How do you plan non-functional testing across an organisation?
60-second answer
I define non-functional requirements as measurable SLOs: latency percentiles, throughput, availability, error budgets, security standards like OWASP ASVS, accessibility levels, and resilience targets. Then I decide where each is verified: performance budgets and small load tests in CI, large-scale load and soak tests before major events, continuous security scanning plus periodic penetration tests, accessibility checks on every PR with manual audits per release, and chaos experiments on a schedule. Each has an owner, tooling and reporting. Production monitoring closes the loop, with alerts tied to the same SLOs.
Explanation
Map NFRs to the pipeline:
| NFR | Continuous | Periodic |
|---|---|---|
| Performance | k6 smoke, Lighthouse CI | Full load/soak before peak |
| Security | SAST, SCA, DAST baseline | Pen test, threat modelling |
| Accessibility | axe in UI tests | Manual audit, user testing |
| Resilience | Fault injection in component tests | Game days |
| Compatibility | Core browsers in CI | Device matrix nightly |
Example
An e-commerce group ran monthly load tests only. After adding k6 checks to every pipeline and a quarterly chaos day, three latency regressions and one failover bug were caught before customers saw them.
Sample code
// slo.js, imported by k6 thresholds and by alert rule generators
export const SLO = {
checkout: { p95Ms: 1500, errorRate: 0.01 },
search: { p95Ms: 600, errorRate: 0.005 },
};