For a new Service Cloud case management process at a utilities company, stakeholders state two needs: every portal page must load in 2 seconds or less, and every login must require multi-factor authentication. How should the BA categorize these two requirements?
- Both are functional requirements, since they state what the system has to do.
- Page load time is a technical requirement, while MFA enforcement is a business requirement.
- Both are non-functional requirements, since they express performance and security quality attributes rather than specific system behaviors.
- Page load time is non-functional, while MFA enforcement is functional because the user performs an action.
Show answer
Answer: C
Why: Non-functional requirements describe quality attributes such as performance, security, usability and scalability, not specific behaviors. A 2-second page load is a performance NFR; mandatory MFA is a security NFR. Classifying requirements correctly helps route them to the right technical teams.