Digital Service Standard checklist: Digital Service Standard

Criterion requirements 

To successfully meet this criterion, agencies need to:

1. Develop a business case for change
2. Survey the policy and service landscape
3. Understand the service’s lifecycle
4. Adopt an agile methodology.

For existing services, this means that agencies should have clearly identified the purpose for the service, the problem it is addressing and the whole of government priorities it is contributing towards.

Concepts or actions to address

• The current problem statement for the service is clear and addressed:
  • Consider the problems the service needs to solve and why they are important. Clearly state the risks of action and inaction, who might be impacted by the service, potential barriers to success and any knowledge gaps.
• Government priorities the service is contributing towards have been identified:
  • Review government policies and existing initiatives and map the problem to relevant strategic objectives and priorities. Engage with stakeholders involved in related government initiatives to gain insights into government approaches and successes.

Optional

• Describe how the digital service complies with this criterion, referencing best practice approaches deployed where possible.

Criterion requirements

To successfully meet this criterion, agencies will need to:

1. Understand the service’s users.
2. Conduct user research.
3. Test and validate designs.

For existing services, this means agencies should know who the service users are, have a deep understanding of user experiences with the service and how to improve those experiences.

Concepts or actions to address

• Understand the key users of the service today and their needs:
  • Regularly conduct user research to understand who your users are and why they are accessing your service. Make sure you also understand what devices, platforms, or technologies they use to access the service.
• Understand the experience of users in accessing your service and how to improve those experiences:
  • Analyse any identified pain points or negative feedback to understand the root cause, make incremental changes based on feedback and test these changes with users to assess their effectiveness. Prioritise action on pain points that have the most significant impact on user experience and ensure resources are allocated effectively.
    Methods and tools to use:
    • Interviews, surveys, observation or analytics to gather data on your users' needs, goals, expectations, and behaviours.
    • existing research from other agencies or sources that are relevant to your service.
    • past research reports, journey maps or project summaries from historical internal documentation, internal databases, project archives or management systems.
    • relevant studies or research papers, from academic and industry journals.
    • professional networks and opportunities to engage with experts and practitioners across the APS to share research findings, reports and insights.

Optional

• Describe how the digital service complies with this criterion, referencing best practice approaches deployed where possible.

Criterion requirements

To successfully meet this criterion, agencies will need to:

1. Understand the diversity of your users.
2. Comply with legislation and standards, including the:
   1. Disability Discrimination Act 1992
   2. latest version of the Web Content Accessibility Guidelines (WCAG)
   3. Australian Government Style Manual.
3. Implement a feedback mechanism.

For existing services, this means that agencies must ensure they understand the diversity of the services’ users, actively manage compliance with relevant legislation and standards as part of service development and ongoing operations, and have a feedback mechanism in place.

Concepts or actions to address

• Understand the different cohorts that may be impacted by or use the service:
  • Expand on the learnings from Criterion 2 of the Digital Service Standard, by conducting targeted and ethical user research with the diverse users of the service. Make sure the service captures and responds to unique circumstances and needs.
  • A feedback mechanism is in place. Provide a user feedback mechanism that supports issue reporting and service improvement suggestions, with timely, transparent responses. Promote the mechanism through an ongoing, multichannel awareness campaign.  

Optional

• Describe how the digital service complies with this criterion, referencing best practice approaches deployed where possible

Criterion requirements

To successfully meet this criterion, agencies will need to:

1. Design for interoperability.
2. Join up services.

For existing services, this means that agencies should ensure that the service has the capability to support interoperability with other services where possible.

Concepts or actions to address

• Where possible, the service integrates with other relevant government systems or platforms (if not possible, also mark this as complete): 
  Best practice approaches:
  • Share data: Review any obligations against privacy policies and the Privacy Act 1988. If external data is used, make the service interoperable and leverage governments’ open datasets. Support safe, ethical data-sharing practices by using the government’s DATA Scheme.
  • Request information once: Assess the data the agency already collects and whether it can be reused for the service. Where it can be reused, eliminate unnecessary data entry requests and fulfil a ‘tell us once’ approach.
  • Publish open APIs (Application Programming Interface): Thoroughly document the service’s APIs. Where appropriate, open them for other services and third parties to build upon existing government offerings. Align with the API Design Standard to support cross-jurisdictional data sharing, maintain a consistent, reusable vocabulary and support wider API literacy.
  • Use a Digital ID: Where appropriate, endeavour to integrate the Australia Government Digital ID System, accredited by the Trusted Digital Identity Framework (TDIF). This will allow users to access the service with a single set of credentials.

Optional

• Describe how the digital service complies with this criterion, referencing best practice approaches deployed where possible

Criterion requirements

To successfully meet this criterion, agencies will need to:

1. Adopt transparent data handling.
2. Implement security measures.
3. Maintain a reliable service.
4. be accountable for the service.

