Implementing a communications tool with production switched off

Implementation should begin in an isolated environment with production publishing and delivery disabled. Cedar Vale Engineering Ltd is fictional. Its test job is to route a clearly marked sample notice about an imaginary site proposal through approval, correction and archive without contacting an employee, customer or journalist.

No system was configured for this guide. The method reflects official evidence checked on 6 September 2026.

Prepare a harmless fixture

Create synthetic names and non-deliverable addresses under buyer control. The source copy should say that it is test material and contain no real proposal, quotation or personal detail. Add two versions: an approved sample and a superseded copy with a visible fictional error. Record the expected state changes before loading either one.

Keep newsroom publishing, employee messaging, email contact, monitoring, social posting, surveys, approval, incident communication and analytics disconnected. A test of approval gives no evidence about delivery or audience response.

Lock roles before content moves

Assign separate synthetic accounts for author, factual reviewer, accessibility reviewer, privacy reviewer, publisher and incident owner. Test minimum privilege, rejected access, joiner and leaver handling, recovery and a second authorised person for urgent withdrawal.

The NCSC's identity and authentication principle explains why buyers need confidence in authenticated and authorised identities and credential lifecycle. It is guidance, not proof that an unnamed service meets Cedar Vale's requirement.

Configure evidence, not outcomes

For each state, capture source-copy ID, actor, timestamp, action, reason, configuration and log location. Test that the obsolete copy cannot reach the staged publication state, then correct and restore it. NCSC cloud Principle 13 describes audit information and alerts that help customers investigate incidents. Confirm the actual export rather than relying on a dashboard label.

Run an accessible user task against the configured sample. Include keyboard use, heading order, link meaning, zoom and an alternative-format request. GOV.UK's accessible communication formats guidance is government-focused; it supplies planning prompts, not an accessibility verdict for a private tenant.

Keep personal data out of the exercise

Do not import a real address book to see whether integration works. If later processing is proposed, document purpose, minimum fields, roles, subprocessors, transfers, retention, rights and deletion first. The ICO's data protection by design guidance was updated for DUAA on 5 February 2026 and supports considering privacy at the start.

Review changes before enabling anything

Compare the tested version, edition, terms, subprocessors and configuration with the approved dossier. A change reopens only the affected gates, but production remains disabled while any of them are unresolved. Record the supplier notice, impact owner and decision. If the service cannot freeze or identify its relevant version, the buyer cannot reliably connect the observation to the product later.

Prove rollback and exit

Disable the test configuration, revoke accounts, export the source copy and audit trail, and request deletion of the synthetic fixture. Record what remains, where, for how long and under whose authority. Restore the manual process and confirm it still holds the authoritative record.

The verdict can only be pass, fail or unresolved for each tested event. Untested support, production load, accessibility conditions, data handling and supplier behaviour stay unresolved. Compare the result with the unchanged manual route and record whether the new configuration solves the admitted problem. Any failed legal, privacy, security, access, correction or exit gate prevents production. No procurement or launch is authorised, and publication remains on hold.