much detai" as possi)"e as we"" ashe is encoura#ed to add missin# items on the "ist. he "ist is di!ided into one6time costs in the imp"ementation

process and runnin# costs after imp"ementation.

'ne?time costs 8rice Specifications

1. Start "icence

2. 9mp"ementation

0ocumentation;ser and de!e"oper #uides to the CMS

2a. ariantA Hour"y rate durin# imp"ementation

3. Hardware

4. 0esi#n

9unning costs 8rice Specifications

5. Maintenance "icence

+. ducation

'. ;ser support

/. Hour"y rate for post6imp"ementationde!e"opments

*. Correction of errors caused )y de!e"operupdates to the CMS

0 ncluded in maintenance license

1. Correction of errors caused )y the supp"ier 0 ncluded in maintenance license

11. Correction of errors in the CMS7 present at the

time of imp"ementation

0 ncluded in implementation costs



22/82

2

C Wor areas and tass

!he work areas of this chapter contain tasks that are used in the CMS on a regular basis. Mostof the functional requirements will be in this chapter. $hen defining the tasks, you should

consider the followingChapter C contains CMS requirements which are related to procedures and tasks, that the

system must support. !he requirements have their starting point in user needs, and therequirements are formulated in a way, that leaves it to the supplier to find out, how to satisfythem. "n this way the specification will not restrict the developers or the range of potentialsystems unnecessarily.

"n the following, some of the requirements are explained further, in order to help thecustomer decide, if the requirements and any related problems are relevant in their situation.

C.1 Mana+e pa+e templates

!emplates are usually used to maintain a certain layout on pages of a site. !emplates can be

on site)level, where they determine the general layout of items, headers, navigational linksetc. or they can be on page)level, where they determine the layout of the page itself.

Most CMSs employ this concept in some form.



23/82

21

C Wor areas and tasshe system must support a"" user tas-s in this chapter7 inc"udin# a"" su)tas-s and !ariants7 and miti#ate thepro)"ems. he su)tas-s are num)ered for reference purposes. hey don@t ha!e to )e carried out in this sequence7

and many of them are optiona". $ su)tas- may a"so )e repeated durin# the same tas-.

C.1 Mana+e templates

;sin# temp"ates is a way to contro" the "ayout and a too" to create a uniform appearance of a"" the pa#es that

ma-e up the site7 no matter who updates them.$ CMS is often set up in a way7 that forces the users to use the temp"ates7 and therefore it is important7 that there

are enou#h temp"ates to pro!ide f"ei)"e presentation of content whi"e -eepin# the num)er "ow enou#h to retainthe o!er!iew of a!ai"a)"e temp"ates and when to use which temp"ate.

Start7$ pa#e temp"ate needs addition7 updatin# or de"etion

&nd7(a#e temp"ate is sa!ed or de"eted

(requenc)7&are"y once set upsers7 We)site administrators7 #raphica" desi#ners

Su/?tas#s and ariations Solution e*ample Code

1. ,ist temp"ates

1p. 9t can )e difficu"t to distin#uish )etween the

"ayout of temp"ates7 if they on"y are identified

)y names

9nstead of choosin# amon# the temp"ates from

their names on"y7 it mi#ht )e easier to o!er!iew

and choose the ri#ht temp"ate7 if they are

represented )y sma"" rou#h mode"s of their"ayout for instance.

2. $dd temp"ate

3. dit temp"ate

4. ;ndo chan#es

5. Sa!e temp"ate

5a. ariantA Sa!e temp"ate with another name%copy

temp"ate

+. 0e"ete temp"ate

+p. (ro)"emA emp"ate is in use. 9f a temp"ate is

)ein# used )y pa#es7 the system shou"d pre!entthat it is de"eted7 and if the temp"ate is to )e

rep"aced )y another one7 it is usefu" to )e a)"e

to see which pa#es are usin# the temp"ate.

B"oc- de"etion and "ist pa#es usin# this temp"ate

ption to se"ect a rep"acement temp"ate to )eapp"ied to a"" pa#es usin# this temp"ate

+q. (ro)"emA ;sers cannot see which temp"ates are

in use )efore tryin# to de"ete them. here mayeist numerous temp"ates in the CMS7 and

some of them may e!en )e eact copies ofothers7 meant to )e chan#ed in some way. o

)e a)"e to c"ean up amon# the temp"ates7 it hasto )e c"ear which are in use and which are not.

,ist temp"ates with indication of whether it is in

use



24/82

22

C.1 Mana#e temp"ates


25/82

23

C.2 #ddeditdelete content item

'dd, edit and delete content are basic functionalities in every CMS, and every CMS will containthe functionality. !he interesting things are therefore the problems that users haveexperienced when adding, editing or deleting content. !hese problems are explained below

because these are problems that are handled differently, if at all, in different systems.

Most pages will include media files, most often images, to liven up the page and aid thereadability.

C.2)problem3 )opypasting to the )* editor does not automatically upload picture tomedia library

!he fact that media files have to be uploaded to the server to be visible to the public on awebsite, is an abstraction that some new or rare users of CMSs forget. ' user writes somecontent in a $ord document, inserts some pictures and tries to copy and paste text as well aspictures into the CMS editor. !his is a intuitive thing to do, but usually CMSs cannot handlethe pictures this way. !he ideal solution would be a CMS that could handle this, andautomatically upload the picture to the media library and change the reference in the text from

the local pc to the media library on the server. 'nother way of handling the problem could be amessage telling the user to upload the picture to the media library, if a picture is pasted into

the editor.

C.2 #ddeditdelete content item

"or# areaA CMS )ac-end

StartA Content has to )e edited7 feed)ac- recei!ed7 resumption of par-ed content

&ndA Content sent for appro!a"7 pu)"ished7 or par-ed for "ater resumption

(requenc)A 0ai"y

sersA $dministrators7 editors and authors


1. ind content item. When a user edits or creates

a pa#e7 there mi#ht )e a )rea- in the tas-7 andthe user wi"" ha!e to sa!e the unpu)"ished

content item in order to resume the tas- thenet day7 or hand o!er the tas- to a co""ea#ue.

herefore the users wi"" need an easy way of"ocatin# content to resume editin#.

