Tools and providers
Part of Procuring corporate communications tools with a dossier before a shortlist
Implementing a communications tool with production switched off
Implement a communication tool through a production-disabled synthetic exercise, with clear role, access, correction, recovery and exit evidence.
Implementation should begin in an isolated environment with production publishing and delivery disabled. Cedar Vale Engineering Ltd is fictional. Its test job is to route a clearly marked sample notice about an imaginary site proposal through approval, correction and archive without contacting an employee, customer or journalist.
No system was configured for this guide. The method draws on the NCSC cloud security principles on identity and audit information, GOV.UK accessible communication formats guidance and the ICO data protection by design guidance updated for DUAA on 5 February 2026.
What to take away
- Start implementation in an isolated environment with production publishing and delivery switched off.
- Use synthetic names, non-deliverable addresses and no real proposal, quotation or personal detail.
- Capture source-copy ID, actor, timestamp, action, reason, configuration and log location for each state.
- The verdict can only be pass, fail or unresolved for each tested event.
Prepare a harmless fixture
Create synthetic names and non-deliverable addresses under buyer control. The source copy should say that it is test material and contain no real proposal, quotation or personal detail. Add two versions: an approved sample and a superseded copy with a visible fictional error. Record the expected state changes before loading either one.
Approved vs Superseded Test Copy
Approved sample
- Content
- clean test text
- Status
- approved
- Expected state
- recorded first
- Real data
- none
- Addresses
- non-deliverable
Superseded copy
- Content
- visible fictional error
- Status
- obsolete
- Expected state
- recorded first
- Real data
- none
- Addresses
- non-deliverable
Keep newsroom publishing, employee messaging, email contact, monitoring, social posting, surveys, approval, incident communication and analytics disconnected. A test of approval gives no evidence about delivery or audience response.
Lock roles before content moves
Assign separate synthetic accounts for author, factual reviewer, accessibility reviewer, privacy reviewer, publisher and incident owner. Test minimum privilege, rejected access, joiner and leaver handling, recovery and a second authorised person for urgent withdrawal.
The NCSC's identity and authentication principle explains why buyers need confidence in authenticated and authorised identities and credential lifecycle. It is guidance, not proof that an unnamed service meets Cedar Vale's requirement.
Configure evidence, not outcomes
For each state, capture source-copy ID, actor, timestamp, action, reason, configuration and log location.
For the fixture, a captured state record could read: source-copy ID TEST-NOTICE-001; actor author.synthetic; timestamp 2026-09-06T10:15:00Z; action approve; reason sample approved; configuration test tenant, publishing off; log location audit export CSV.
Test that the obsolete copy cannot reach the staged publication state, then correct and restore it. NCSC cloud Principle 13 describes audit information and alerts that help customers investigate incidents. Confirm the actual export rather than relying on a dashboard label.
Run an accessible user task against the configured sample. Include keyboard use, heading order, link meaning, zoom and an alternative-format request. GOV.UK's accessible communication formats guidance is government-focused; it supplies planning prompts, not an accessibility verdict for a private tenant.
Keep personal data out of the exercise
Do not import a real address book to see whether integration works. If later processing is proposed, document purpose, minimum fields, roles, subprocessors, transfers, retention, rights and deletion first. The ICO's data protection by design guidance was updated for DUAA on 5 February 2026 and supports considering privacy at the start.
Review changes before enabling anything
Compare the tested version, edition, terms, subprocessors and configuration with the approved dossier. A change reopens only the affected gates, but production remains disabled while any gate is unresolved. Record the supplier notice, impact owner and decision. If the service cannot freeze or identify its relevant version, the buyer cannot reliably connect the observation to the product later.
Prove rollback and exit
Disable the test configuration, revoke accounts, export the source copy and audit trail, and request deletion of the synthetic fixture. Record what remains, where, for how long and under whose authority. Restore the manual process and confirm it still holds the authoritative record.
Untested support, production load, accessibility conditions, data handling and supplier behaviour stay unresolved.
Compare against the unchanged manual route and record whether the new configuration solves the admitted problem. A failed legal, privacy, security or access gate prevents production. A failed correction or exit gate prevents it. No procurement or launch is authorised; publication stays on hold.
Before you act
- Disable production publishing, messaging, email, monitoring and social posting.
- Assign separate synthetic accounts for each role before content moves.
- Test that the obsolete copy cannot reach the staged publication state.
- Run an accessible user task against the configured sample.
- Keep personal data out of the exercise.
- Prove rollback and exit, then restore the manual process.
Common questions
What should be disconnected before testing begins?
The isolated exercise runs with all live channels off: publishing, messaging, email, monitoring, social posting, surveys, approval, incident communication and analytics. It tests the fixture only.
What must be recorded for each state change?
Each state needs its source-copy ID, actor, timestamp, action, reason, configuration and log location. Check the export itself, not a dashboard label. Review changes need the supplier notice, impact owner and decision.
When does production remain disabled?
Production remains disabled while any gate is unresolved. A failed legal, privacy, security, access, correction or exit gate blocks go-live. Publication stays on hold until the affected gates are resolved.