For existing services this means that agencies should have mechanisms in place to manage the transparency, security, reliability and accountability for the service.

Concepts or actions to address

• The service adopts transparent data handling practices:
  • Safeguard user data by adhering to the Australian Privacy Principles and the Privacy Act 1988.
  • Always get explicit, informed consent before collecting a user’s data and provide a means to update or delete it.
  • Allow users to report inaccurate data and respond with how it has been rectified.
  • Notify users about their responsibilities to protect their data, such as not sharing their password with others.
  • Tell users what information they need before they start a task and, where appropriate, allow them to pause and resume at their own pace.
• There’s a process in place to ensure ongoing compliance of the service with up-to-date security measures:
  Best practice approaches:
  • Regularly conduct and comprehensive security audits to identify vulnerabilities in the digital service. This includes penetration testing and assessments to keep security measures robust and up to date.
  • Regularly update software, hardware and security protocols to protect against new and emerging threats. This includes prompt application of patches, updates and security fixes.
  • Implement ongoing security training for staff on best practices, include phishing recognition attempts and secure handling of sensitive data.
  • Establish and regularly update an incident response plan to prepare for potential security breaches. Outline steps for detecting security incidents, responding to them and recovering.
• There are processes in place to manage reliability of the service for availability and consistency:
  • Make the service available, stable and consistent for users in different places and time zones, at different times, on different days.
  • Schedule maintenance for a predictable period of downtime and give notice to users well ahead of time.
• There are accountability measures in place for the service to maintain contestability and periodic auditing:
  Best practice approaches:
  • Offer clear avenues for users to submit complaints, contest decisions or report issues, including security data and cyber concerns. To increase the likelihood of useful feedback, make avenues anonymous by default and identifying by choice wherever possible. To demonstrate that feedback has been addressed or will inform future action, provide users with timely and transparent responses. Responses should be tailored to the feedback.
  • Audit the service, data-handling practices, security incidents and compliance with whole-of-government policies. Use an independent review to test assumptions and identify issues that may be taken for granted. Use these results to improve and keep the service fit for purpose.

Optional

• Describe how the digital service complies with this criterion, referencing best practice approaches deployed where possible:

Criterion requirements

To successfully meet this criterion, agencies will need to:

1. ‘Build once, use many times’.
2. Design for a common, seamless experience.
3. Reuse data where possible.

For existing services, this means that agencies should enable the re-use of designs and data where it is possible to do so.

Concepts or actions to address

• Where possible, components, solutions and/or data, such as forms, content, workflows, APIs, design components or information, are able to be reused in other services:
  • Share designs with other teams and agencies that are establishing services that could benefit from the work your agency is doing with your service. Similarly, share data, where possible, with other services that require the same data to provide a seamless experience for the users (if not possible, also mark this as complete).  

Criterion requirements

To successfully meet this criterion, agencies will need to:

1. Protect users’ digital rights.
2. Understand privacy impacts.
3. Understand the limits of data.

For existing services, this means that agencies must have mechanisms in place to protect users’ digital rights and understand the privacy impacts of the services and the limits of data.

Concepts or actions to address

• The digital rights of users are protected:
  • Capture how the service might impact the digital rights of users. Identify users facing greater personal risks and make sure they’re provided with the means to access, communicate and contest the service transparently or anonymously. If rights are breached, move quickly to implement changes that prevent future harm. Map the implications of the service beyond its immediate impacts. Workshop environmental, economic or social impacts and undertake scenario planning to explore unforeseen issues and opportunities.
• Understand, and have responded to, the services’ privacy impacts:
  • Regularly undertake privacy impact assessments and plan to incorporate these service improvements.
    Methods or tools to use:
    • Privacy Impact Assessments: Undertake regular Privacy Impact Assessments to capture issues. Mitigate unwarranted and unauthorised surveillance, data collection and malicious data breaches and share these actions with users.
    • Obtain consent: Where required, seek and obtain informed consent from users prior to collecting, storing or disclosing any of their data. Consider opt-out options and ensure the service requires as little user data as possible.
    • Be transparent: Communicate how data will be used or may be used in the future at the time of consent. This includes how it may be shared with other people or between services and secondary or less obvious uses.
• Assess any current or potential negative consequences of the service:
  • Consider how the service might impact the digital rights of users. Build with pre-emptive measures in mind, such as net neutrality, access to information without censorship and freedom of online assembly. Identify users facing greater personal risks and make sure they’re provided with the means to access, communicate and contest the service transparently or anonymously. If rights are breached, move quickly to implement changes that prevent future harm. Consider the implications of the service beyond its immediate impacts. Workshop environmental, economic or social impacts and undertake scenario planning to explore unforeseen issues and opportunities.
• Understand the limits of data that is collected and / or used by the service:
  Best practice approaches:
  • Use data ethically: Data should only be collected and used for the stated purpose that the user agrees to. Account for how data models, datasets and algorithms may produce discriminatory results and provide transparent detail to users on how decisions and calculations are made. Before sharing data, apply the DATA Scheme’s Data Sharing Principles to help assess whether it would be safe to do so.
  • Use qualitative and quantitative data: Quantitative data, which is numeric or measurable, helps us understand what is happening on a service. Qualitative data, which is descriptive or observable, helps us understand why. Use both to fully understand the story and match any correlation with a provable causation. Do this before making important decisions.