,ist of content items

0irectory structure with content items

1p. (ro)"emA$ par-ed content item can )e difficu"tto find ption to "ist on"y unpu)"ished pa#esMar- unpu)"ished pa#es with appropriate icon orco"our

2. dit pa#e%content

2a. ariantA Create pa#e )ased on temp"ate

2q. (ro)"emA CMS editor on"y shows a "itt"e part

of the pa#e7 so the o!er!iew of the pa#e in itscontet is missin#

CMS editor shou"d )e a)"e to show the entire pa#e

and not on"y the )o that is )ein# edited

2r. (ro)"emA Someone edits a pa#e he shou"d notedit

(ermissions shou"d )e set up so that on"y re"e!antpa#es are !isi)"e to and edita)"e )y a user



26/82

24

C.2 $dd%edit%de"ete content item


27/82

25

C.2 $dd%edit%de"ete content item


28/82

2+

C.3 0e"iew and appro"e content

ublish content has been separated as a long subtask to C.2 to give a better overview of theprocess. !he subtasks can be called a workflow, which supports and enforces publishingrestrictions.

' workflow is a chain of tasks that are carried out by different user roles. 'n example could be

that an author writes an article and an editor approves the article before it gets published. 'workflow system can enforce and support these organisational procedures directly in the CMS,

thus not allowing for content providers to skip this step.

"f the customer wants to enforce content review prior to publishing and:or enforce that only a

few people can publish content, this long subtask is relevant. "n our experience, though, it isoften thought of as needed in the requirements, but rarely used in the finished solution, due to

the increase in bureaucracy and the fact that the process could 8ust as easily be manual withcontent providers communicating directly, asking for a review, when in doubt.



29/82

2'

C.3 0e"iew and appro"e content

StartA Content is ready for re!iew7 notification recei!ed )y re!iewer

&ndA Content re!iewed and feed)ac- #i!en to content pro!ider or content appro!ed and pu)"ished

(requenc)A aries )etween many times a day to wee-"y7 month"y or year"y

sersA Content editors


1. &ecei!e notification a)out content ready forpu)"ishin#

Manua""y )y mai"7 phone or !er)a""y or )y anautomated wor-f"ow functiona"ity

2. ,ocate content

2p. Content created or "ast edited )y another editor

can )e difficu"t to find

,in- in notification emai"

Search functiona"ity,ist of unpu)"ished content items

We""6arran#ed directory structure7 whereunpu)"ished content items can )e identified easi"y

3. Correct content

4. (u)"ish


30/82

2/

C.4 ulish content

&ong sub)task to C.2 and C.3.

C. Mana+e media lirary

'll websites need at least a few hand)typed pages with text, images and links to other pages

or websites. Most CMSs have a repository for media files 0 images, video files, $ord and 41documents etc. ) that can be inserted on a page. !his is a basic requirement that must be

present, although the specific functionality can vary.

!he requirements to media library varies, but if the site contains many pages referring tomedia files, or if the media library contains a lot of media files, it is recommended to look for aCMS with a good media library.

!he media library can resemble a file system with folders and files as in the Composite CMS,but can also contain meta data that will aid when searching for relevant files. Someorganisations 0 mainly those with many content providers 0 will need the searchable medialibrary whereas others will 8ust need to set up a relevant category:folder structure so users

can browse for the relevant files.



31/82


32/82

3

C.5 6in checin+

&inks referring to pages on external sites, uncontrolled by the organisation, can be outdated ifthe external page is removed. ' periodical link check that checks whether links are still valid,is often used to avoid dead links on the site. 9sually a CMS has some functionality, that

prevents the site from containing internal dead links *see C-)q+, but if this is not the case,the link check should also include checking of links to internal pages.

C.5 6in checin+

9nterna" "in-s to and from a pa#e are usua""y chec-ed when the pa#e is sa!ed7 )ut eterna" resources can chan#e

independent"y. herefore7 it can )e necessary to periodica""y chec- whether these "in-s are sti"" !a"id.


StartA ;ser wants to chec- for dead "in-s or retrie!e an ear"ier "in- chec- resu"t

&ndA Site or su)6site without dead "in- or "ist of pa#es with dead "in-s par-ed for "ater resumption(requenc)A aries )etween many times a day to wee-"y7 month"y or year"y

$ifficultA Many pa#es with dead "in-s require editin#

sersA ditors and authors


1. ind sa!ed "in- chec- resu"t "ist

2. Start "in- chec-

2p. (ro)"emA ;ser mi#ht on"y )e interested in

doin# a "in- chec- of a particu"ar part of the

site. $ site can contain se!era" thousands ofpa#es7 and a "in- chec- of the who"e site is !erytime consumin#

,in- chec- on pa#e "e!e" or su) tree "e!e" of the

site structure

2q. (ro)"emA ,in- chec- is too sensiti!e7 and

considers "in-s to "ar#e fi"es as dead "in-s

3. 9t shou"d )e easy to find the pa#es with dead

"in-s

ach item in the "ist has a "in- to edit the pa#e

with a dead "in-.

3p. (ro)"emA ,in- chec- resu"t "ist disappearse!ery time the user #oes to one of the pa#es to

correct dead "in-s.

pen in new window&emem)erN "in- chec- resu"t "ist for when the

user returns

4. Sa!e "in- chec- resu"t "ist for "ater resumption



33/82


34/82

32

C.8 Mana+e newsletter types

'n organisation might have several newsletters that need to be managed. 9sers should havethe possibility of creating new newsletter types as well as changing the layout and name of anexisting newsletter.

C.9 Mana+e newsletter suscriers

Managing subscribers from the CMS backend can be very useful. 1or instance when amarketing campaign at an exposition yields a *possibly handwritten+ list of email addresses ofpeople interested in the organisation.

C.8 Mana+e newsletter types

$ news"etter type is a series of news"etters I e.#. the month"y promotiona" news"etter or the year"y Christmasnews"etter I that wi"" ha!e a num)er of su)scri)ers and information common to a"" news"etters sent with this

type7 such as su)ect and sender address.

"or# areaA CMS Bac-end

StartA ews"etter type is to )e added7 edited or de"eted

&ndA ews"etter types are up to date

(requenc)A 162 times a year


1. ,ist news"etter types

2. Create news"etter type

3. dit news"etter type

4. 0e"ete news"etter type

C.9 Mana+e newsletter suscriptions

Su)scri)ers to a news"etter can come from many sources. Many can su)scri)e direct"y from the we)site7 )ut at

trade fairs7 throu#h customer studies or simi"ar7 a "ist of new recipients can )e #athered7 which has to )emanua""y imported.


