Common Questions to Capture NFRs Non-functional requirements are global constraints, often known as software qualities or just the "ilities". For example, development costs, operational costs, performance, reliability, maintainability, portability, etc. All quality measures are relative and generally, we  say A quality is better than B but it is hard to say how much better, so consider all qualities of a system and given NFRs while designing the system. NFRs are hard to model and hard to make them as measurable requirements. If these are stated informally then: Often leads to contradictory situations Difficult to enforce during development And, difficult to evaluate for the customer before delivery. So, always use Quantitative NFRs like "The system should be scalable to handle 10K users within the next 1 years." Take the help from below mentioned examples and questions: Security Requirements related to authentication and authorizations. Who can do what? Who can access to the system? Create Roles and Permissions Matrix Login related requirements like Users must change the initially assigned login password immediately after the first successful login User should provide the OTP while providing user credentials MFA authentication is mandatory for admin or all users SAML based Single Sign-On (SSO) Password related requirements Inactivity timeouts Duration, actions and traceability Information related security: What are the sensitive data which needs to be protected? This can be understand by data classification. Is there any approval is required from any team? Which type of encryption will be used and at what level? System data needs to be backed up every x hours.Usability User Standards (Style guide) Globalization/localization requirements Target devices and users Efficiency of use: how quickly or accurately the user can use the product? Maintainability, Reusability What type of development pattern to be used like ATDD or TDD or not? Sometimes, normal development is considered without automated unit testing however TDD is the recommended one from maintainability standpoint. Which code analysis tool(s) can be used to identify the redundant code and to verify the code to check its maintainability index? What will be the review strategy and process? Conformance to defined technical guidelines, standards, or best practices. Is there any standards/best practices/coding standards or guidelines prepared by existing architecture or COE team which has to be followed? Performance and scalability What are the min and max number of actual/expected concurrent users? What is the peak load time of the system? How many users accessing the system in peak load time? How many user are visiting the application in 24 hours? What are the performance goal to decide that the system is ready for go-live or not? Response time: For each business functions and pages. User Load: min and max numbers of concurrent users Transaction Rate: min numbers of transactions per seconds Hardware Resource Utilization: CPU utilization, Disk utilization, Memory utilization, etc. For example, CPU resource utilization on production server should not exceed 70%. Expected throughput of the system: For example, 1000 transactions per seconds. What is the system or query response times? What are…