Optional

• Describe how the digital service complies with this criterion, referencing best practice approaches deployed where possible.

Criterion requirements

To successfully meet this criterion, agencies will need to:

1. Follow guidance on critical and emerging technologies.
2. Maintain interoperability in the face of new technology.
3. Track adoption of new technology.

For existing services, this means that agencies must demonstrate that they have adopted emerging technologies only when there is an inherent benefit, maintain interoperability where relevant, and have implemented measures to monitor for changes relating to critical and emerging technologies that may impact the service.

Concepts or actions to address

• There are processes in place to monitor and implement guidance for critical and emerging technologies for the service:
  • Stay current, technology can advance at a staggering pace. If available, refer to government guidance on risks, opportunities and developments for up-to-date advice on critical or emerging technology that may impact the service.
  • Regularly check the Australian Government Architecture: Follow published guidance in the Australian Government Architecture for the adoption of critical and emerging technologies.
• There are processes in place to maintain the interoperability of the service in the face of new technology:
  • Consider interoperability, determine if new technologies will impact the service’s interoperability. Plan for its introduction or implementation in partnership with other affected agencies to prevent further divergence or disconnection. Be digital ready, undertake an assessment of the preparedness for new technologies. Consider the resources and training for a new technology that will be required by the agency and team.
• There are mechanisms in place to track adoption of new technology: Prior to implementing a new technology, determine whether it aligns with the clear intent of the service and whether it risks leaving certain types of users behind. If implemented, monitor how users respond to the new technology and respond to any accessibility or usability concerns.

Optional

• Describe how the digital service complies with this criterion, referencing best practice approaches deployed where possible.

Criterion requirements 

To successfully meet this criterion, agencies will need to: 

1. Establish a baseline for the service.
2. Identify the right performance indicators.
3. Measure, report and improve according to strategies.

For existing services, this means that agencies must demonstrate that there is continuous monitoring and measurement of services to ensure they operate smoothly, remain secure and cater for users’ evolving needs.

Concepts or actions to address

• There is an established performance baseline for the service:
  • Use a performance monitoring framework to understand the digital platform’s real-world impact and how users interact with digital services. The framework should centre around an end-user perspective, not from the perspective of an agency’s infrastructure. Use clear objectives and goals framed in the context of what users need and expect from the digital service.
• Appropriate performance indicators have been identified for the service:
  • Use metrics that accurately capture the service’s ability to deliver the outcomes that users expect. These might include adherence to design standards and privacy legislation, site/app performance, security benchmarks or tasks completed by users.
• The service measures, reports and improves according to strategies:
  • Make sure the service meets the Data and Digital Government Strategy and consider how information collected and reported could improve the service in line with the Strategy’s implementation plan. All digital and ICT-enabled investment proposals must define their purpose, outcomes and methods for measuring, monitoring and optimising them. Find out more in the Benefits Management Policy.

Optional

• Describe how the digital service complies with this criterion, referencing best practice approaches deployed where possible.

Criterion requirements 

To successfully meet this criterion, agencies will need to:

1. Improve the service across its life.
2. Schedule regular assessments.
3. Communicate service upgrades.

For existing services, this means that agencies must seek to continuously improve their services, schedule regular assessments and communicate service upgrades.

Concepts or actions to address

• There are mechanisms in place to make improvements to the service across its life:
  • Increase people’s use of the service by continuously optimising performance, enhancing security, introducing relevant features, addressing bugs and increasing compatibility. Use metrics identified in Criterion 9 (‘Monitor your service’) to reveal the biggest opportunities for impact and ground improvements in evidence. Provide ongoing training and materials for staff to support change.
• Regular assessments are scheduled to review the performance and experience of the service over time:
  • Define the goals and scope of the assessment then observe performance and experience over time. Performance metrics might include load times, responsiveness or bottlenecks. Experience metrics might include entry/exit points, dwell time or task abandonment. Ongoing monitoring should be part of business-as-usual processes and a detailed review part of regular service evaluation.
• Service upgrades appropriately communicated with users:
  • Develop an iterative communication plan for how, when and through what channels updates and findings will be shared with users. When writing content, show how users’ feedback informed the actions that have been taken. Highlight key achievements or milestones reached and use real-life stories to demonstrate how users shaped change.

Optional

• Describe how the digital service complies with this criterion, referencing best practice approaches deployed where possible.