StartA ne or more emai" addresses are to )e added to a news"etter type

&ndA mai" addresses added to the news"etter type

(requenc)A(eriodica""y

sersA ditors7 administrators


1. Su)scri)e recipient to news"etter type

2. 0e"ete recipient from a certain news"etter

3. Chan#e emai" address of recipient



35/82

33

C.1: Mana+e newsletter suscriptions from front end

Subscribing and unsubscribing to a newsletter should be easy to do for a website visitor.%owever, the subscription and unsubscription processes should be handled with care andsecurity so the customer can be safe in the knowledge that he is only sending out newsletters

to people, who have opted for it. Sending newsletters to people, who never signed up or whohave followed the unsubscription process is classified as =spam@ and it can be a costly affair, ifthe organisation is fined for it.

C.1: Mana+e newsletter suscriptions from frontend

"or# areaA rontend

Start7;ser wants to su)scri)e or unsu)scri)e to a news"etter

&nd7;ser su)scri)ed%unsu)scri)ed

(requenc)A ;serA nce a year7 SystemA 0ai"y)sersA isitors on the we)site


1. Su)scri)e to a news"etter

1p. (ro)"emA isitor mi#ht su)scri)e anotherperson@s emai" address or )e unsure whether the

su)scription is confirmed

Send su)scription confirmation emai" to user

2. Confirm su)scription Su)scription emai" contains "in- that the usermust fo""ow to confirm the su)scription

3. 0e"ete su)scription to a certain news"etter

3p. (ro)"emA isitor can unsu)scri)e another

person@s emai" address or )e unsure whether theunsu)scription is confirmed

Send unsu)scription confirmation emai" to user

4. Confirm unsu)scription ;nsu)scription emai" contains "in- that the usermust fo""ow to confirm the unsu)scription

5. ,ist news"etter types with indication of whetherthe user is su)scri)ed or not



36/82

34

C.11 Send newsletter

;e sure to confirm before sending a newsletter. Bewsletters are sometimes sent out to a hugeamount of subscribers, and there are often advertisers who pay to have their products in thenewsletters. "f the newsletter is not entirely ready, it gives the receivers an unfavourable

impression of the company and:or the advertisers.

C.12 Mana+e news

!he ability to display news is desirable by the ma8ority of organisational websites. "t can benews about the company, the market, products available, new employees and much more. !oreally benefit from the versatility of =news@, articles should assigned to categories so it ispossible to pull a =latest news@)component with only press releases or only new employees,relating the content to the context in which it is used.

Most CMS suppliers will be able to fulfil this task with a standard component.

C.13 Browse news

&isting too many news articles on a =&atest news@ page will only annoy the visitors, butmanually transferring articles to an archive is equally impractical to maintain. !he CMS should

in this standard component be able to only list a limited number of news in the variouscategories and have a common interface with numerous search and filter options in a news

archive.

C. 11 Send newsletter"or# areaA CMS )ac-end

StartA ;sua""y sent periodica""y7 for instance twice a wee-

&ndA ews"etter sent or par-ed for "ater resumption(requenc)A nce a day%wee-%month

sers7 ditor7 author7 $dministrator


1. Create news"etter

1a. ariantA dit news"etter

2. 9nsert tet

3. 9nsert media fi"es in news"etter

4. ;ndo chan#es

5. Send news"etter to recipients

5p ews"etter can )e sent out )efore it is ready

+. ews"etter shou"d )e appro!ed )y some)odye"se in the or#anisation )efore is can )e sent

'. Send test7 which sends the news"etter to oneemai" address on"y

/. (ar- news"etter for "ater resumption

*. ind par-ed news"etter for resumption



37/82

35

C.12 Mana+e newsWor- areaA Bac-end

Start7$ press re"ease7 new emp"oyee or simi"ar news is recei!ed )y the editor

&nd7ews story pu)"ished

(requenc)7SystemA 0ai"y7 ;serA Wee-"y

sers7 ditors

Content Solution e*ample Code

1. Create news story

2. dit news story

3. 0e"ete news story

4. 9nsert media fi"e

5. ;ndo chan#es ;ndo in the editor or ro"" )ac- to ear"ier chan#es

+. Sa!e and pu)"ish news story

C.13 Browse news

"or# area7 rontend

(requenc)7SystemA 0ai"y7 ;serA Wee-"y

sers7 rontend !isitors


1. iew news o!er!iew (a#e with "atest news "isted2. &ead news story

3. iew news archi!e

3p. (ro)"emA ews accumu"ate to the thousands7

too many to disp"ay on one pa#e



38/82

3+

C.14 ; C.1 Mana+e course enrolment and enrol to course

!hese two tasks are example tasks, connected to the data example in chapter 4.

C.14 Mana+e course e"aluation form

his tas- is part of a custom inte#ration with an eistin# course re#istration app"ication. See Chapter 0 fordescriptions of data.

Start7uestions need to )e added or remo!ed from a course@s e!a"uation form

&nd7Chan#es sa!ed

(requenc)7once a wee-

sers7 ditors

Sub-tasks and variations Solution example Code

1 'reate new question

1a 6ariant .ocate and edit eistin) question

2 8et question type and answer options

! 8ave question

4 $dd question to a speciic course

5 9emove question rom a speciic course

# Undo chan)es Undo in the editor or roll bac" to earlier version

7 *ublish evaluation orm

Eport replies to :icrosot Ecel ormat



39/82

3'

C.1 0eply to course e"aluation form

his tas- is part of a custom inte#ration with an eistin# course re#istration app"ication. See Chapter 0 fordescriptions of data.

"or# area7 rontend

Start7Course participant wants to e!a"uate a course

&nd7!a"uation finished

(requenc)7SystemA 263 times a wee-7 ;serA 162 times per year

sers7 We)site !isitors

Sub-tasks and variations Solution example Code

1 6iew a list o courses

2 6iew course evaluation orm

! 9eply to evaluation orm

!p *roblem 6isitor evaluates a course he did notparticipate in

.oo" up participant with username and passwordin course enrolment system

!q *roblem 6isitor evaluates a course multiple

times

9e)ister that the user has evaluated the course

!r *roblem Users with database access can see,who has )iven which reply

8ystem does not allow anyone to connect aspeciic evaluation to a speciic person



40/82

3/

C.15 Search content

"f visitors cannot find the desired information, they go elsewhere. %aving an easy)to)usesearch functionality can be vital to a website.

