# Testing checklist: government services portal

Source: https://howtotestaproduct.com/how-to-test/government-portal/
Generated: 2026-10-07. Licence: CC BY 4.0.

- [ ] 1. release smoke tests
  - Done when: On the release build, a citizen signs in, starts an application, saves it and sees its case status, and sees only their own cases.
  - Risks: data-breach
  - Tool class: browser automation. Usually run by: QA engineer.
- [ ] 2. penetration testing
  - Done when: A tester signed in as one citizen cannot view another person's case or documents by changing an ID, and cannot bypass identity proofing to file a claim.
  - Risks: data-breach, fraud-abuse
  - Tool class: proxy. Usually run by: security specialist.
- [ ] 3. end-to-end functional tests
  - Done when: A claim filed with a test identity that fails proofing is held for review, and a claim under an identity already in use is flagged before payment.
  - Risks: fraud-abuse
  - Tool class: browser automation. Usually run by: QA engineer.
- [ ] 4. compliance checks
  - Done when: A reviewer holds a current accessibility conformance report and a current security authorisation for the release.
  - Risks: accessibility-liability, data-breach
  - Tool class: test management. Usually run by: product manager.
- [ ] 5. accessibility testing
  - Done when: A screen reader user and a keyboard-only user each complete an application, upload a document and read case status without help.
  - Risks: accessibility-liability
  - Tool class: accessibility checker. Usually run by: accessibility specialist.
- [ ] 6. security scanning
  - Done when: The scan report for the portal and its admin tools lists no open high-severity finding, and every staff account requires phishing-resistant sign-in.
  - Risks: data-breach
  - Tool class: DAST scanner. Usually run by: security specialist.
- [ ] 7. performance and load testing
  - Done when: Sign-in and form submission keep working while a load test simulates the opening hours of an enrolment window.
  - Risks: outage-under-load
  - Tool class: load generator. Usually run by: QA engineer.
- [ ] 8. resilience and failure testing
  - Done when: When the identity or case backend is slowed in a test, applicants see a queue or retry message and no submitted form is lost.
  - Risks: outage-under-load
  - Tool class: chaos tool. Usually run by: developer.