| Functional |
| 1. Informed and led by the KM framework; secure public site with clear navigation, search and priority pathways to high-demand content | D3 precedes D4 and D5 by design. Intent-first navigation, bilingual search, "top tasks" on the homepage from analytics. | Core |
| 2. Document repository with categories, metadata and search/filter | Structured document collection with the KM metadata scheme (type, year, division, island, fishery, species, language, sensitivity), filters and full-text search. | Core |
| 3. Online or downloadable forms with accessible labels and clear submission instructions | Form builder for online forms with accessible labels and confirmations; downloadable forms in the repository with instructions on each page. | Core |
| 4. Staff update news, events, vacancies and programme pages without developer support | Live-preview editor with content types for each; roles for authors, publishers and admins; training in D3 and D7. | Core |
| 5. Maps and embedded geospatial content; future API-based integrations such as ArcGIS | Map block embedding GeoJSON and ArcGIS feature services; content model keeps geospatial references separate so an ArcGIS SDK swap is a front-end change only. | Core |
| 6. Analytics on traffic, popular content, search terms and user journeys | Self-hosted Umami with custom events for search terms and document downloads; monthly report template for the Communications lead. | Core |
| 7. Current Chrome, Edge, Safari and Firefox on desktop and mobile | Standards-based static output; tested across all four on desktop, Android and iOS before launch. | Core |
| Non-functional and compliance |
| Comply with Cook Islands and regional digital, IT and cybersecurity rules and policies | Aligned with the National ICT Policy 2023–2027 and the Cook Islands Cyber Security Policy; hosting and data residency chosen by the Ministry; we work with OPM ICT where required. | Core |
| Clear pricing in NZD, VAT exclusive and inclusive, ongoing support/hosting separated | Part D shows every activity and person, VAT exclusive and inclusive at 15%, with hosting (B3) and support quoted as separate lines. | Core |
| Secure administration, least privilege, MFA, SSL/TLS, backups, updates, audit logging | All included in D5: MFA for every admin, role-based least privilege, TLS, nightly encrypted backups, automated patching, audit trail. | Core |
| Privacy-conscious analytics; avoid unnecessary collection of personal information | Umami collects no personal data and sets no cookies. Forms collect only fields the process needs. No third-party trackers. | Core |
| WCAG 2.2 AA where practicable; guidance for accessible documents and media | Design system built and tested to AA; automated and manual testing in D7; an accessible-documents guide and PDF remediation of priority documents in D6. | Core |
| Mobile-first, low-bandwidth, culturally appropriate content, attention to Pa Enua and underserved groups | Static pages under a 300 KB budget; tested on throttled links; Cook Islands Māori alongside English; content reviewed with island officers. Further options in B5. | Core |
| Platform staff can manage, with documentation, training and support arrangements | Live-preview editor; handover documentation and runbooks; training for every division; optional support retainer in Part D. | Core |
| Training that strengthens MMR's internal digital capability in line with the National Digital Strategy's talent objectives | Role-based training (editor, publisher, administrator), recorded sessions for the islands, a champions network, and a KM refresher at the end of the support period. | Core |