Most CMSs have basic search components, but real search engines are usually not a kernelfunctionality in CMSs. Search engines are a rather large area with specialised search engine

suppliers, and performance and features vary from simple database searches to search indexengines with phonetic and synonym recognition that record searches without results. !he latter

type can come with a high price tag, but is very useful especially on legal and public authoritywebsites where the language used in the content can differ from the language used by thevisitors. %owever, a cheap solution will often suffice to begin with, while the customerdiscovers the specific user requirements to a search engine. !he search engine is usually easyto replace, so the choice of search engine is not tied to the choice of CMS. Bevertheless, agood search engine is often a prerequisite for the website to become a success 0 especially ifthe CMS is used for an intranet.

C.15 Search content

"or# areaA rontend

Start7;ser is "oo-in# for content

&nd7Content found

(requenc)7SystemA ery frequent"y7 ;serA Wee-"y

sers7 rontend !isitors


1. Search for content with a search term1p. (ro)"emA Search does not find terms inside

documentsSearch inde reads (07 Microsoft Word and0 documents

1q. (ro)"emA Search term is misspe""ed (honetic searchesSearch inc"udes a "ist of common misspe""in#s and

their correct term

1r. (ro)"emA Search term has a synonym that is

used in content

Search for synonyms to the search term

2. iew search resu"ts o!er!iew



41/82

3*



42/82

4

ata to present

!his chapter is about structured business data that should be presented on website pages. !hedata will be used by the CMS either by storing the data inside the CMS or by integrating with

other systems that contain the data already. !he tasks that are carried out in connection withthe structured data 0 from the frontend as well as from the backend should be described astasks in chapter C in the requirements specification.

!o manage these data, the developers need to know the data structure and how it should beused and presented. !his is done in the tables with descriptions of necessary data andinformation about where the data are currently stored. 1or these data, the customer is the onewith the domain knowledge, as opposed to other parts of the CMS, where the suppliers are theexperts. "t is usually a good idea to consult the users, who are going to use the pages, aboutthe procedures. ;e aware of the fact that it is very likely that users have exceptions fromofficial procedures, and this is impossible to handle by a system, unless the exceptions are

analysed thoroughly and accounted for in the system. !o avoid this kind of problems, becareful that the system doesnt restrict the users unnecessarily, and be sure to ask the users

what they need for the system to become a success.

!he data should be presented on specially developed pages. "n order to ensure that the

supplier can deliver an appropriate solution, the customer should give as much information aspossible in data models. 'lternatively, the customer can provide mock)ups of pages containing

the data and let the implementation details be up to the supplier.

"f the same kind of data is used by other systems as well, it might be a better solution tointegrate with relevant databases or systems outside the CMS, since redundant data are hardto keep consistent and lacks scalability. "ntegration with external systems is covered in chapter

1.

ata e'amples

/rganisations often have data collected without really thinking of it as data. !he example inthe requirements template is an existing course enrolment application that should be extendedwith a course evaluation functionality, accessible on the website.

7etting this information into structured form inside the CMS can make updating and looking upinformation easier for everyone in the organisation as well as be of use to website visitors.

"t is important to describe the existing data in as much detail as possible since the supplier willeither build a new extension from scratch or try to apply the data to an existing extension with

or without modifications. "f the data are not thoroughly described, the supplier may think thatan existing extension can be applied and only late in the process discover that a new extensionor large modifications are needed that he has not included in the estimates.

!he data model in shape of E:# diagrams presents

-. #elevant parts of the existing data, that are used in connection with an existing courseenrolment system

2. ' course evaluation system that should be developed and presented on the site. !hisdiagram is an example of how the business data could be structured.

"f the data volume is very large, the supplier would have had to take it into consideration whenmaking time and price estimates, so the customer should give an estimate on current and

prospective volumes.



43/82

41

ata to presenthe customer needs the system to present data descri)ed in this chapter. he ta)"e )e"ow shows the data7 thatshou"d )e presented on different pa#es on the we)site. Besides presentin# the data7 the CMS shou"d pro!ide

functiona"ity to search7 create7 de"ete and edit the data as descri)ed in chapter C7 tas-s C.14 Mana#e coursee!a"uation form7 and C.15 &ep"y to course e!a"uation form.

he CMS sha"" etend an eistin# course enro"ment app"ication with course e!a"uations performed throu#h thewe)site. he course enro"ment app"ication is accessi)"e throu#h we) ser!ices supp"ied )y the customer.


-llustration 27 $ata model for course ealuation

Course

name

description

"ocation

term

price

maDparticipants

minDparticipants

enro"mentDstart

enro"mentDend

(erson

isDpaid

dateDenro""ed

hasDanswered

dateDanswered

02. ques tion

03. type

name

04. option

password

"o#in

name

emai"

address

phoneD1

phoneD2

ame

uestion

01. form

!a"ue

date

enro""edDin

05. rep"y

0+. answer

question

hasoptions

a form has rep"ies

a rep"y consists

of answers

a question

has a type

$n answer

)e"on#s toa question

form has questions%

ques tions )e"on#s to forms

&*isting data

@ew data

teaches

has


44/82

42

.1 %orm

'onnects questions to courses, speciyin) which questions should be as"ed in the evaluation o which courses

;ote that a question can be reused or several courses

Data volume: #00, increasin) by 200 per year

;o ields, only orei)n "eys &able is here to create one sin)le point o inte)ration with eistin) data

.2 (uestion

Data volume: 400, increasin) by 100 per year

(ields and relations Solution e*ample Code

1


45/82

43

. 0eply

$n answer is the reply to one course evaluation

Data volume 50 thousand, increasin) by 4 thousand per year


1 Form+, reerence to orms

2 9eply date

.5 #nswer

$n answer o one question to one reply

Data volume 200 thousand, increasin) by #0 thousand per year


1


46/82

44

!


47/82

45

!


48/82

4+

!.4 !'pansion of the system

CMSs are made to be expanded 0 or they should be. $ebsites on the "nternet have changedenormously over 8ust a single decade and website owners are expected to explore newpossibilities and expand the use of their websites continuously. !herefore, being able to

expand the CMS with new content types, modules and dynamic components is a must)haverequirement for any CMS and a customer should be able to change certain things very quicklyor hire a third party to do so.

