Skip to content

5. Guidelines.md

Latest commit

 

History

History
381 lines (264 loc) · 7.7 KB

5. Guidelines.md

File metadata and controls

381 lines (264 loc) · 7.7 KB

Below is a condensed but complete extraction of all required cases from page 31 to page 96 of GIGW 3.0, translated into a practical, implementation-ready documentation and checklist.

This is not a rewrite of the PDF. It is a developer + architect focused compliance document that you can directly use during design, development, testing, audits, and STQC/CERT-In readiness.

Source: GIGW 3.0 – Pages 31–96 (Guidelines: Quality, Accessibility, Cybersecurity, Lifecycle Management)

GIGW 3.0 – Complete Development Checklist

(Derived from Pages 31–96)

Scope of This Document

Applies to:

  • Government Web Apps
  • Government Mobile Apps
  • Backend APIs supporting them

Mapped to:

  • React Native + TypeScript + Jotai
  • Vite React + TypeScript + Jotai
  • Node.js + Express + MongoDB + Redis + MinIO + ClickHouse
  • JWT Authentication
  • Zod Validation
  • Google Maps API (Web)

1. QUALITY GUIDELINES (Section 5.1)

1.1 Identity, Trust & Authenticity

Required Cases

  • Government ownership must be clearly visible
  • Official emblem/logo must be used correctly
  • Ownership visible on every major entry page
  • gov.in / nic.in domain usage

Implementation Checklist

Web + Mobile

  • Display Government Emblem / Official Logo on home screen
  • Logo has alt text (web) / accessibilityLabel (RN)
  • Logo ratio and color preserved
  • Ownership footer/header present on all pages
  • Last updated / reviewed date visible
  • gov.in / nic.in domain enforced (web)

Backend

  • Central config for organization identity
  • Ownership metadata injected into responses if required

1.2 Consistent UX, IA & Navigation

Required Cases

  • Same IA, navigation terminology, layout across all apps
  • Reusable templates

Implementation Checklist

Web (Vite React)

  • Central layout component
  • Shared navigation schema
  • Common page structure (Header, Content, Footer)
  • Consistent route naming
  • Jotai atoms for global UI state

Mobile (React Native)

  • Central navigation stack
  • Consistent screen titles
  • Shared UI components
  • Platform-agnostic UX patterns

1.3 Mandatory Minimum Content

Required on Home Screen

  • Org name
  • Logo/emblem
  • About
  • Services
  • Contact Us
  • Feedback
  • National Portal link
  • Terms & Conditions
  • Search / Sitemap

Required on Every Page

  • Page title
  • Ownership
  • Contact link
  • Navigation context

Checklist

  • About Us page exists
  • Contact Us page exists
  • Feedback form exists
  • Terms & Conditions exists
  • Privacy Policy exists
  • Sitemap / Search exists
  • National Portal opens in new window (web)

1.4 Content Integrity & Management

Required Cases

  • Accurate, updated, audience-appropriate content
  • Archival of expired content
  • Download metadata visibility

Checklist

Backend

  • CMS-like content schema
  • validFrom, validTill fields
  • Auto archival cron
  • File metadata stored (size, format, instructions)
  • Virus scan before MinIO upload

Web/Mobile

  • Display file size, type, usage
  • Show expiry warnings
  • Archive section UI

1.5 Metadata, SEO & Print Support

Required Cases

  • Proper page titles
  • Language attributes
  • Metadata
  • A4 print compatibility

Checklist

Web

  • <title> set per page
  • <html lang="...">
  • Meta description & keywords
  • Print stylesheet
  • CSS-only layout (no table layouts)

2. ACCESSIBILITY GUIDELINES (Section 5.2)

WCAG 2.1 – Level AA compliance is mandatory

2.1 Core Accessibility Principles

Required Cases

  • Perceivable
  • Operable
  • Understandable
  • Robust

Common Failure Risks Covered (A1–A9)

  • Visual impairment
  • Hearing impairment
  • Cognitive disability
  • Seizures due to blinking
  • Keyboard inaccessibility
  • Language barriers

2.2 Web Accessibility Checklist

  • Semantic HTML
  • Proper heading order
  • Alt text for images
  • ARIA roles where required
  • Keyboard navigation works
  • Focus indicators visible
  • No fast blinking content
  • Forms have labels
  • Error messages are descriptive
  • Language switch supported (where applicable)

2.3 Mobile Accessibility Checklist (React Native)

  • accessible={true} used
  • accessibilityLabel provided
  • Touch targets ≥ 48dp
  • Screen reader tested (TalkBack / VoiceOver)
  • Time-based actions have pause/extend
  • No gesture-only interactions

2.4 Forms & Inputs (Web + Mobile)

  • Labels always visible
  • Instructions provided
  • Error feedback accessible
  • Zod validation messages user-friendly
  • No placeholder-only labels

3. CYBERSECURITY GUIDELINES (Section 5.3)

Aligned with:

  • OWASP Top 10
  • ISO 27001
  • ASVS
  • CERT-In advisories

3.1 Authentication & Authorization

Required Cases

  • Secure authentication
  • Least privilege
  • Session protection

Checklist

Backend

  • JWT short-lived access tokens
  • Refresh tokens rotated
  • Role-based access control
  • Token revocation supported
  • Redis for session/token blacklisting

3.2 Input Validation & Injection Prevention

  • Zod validation at API boundary
  • No trust in client data
  • MongoDB queries sanitized
  • No dynamic query building
  • ClickHouse queries parameterized

3.3 File Upload Security (MinIO)

  • Presigned URLs only
  • MIME type validation
  • File size limits
  • Virus scan
  • Private buckets
  • Time-bound URLs

3.4 Transport & Data Security

  • HTTPS enforced
  • HSTS enabled
  • Secure cookies
  • Encryption at rest
  • Sensitive fields masked

3.5 OWASP Top Risks (Explicitly Covered)

  • XSS (stored, reflected, DOM)
  • CSRF protection
  • Broken auth
  • Insecure deserialization
  • Security misconfiguration
  • Component vulnerability scanning
  • Rate limiting
  • Brute force prevention

3.6 Logging, Monitoring & Incident Response

  • Audit logs
  • Auth logs
  • File access logs
  • Failed login tracking
  • Alerting (abnormal patterns)
  • CERT-In advisory tracking

4. LIFECYCLE MANAGEMENT (Section 5.4)

4.1 Governance & Ownership

  • Web Information Manager identified
  • Clear ownership of content
  • Change management process
  • Approval workflows

4.2 Maintenance & Updates

  • Regular dependency updates
  • Vulnerability scanning
  • Performance monitoring
  • Broken link checks
  • Content freshness review

4.3 Backup & Disaster Recovery

  • MongoDB backups
  • MinIO backups
  • Redis persistence strategy
  • DR plan documented
  • Restore drills performed

4.4 Performance & Availability

  • CDN where applicable
  • API rate limiting
  • Graceful degradation
  • Slow network support
  • Mobile offline handling (where relevant)

5. FINAL COMPLIANCE MATRIX (What Auditors Will Check)

Area Must Exist
Identity Logo, Ownership, gov.in
UX Consistency, IA
Content About, Contact, Feedback
Accessibility WCAG 2.1 AA
Security OWASP + CERT-In
Lifecycle Archival, Updates
Logging Audit trails
Files Secure upload
APIs Validated, Authenticated

How You Should Use This Document

  • Design phase → Architecture & UX decisions
  • Development → Daily checklist
  • Testing → Manual + automated audits
  • Security audit → CERT-In readiness
  • STQC audit → CQW compliance