!he CMS itself can be closed source, but the source code of custom built extensions paid for bythe customer, should be available to the customer. "t should be possible to have otherdevelopers extend the system, and therefore the customer needs access to a well)documented'" for the CMS. /therwise the customer will in practice be dependent on the initial developer,and that is usually not a good way of securing quality and reasonable prices.

!. Search en+ine optimisation

!he optimisation of a website to be found high in the lists of popular search engines is ascience of its own. !he CMS can be an obstruction to this process or it can be a facilitator, but

it will not be the sole answer to search engine optimisation. Many factors come into play, butthe most important ones relate to the actual content written by the content providers 0 i.e.eople outside the control of the CMS supplier. !he design can be structured properly, the CMScan allow e.g. !itles on hyperlinks, set meta tags on the page and provide a page title, but if

the users do not set a proper hyperlink title, relevant meta tags and good page titles, all theCMS offerings will bring few results. %owever, the CMS should notpreventusers from setting

these and therefore, the requirements in this chapter are likely used to disqualify the poorCMSs rather than to select the right one.



49/82

4'

!.4 !'pansion of the system

he customer or a third party hired )y the customer sha"" )e a)"e to epand the system without in!o"!in# thesupp"ier. 9n this section7 OcustomerO means his own 9 staff or a third party authoriEed )y him.

9equirements to the e*tension possi/le Solution e*ample Code

1. he customer can add new content types withcorrespondin# mana#ement and output

$dd components7 e.#. #eneration or consumptionof &SS feeds

2. he customer can chan#e )eha!iour ofcomponents and modu"es7e) $dd unctionality

to send an email to a teacher, when a courseevaluation is submitted

dit%rep"ace components7 e.#. &ep"ace thenews"etter modu"e with another

3. he customer can chan#e "ayout of eistin#

content types

Content types use temp"ates that can )e edited

throu#h the temp"ate mana#ement7 simi"ar to pa#e

temp"ates

4. he customer can use a we""6defined $(9 tocommunicate with the core system. (refera)"y7the CMS source code is a!ai"a)"e.

We""6defined means that e!erythin# that can )edone )y an administrator can )e rep"icated

usin# the $(9.

5. he source code of a"" components constructedspecifica""y for this imp"ementation sha"" )e

a!ai"a)"e to the customer a"on# with de!e"oper

documentation. he customer sha"" ha!e theri#hts to use and modify )oth source code and

documentation.

!. Search en+ine optimisation

9equirements &*ample solutions7 Code

1. he system shou"d #enerate human reada)"e;&,@s to we)site pa#es and interna" "in-s in

content

2. Search en#ines must )e a)"e to )rowse the site Site na!i#ation is functiona" without :a!aScript7

"ash or other non6HM, techno"o#ies

3. (a#e code structure is tar#etin# search en#ines HM, code is structured with na!i#ation "in-s

first7 then the pa#e@s unique content7 then contentcommon for se!era" or a"" pa#es



50/82


51/82


52/82

5

% System inte+ration with e'ternal systems

%.1 irectory ser"ice

"f there are many users of the CMS, it might be a good idea to consider integration with adirectory service.

' directory service is basically a network based application, that contains information aboutusers and resources on a network. Examples of directory services are 'ctive 4irectory, Bovelland e4irectory, and the information in these directory services is accessed with a protocolcalled &4'2, and therefore integration with a directory service is also referred to as &4'integration.

!he directory service is used to centrally manage users, resources, services and users access

to resources and services such as the CMS. !his means, that the user can use the same username and password to the CMS as to other systems that also use the directory service.

!he main benefit with &4' integration is, that users have only one user name and password

combination to remember and can change it once for all the systems authenticating with thedirectory service. "t is often used in connection with single)sign)on where a user is grantedaccess to several systems as soon as he has locked on to the domain administered by thedirectory service.

' directory service can have several domains, that reflect the geographical or organisationalstructure of the organi(ation. 'n example could be a multinational cooperation, that hasaffiliates around the world on different domains. "n this case each affiliate might have a sub)site with locally relevant information communicated in different languages. "t might have itsadvantages to let the website reflect the structure of the organi(ation, and grant some usersfrom each domain access to edit their sub)site.

2 &ightweight 4irectory 'ccess rotocol


-llustration 7 4$A8 integration ? same authentication to different s)stems

0irectory Ser!ice

etwor- "o#6onCMSther authenticated

systems

,o#in

Ren

cry

ptedpa

ssw

ord

$cces#

ranted%not#ranted2

1,o#in

Ren

cry

ptedpa

ssw

ord

$cces#

ranted%not#ranted2

1 ,o#in

Ren

cry

ptedpa

ssw

ord

$cces#

ranted%not#ranted2

1,o#inR

enc

rypt e

dpas

swo

rd

$cces#

ranted%not#ranted2

1,o#inR

enc

rypt e

dpas

swo

rd

$cces#

ranted%not#ranted2

1


53/82

51

% System inte+ration with e'ternal systems

he CMS sha"" inte#rate to the fo""owin# eterna" systems

1. ,0$( 0irectory ser!ice

2 ?oo)le $nalytics, website statistics )atherin) solution

! 'ourse enrolment system

%.1 irectory ser"ice

he directory ser!ice is used to authenticate interna" users with the same username and password as in othersystems

-ntegration requirements Solution e*ample Code

1. he CMS sha"" authenticate users throu#h,0$( in rea"6time

1p. 9f a user is de"eted in the directory7 the CMScan sudden"y ha!e pa#es with a pa#e

responsi)"e that no "on#er eists

nvo"e code in the ':8 when a user is deleted inthe directory, notiyin) relevant people about the

deletion

%.2 #nalytics software & $oo+le #nalytics

?oo)le $nalytics )ather statistics on pa)e views and visitors


1 9e)ister pa)e statistics in ?oo)le $nalytics $ll pa)es must include the ?oo)le $nalytics@ava8cript code

%.3 Course enrolment system

&he course enrolment system can communicate throu)h web services or, i the ':8 is hosted at the customer,direct database access to certain views in the Aracle database runnin) the enrolment system the ':8 is

eternally hosted, only web services are available -eb services or database views will be created by thecustomer to ulil the supplierBs requests

the supplier provides a solution with a hi)her de)ree o inte)ration /1 is lower than 2 is lower than !, he doesnot need to provide a solution to a lower de)ree


1 &he ':8 periodically replicates courseenrolment data

2 Users can initiate manual replication, whenneeded

! &he ':8 pulls data about courses, its teachers

and students rom the course enrolment systemin realtime



54/82


55/82

53

%.4 ,nte+ration with new e'ternal systems

he customer epects to inte#rate the CMS with other systems7 possi)"y usin# a third party consu"tant. he CMSsha"" )e prepared for this inte#ration throu#h the fo""owin# requirements.

%.4.1 Ser"er role

S)stem interface in serer role Solution e*ample Code

1. he system sha"" )e a)"e to eport data in aformat7 reada)"e to other systems

8tandardised eport ormat

*lu)in architecture or sendin) data

2. unctiona"ity in the CMS can )e tri##ered )yother systems.

9t sha"" )e possi)"e to use an $(9 accessi)"efrom other systems to

6 Create a new or modify an eistin# user6 Create a new pa#e with content

6 (erform a search in the CMS@ search en#ine

-ebservice $*, C:.9*' etc

3. he data)ase is a!ai"a)"e for use )y othersystems

%.4.2 Client role

S)stem interface in client role Solution e*ample Code

1. he system sha"" )e a)"e to import data fromother systems and automatica""y create new

pa#es in the pa#e hierarchy.

8tandardised import ormat

2. unctiona"ity in other systems can )e tri##ered)y the CMS7 e.#. Ca""in# a we)ser!ice andprocessin# a rep"y

-ebservices, C:.9*' etc

%.4.3 ocumentation and ri+hts

$ocumentation and rights Solution e*ample Code

1. $(9 documentation shou"d document a"" areas

of the $(9 a!ai"a)"e to etensions andcomponents in a way so it is understanda)"e to

a third party

2. he customer or a third party appointed )y him

has a"" ri#hts to use the documentation and $(9

3. he customer ho"ds a"" ri#hts to a"" data stored

in the CMS

4. Content data are stored in a standard data)ase7

with connecti!ity throu#h standard data)asetoo"s7 ma-in# access to data a!ai"a)"e without

usin# the CMS



56/82

54

$ )echnical ,) architecture

$.1 Hardware requirements

$.1&1 !'istin+ hardware"f the customer has hardware that he expects will be sufficient for running the CMS, he should

list the specifications and the supplier can reply with expected capacity of such a system.

$.1.&2 Hostin+

!he customer hosting the CMS will ensure physical access to the servers and complete controlof what is running on which servers. %owever, it also requires "! personnel with web servermanagement competencies to keep the servers secure and running.

%iring a data centre to host the CMS can outsource the need for web server managers in

exchange for less control with the physical servers 0 and perhaps a higher price.

/ften, CMS suppliers offer to host the CMS for customers. !he advantage of this solution is

that it will be hosted with someone, who knows the CMS very well and who can include CMSsecurity updates in the normal server maintenance procedures.

$.1&4 )est and de"elopment en"ironment

'dding new features, updating the CMS or changing the set up can be an intimidating task ona production website with many risks ranging from misplaced images to server errors.!herefore it can be useful or even necessary to have a range of servers for developing, testingand staging these changes

Development server!he server used by developers *in)house or external+ to develop new features, modules,templates etc. Content is test content to test whether a feature works or a template looks

correct. Bot everything is finished and ready for deployment to the test server.

Test serverServer used by developers for testing whether developments work together with otherdevelopments and to show changes to interested parties before deployment on the staging andproduction servers.

Staging server!his server is used by content providers to make changes to the content or site structurewithout affecting the website visitors, until the changes are published to the production server.

Content should always be synchronised with the production server, barring the unpublishedchanges.

Production server

Server *or several servers in a load balancing solution+ accessed by the website visitors.

1or organisations with large websites containing critical data or functionality vital to thecompany, all of the servers mentioned in the requirements template are likely to be necessary.1or others, only the production server. 1or most, a development and test server can becombined into one and a good versioning and preview function can combine staging and

production servers.



57/82

55

$ )echnical ,) architecture

$.1 Hardware and software requirements

he customer current"y has the fo""owin# equipment7 to )e used in the CMS operationsA

1 2 servers with these speciications

2 100 :bps connection to the nternet

! 4 Aracle database licenses

9equirements to hardware and software of the

customer

'ffered solution Code

1. he system is epected to run on eistin# hardware7

comp"yin# with the requirements in ,.1 and ,.2

;nder these circumstances7 the system can

hand"e DDD hour"y pa#e "oads.


58/82

5+

H Security

Somethin# that is ta-en for #ranted )y many CMS customers is the aspect of security. 9f considered

at a""7 emphasis is usua""y on accidenta" addin#%editin#%de"etin# of content )y users or unauthorised

access to the ser!er itse"f. Howe!er7 other areas shou"d )e forma"ised and considered proper"y.

H.1 #ccess ri+hts for users

$ )asic feature of any CMS is the a)i"ity to )"oc- off areas of the we)site from the eye of the

#enera" pu)"ic. Most nota)"y7 the administration )ac-end shou"d ne!er )e accessi)"e without proper

user authentication.

H.2 Security mana+ement

Managing users and their access rights should be targeting the "! department andaccommodate their wishes of easy user administration 0 possibly centralised through adirectory service as covered earlier.

Managing the permissions in the directory service is rarely available, but some CMSs have

synchronisation of user groups and user group memberships between the directory service andthe CMS, so defining the permissions on a user group basis allows for moving users in and out

of groups directly in the directory service management application, saving the "! departmentfrom keeping user group memberships synchronised manually.

Should the requirements not include authentication through a directory service, it is importantto ensure that the user and permissions management is suited towards the number of users.

$ith many user accounts, it becomes a very large task to assign permissions to each andevery one of them or assign users to user groups individually.

"n chapter E.6, we suggested that the system should log user actions. %owever, for thelogging to hold real value for the users, there should be a way of reviewing and filter this log

so only data relevant to the reviewer is presented.



59/82

5'

H Security

H.1 #ccess ri+hts for users

Mana#e users7 ri#hts7 ro"es7 and responsi)i"ities

9equirements to securit) 'ffered solution Code

1. $ccess security7 ensurin# that on"y authorised users

access re#u"ated areas

1.p (ro)"emA ;sers use se!era" systems and for#et user

names and passwords if there are too many.

8in)lesi)non throu)h directory service

Access rights7

1. &i#ht to !iew pa#es

2. &i#ht to add%edit pa#es from a certain "e!e" and down in the document tree3. &i#ht to de"ete pa#es )e"ow a certain "e!e" in the document tree

4. &i#ht to up"oad fi"es to the media "i)rary5. &i#ht to edit or de"ete fi"es in the media "i)rary

+. &i#ht to use HM, and :a!aScript in pa#e content editin#$n editor mi#ht ha!e ri#hts 273747 whi"e a content pro!ider may ha!e on"y 273 and an administrator has a"" ri#hts

from 2 throu#h +.

H.2 Security mana+ement

he wor- in security mana#ement inc"udes the fo""owin# su)tas-s.

$ifficult7 -hen 120 new people have been employed and need access ri)hts rom day one

Su/tas#s for securit) management7 &*ample solutions7 Code

1. $ssi#n or remo!e access ri#hts for a user.

1a. ariantA he user must )e created.

1p *roblem $ lot o users have to be created, e)

when they start the irst day in the month

$utomatic transer o data rom the personnel

system

2. Create new user ro"es

3. $ssi#n ro"es to a user

3.a ariantA $ssi#n users to a ro"e

4. $ssi#n permissions to ro"e

5. 8et an o!er!iew of who has which ri#hts and

whether some ri#hts ha!e not )een assi#ned to

anyone.

+. &e!iew user action "o#


60/82

5/

H.3 rotection a+ainst data loss

Measures protecting against loss of data should cover three situations

-. !ransfer of data between servers or systems 0 ensuring that data are received correctlybefore being purged from the sending system.

2. Concurrent use of the system by multiple users 0 protecting against corrupted data as aresult of several concurrent writes of the same item.

3. hysical damage to or theft of servers 0 protecting the servers from physical access byunauthorised personnel, proper fire extinguishing measures and backup power supplies.

$hatever measures are taken, always be sure to test the backup and restore proceduresregularly 0 at least once a year 0 both to be certain that the backup and restore procedures

are working andto ensure that the responsible persons are familiar with them, so they knowwhat to do and how to do it properly.

H.3&1 )ransfer of data

!ransferring data from one system to another is always a situation to be cautious. Manyfactors influence a proper data transfer, ranging from the physical condition of wires to theother processes performed by the servers running the systems. !herefore, it can be resources

well spent, ensuring that data are transferred correctly, thus not ending in a situation wheredata have been deleted in one system without being properly received at the other end.

H.3&2 Concurrency issues

$hen two users open the same page for editing at the same time and then save it, the CMScan have difficulties determining which edition is the right one to use. Should it overwrite thefirst with the second< 4isallow saving the second since the original has been changed< 4isallowopening the second for editing while it is open for editing by someone else< Save the secondas a new version so the first is still available< Should some users have privileges that overrule

the restrictionsections

ages in a CMS are for the most part dynamically generated by looking at the users input

*accessed 9#&, parameters in the request+ and looking up the corresponding pages content inthe database. "f the input from 9#& and parameters is not handled correctly before being used

in a database query, malicious visitors may be able to include SG& syntax that will beexecuted. !his could lead to discovery of passwords *another good reason to use a directoryservice for authentication+, modification of content or change of user permissions, giving thevisitor administrator rights in the CMS.

' good CMS will ensure that all user parameters are handled as not)to)be)trusted and filteredbefore being used in database queries.

H.&4 Cross Site Scriptin+ ?@SSA

Even if the CMS filters the user parameters to avoid SG& in8ections, the user submitted inputcan still be of danger to the website and its visitors. Cross Site Scripting *abbreviated HSS toavoid confusion with CSS 0 Cascading Style Sheets+ involves adding IavaScript code to the

user input, which will be executed by the visitors browser, when he visits the page with thecode. HSS attacks can result in cookies being stolen or redirecting the visitor to a malicious

site with even more malicious code to attack the visitors computer.

!his is mainly an issue for websites where visitors can contribute content, e.g. write commentsin a discussion forum.

!o avoid HSS problems, the CMS should escape the input so that it is not executed whendisplayed on a web page. 'dditional measures could be logging HSS attempts and notifyingserver administrators of the possible attack.

H.& Cross Site 0equest %or+in+ ?CS0%A

!he %!! protocol used by web browsers to communicate with web servers is a state)less

protocol, meaning that each request sent by the browser will be handled by the server as ifthere have been no previous requests. !herefore each request must contain all the information

needed by the web server to serve the correct page. !his also means that anybody can buildan %!! request and send to a web server, which will handle the request based on the

information.

CS#1 attackers exploit this, by forging a request to look like it is coming from an authenticated

user, who is allowed by the server to perform actions, such as modifying content or grantingCMS access rights.

!he usual way to determine whether a request is genuine and part of a session for a logged)inuser, is to set a cookie on the users computer that will be sent along with the request.

rovided that the malicious person has not stolen cookies through HSS or physical access tothe users computer, it is very difficult to know the cookie content to send with the request.

%owever, if the malicious person can somehow get the user to send the re'uest himsel!, thecookie will be included and the attack may succeed.



63/82

+1

H. rotection a+ainst threats

$ ris- assessment has shown that the fo""owin# threats are serious. he system must protect a#ainst them.

,he s)stem must protect against7 &*ample solutions7 Code

1. ;nauthorised persons o)tainin# administrator

ri#hts trou#h the 9nternet


64/82

+2

!here are several methods for a malicious person to trick the user into sending the forgedrequest

-. "f the web server performs the desired actions with 7E! parameters *parameters sentthrough the 9#&+, the attacker can merely add a link in a comment, hoping that a CMS

administrator will click on it or 0 if the comment system allows this 0 add an image withthe attack link as its source. $hen a CMS administrator clicks on the link or views the

page with the image, the 9#& will be invoked with a request from the administrator andthe web server will perform the desired actions.

2. "f the web server allows %!M& in the discussion comments, a malicious person can builda web form, e.g. $ith an image as the =submit button@ and writing something along the

lines of =click on the image to see an enlarged version@, hoping that a CMSadministrator will do so, thus submitting the form.

3. "f neither option is available, the malicious person can build the attack form on anotherwebsite where an option is available 0 or his own, where he can add content withoutrestrictions 0 and then trick the CMS administrator into visiting the website and clickingthe link. !his is of course a very unreliable method for the attacker, but it happens

nevertheless.

rotection against CS#1 attacks can consist of

Bever accepting database changes from 7E! requests 0 except logging and similar

actions.

4isallowing %!M& for website visitors or have a small white)list of accepted %!M& that

the visitors can use, filtering or escaping all other %!M&. Many websites allow no %!M&but instead allows the use of so)called =bbcode@ where pseudo)code is transformed into%!M& within very restricted limits.

Checking the %!!D#E1E#E# property of the request. !his will contain the 9#& the user

is coming from. "f it does not come from the same web domain as the website, it can be

discarded. %owever, many software firewalls block this information to protect usersprivacy, since it allows websites to register, where the user is coming from.

Ensuring that submitted forms include keys that a malicious user cannot know about

and incorporate in his attack forms. !his could be a randomly generated key saved in

the users session data *which is stored on the web server+ that is only valid for aperiod of time and added to the form dynamically. $hen the form is submitted, the web

server can check to see whether the key is there and whether it corresponds to a key inthe users session.



65/82

+3



66/82

+4

, -saility and desi+n

9sability of the CMS is a decisive success criteria. !he usability has often been ignored,because the focus has been on the usability of the CMS frontend, i.e. the website, or because

the customer does not know, what to look for when the CMS is chosen.$hen choosing a CMS it is decisive to test the usability of the backend before contract signing

as described in chapter ;, while the usability of the frontend design can be tested aftercontract signing. 's the design of the CMS backend is a basic part of the CMS, it is usually noteasily changed, and therefore the usability has to be evaluated before a CMS is chosen and acontract signed.

' way of measuring usability, is to let a user carry out relevant tasks *chapter C+ and countthe number of critical usability problems and demand, that there may only be a certain

number of critical usability problems. !he definition of a critical usability problem is a problem,where the user

1. cannot carry out the tas- on his own

2. or )e"ie!es that the tas- is carried out e!en thou#h it is not

3. or epresses that this is difficu"t7 rea""y

4. or the test sees7 that the user does not use the system in an efficient"y manner

,a/le %7 Critical usa/ilit) pro/lems

!o perform a usability test, require that the suppliers show the backend from an existing CMS

solution, and perform think)aloud)tests with future users to find potential problems. !he think)aloud)test should contain as many tasks from the requirements specification chapter C aspossible, as we have also described in chapter ; about proof of concept.

,.1 6earnin+ and efficiency in daily use

9sability is primarily about how convenient it is to use the system. !he typical users of the

backend are editors, administrators and authors. !o frequent users of the CMS, efficiency isthe most important usability factor, while ease)of)learning is the most important usabilityfactor to users, who seldom use the CMS. %owever, both usability factors are important,because the bigger a site is, the more likely it is that the responsibility of different pages andsub)areas are taken care of by many not)so)frequent users in an organisation, while the fewpeople overall responsible of the site use the CMS very frequently.

"f the backend is not logical or intuitive, it will be a problem especially to infrequent users. !heresult of poor usability can be that organisations give up distributed update, using only one ortwo people to do all the editing. "f the CMS is not efficient, it is very inconvenient to frequentusers, who use the CMS as their primary work application. Either way, it will make the usersless motivated to use the CMS and thus less motivated to update the content frequently andfulfil the ;.-)3 and ;.-)J business goals. !he ideal situation is that the CMS supports the

organisation rather than the organisation having to fit to the CMS, so it is a good idea to spendtime and resources to check the usability of different systems thoroughly.

/ften it is much easier to find =ease)of)learning@)usability problems than it is to find=efficiency@)usability problems, because the =efficiency@)usability problems become visible onlyto users, who have to do the same inefficient task 6> times a day.



67/82

+5

,.1 6earnin+ and efficiency in daily use

9t is important that the system o)tains adequate usa)i"ity. his is )est done throu#h ear"y usa)i"ity tests. $fter theear"y tests7 customer and supp"ier oint"y decide the detai"ed requirements to )e !erified at the time of system

de"i!ery. 9t may for instance )e a detai"ed specification of the tas-s to )e tested7 and the acceptance criteria towrite in the midd"e co"umn.

sa/ilit) test of proof of concept &*ample solutions7 Code

1. he supp"ier must test the user interface for

usa)i"ity )efore si#nin# the contract.

;sa)i"ity testin#


68/82

++

1or instance, we have interviewed a user who frequently publishes a lot of content items on alarge website. Every time he presses publish, he has to wait about -> seconds while the

pages are being published, without being able to do anything in the meantime. 'part from thatthe system can either publish a single content item or publish all unpublished content)items.$hen the user publishes e.g. 55 out of K6 unpublished content items, he can only do it one by

one and each time wait at least -> seconds. !his is inconvenient as well as time consuming. 'nadditional problem is the preview functionality that does not look exactly like the publishedcontent item. !herefore the user actually has to publish every time he makes small changes, ifhe needs to see how it really looks. !his is especially relevant on the frontpage of the website,where line breaks have to be controlled and text has to fit into different boxes on the page.

!hese are typical efficiency usability problems that are often not noticed in time and reduceefficiency and flow in daily work tremendously. !herefore it is recommended to pay specialattention to the problems, that are connected to the different tasks in chapter C when carryingout usability tests as well as to specify usability tests with enough volume to test theefficiency.

,.2 #ccessiility and 6oo&and&feel!he CMS backend is usually not optimised towards visually or otherwise impaired people, whilethe accessibility to the frontend to some extent can be supported or restrained by the choice ofCMS. !his is a large sub8ect, with many different approaches to linking, titling, contentorgani(ation and rapid navigation, as well as generation of multiple sites optimised towards thespecial browsers used by people with different kind of impairments. !herefore the accessibility

requirements might not be satisfactory, and if accessibility is a critical issue, where it isntenough to follow an accessibility standard such as $'", it is necessary to consult an expert in

this area.

Many CMSs attempt to exploit the general users familiarity with applications such as Microsoft

$ord by creating page text editors with a similar toolbar layout as Microsoft $ord. 1amiliaritywith known programs, usually makes them easier to learn and remember, but as such a

familiar look is not

Guide to CMS Requirements Template

Documents

Transcript of Guide to CMS Requirements Template