Every user story in the final build as a single list, with the functional requirements each one delivers. 168 stories; none are built yet.
User story Status Tests
As an Applicant, I want to sign in to the DCC Portal with my username and password, so that I can securely access my applications and license records.FL-158 FL-174 FL-179 FL-193 FL-210 FG-47 FG-48 FC-01 NF-IA-02 Planned Not yet recorded
As an Applicant, I want to create a new user account with a unique username and password, so that I can register with DCC and begin the licensing process.FL-154 FG-59 FG-60 NF-IA-01 NF-IA-09 NF-IA-03 Planned Not yet recorded
As an Applicant, I want to register or search for my business entity using a Registration Number, FEIN, ITIN, or SSN, so that DCC can identify my entity before I apply for a license.FL-159 FL-160 FL-161 FL-162 Planned Not yet recorded
As an Applicant, I want the system to automatically verify my business details against the Secretary of State for LLC, LP, or Corporation entity types, so that my entity information is validated before I proceed.FL-163 FL-164 Planned Not yet recorded
As an Applicant, I want to provide my Designated Responsible Party, Agent Service of Process, contact information, and owner details including ownership percentages totaling 100%, so that the entity registration record is complete and accurate.FL-165 FL-166 FL-167 FL-168 FL-169 FL-170 FL-172 FL-173 Planned Not yet recorded
As an Owner, I want to register my personal profile after receiving an invitation link, so that my owner record is linked to the correct business entity before the license application is submitted.FL-171 FL-175 FL-176 FL-177 FL-178 Planned Not yet recorded
As a Cannabis Event Organizer Licensee, I want to apply for a Cannabis Event License by selecting my existing organizer license number and providing event details such as date, hours, and address, so that DCC can review and approve my event before it takes place.FL-179 FL-180 FL-181 FL-182 FL-183 FL-184 FL-185 FL-186 FL-187 FL-188 FL-189 FL-190 +2 more Planned Not yet recorded
As an Applicant, I want to apply for a Cannabis Event Organizer license by entering my entity registration number, providing equity information, and having owner information auto-populated and verified against the Secretary of State, so that my application is pre-filled accurately and submitted with the correct fee.FL-193 FL-194 FL-195 FL-196 FL-197 FL-198 FL-199 FL-200 FL-201 FL-202 FL-203 FL-204 +5 more Planned Not yet recorded
As an Applicant, I want to apply for any general DCC license type by searching my business entity, selecting the appropriate license type, and completing all required application sections, so that my application is routed to the correct regional supervisor for review.FL-210 FL-211 FL-212 FL-213 FL-214 FL-215 FL-216 Planned Not yet recorded
As a Division Manager, I want the system to automatically verify the APN, physical address, and jurisdiction of each application and route it to the correct regional queue, so that the right supervisor receives the application without manual routing.FL-20 FL-21 FL-22 FL-23 Planned Not yet recorded
As a Division Manager, I want to open applications from my pending review queue, review system-generated flags, toggle manager approval on or off, and assign applications to analysts, so that the review process starts efficiently.FL-24 FL-25 FL-26 Planned Not yet recorded
As a Licensing Analyst, I want to view application documents, request local jurisdiction verification, place hold conditions, and record equity verification results, so that only compliant applications proceed to the next review stage.FL-27 FL-28 FL-29 FL-30 FL-31 FL-32 FL-33 FL-34 FL-35 FL-36 FL-37 Planned Not yet recorded
As a Licensing Analyst, I want to review business information, entity relationship diagrams, owner details, disciplinary history, and active license reports, then record timestamped comments and a determination of approve, deny, or deficient, so that each review section is documented.FL-38 FL-39 FL-40 FL-41 FL-42 FL-43 FL-44 FL-45 FL-46 FL-47 FL-48 FL-49 +5 more Planned Not yet recorded
As a Division Manager, I want to review my analyst's approval determination and either accept it or return it for revision, with a visual status indicator visible to all managers, so that quality control is applied before advancement.FL-55 FL-56 FL-57 FL-58 FL-59 Planned Not yet recorded
As a Licensing Analyst, I want to review all admin-specific documentation including LPA attestations, Cal OSHA certificates, ISO accreditation, surety bonds, and premises diagrams, communicate with the applicant, and record deficiencies, so that the application meets all administrative compliance requirements.FL-68 FL-69 FL-70 FL-71 FL-72 FL-73 FL-74 FL-75 FL-76 FL-77 FL-78 FL-79 +13 more Planned Not yet recorded
As a Division Manager, I want to review my analyst's admin review determination and accept or reject it, with the system returning the application to the analyst queue on rejection, so that admin review meets the required standard.FL-93 FL-94 FL-95 FL-96 FL-97 Planned Not yet recorded
As a System, I want to automatically determine when all workflow sections are approved and mark the application Approved-Pending Payment, or when any section is deficient generate a consolidated deficiency letter from a DCC template and notify the applicant with 180-day abandonment status if no response is received, so that applicants receive clear communication.FL-60 FL-61 FL-62 FL-63 FL-64 FL-65 FL-66 FL-67 Planned Not yet recorded
As an Applicant, I want to update my application for a license type change, upload additional documents, and pay any additional fee if the new license type costs more, so that my license accurately reflects the correct activity type.FL-98 FL-99 FL-100 FL-101 FL-102 Planned Not yet recorded
As an Equity Applicant, I want to submit an Equity Fee Relief Application online with supporting documents, and have the system identify whether I am applying for a fee waiver or deferral and guide me to upload the correct documentation, so that my equity relief request is complete from the start.FL-133 FL-135 FL-146 FL-154 FL-155 FL-156 FL-157 FL-136 Planned Not yet recorded
As a System, I want to automatically verify the identity of the Designated Responsible Party and evaluate the application against DCC regulations, so that only eligible applicants proceed to full review.FL-137 FL-138 Planned Not yet recorded
As a Licensing Analyst, I want equity applications to be automatically routed to the designated analyst or team based on set criteria and notified immediately upon assignment, so that equity applications are processed promptly.FL-139 FL-140 FL-141 Planned Not yet recorded
As a Licensing Analyst, I want to see a cross-reference display on the applicant's profile showing all linked businesses and flagging multiple-business ownership on my dashboard, so that I can identify concentration of ownership.FL-149 FL-150 FL-151 FL-152 Planned Not yet recorded
As a System, I want to automatically tag uploaded documents with metadata upon upload and link them directly to the specific application they pertain to, so that documents are categorized without manual filing.FL-147 FL-148 Planned Not yet recorded
As a System, I want to verify whether a business entity has any record of unpaid deferrals before approving equity fee relief, so that deferral benefits are not granted to entities with outstanding obligations.FL-153 Planned Not yet recorded
As a Licensing Analyst, I want the system to log all current and historical activities for each equity application including timestamps, changes, and user interactions, so that a complete audit trail exists for compliance and reporting.FL-142 FG-67 FG-68 Planned Not yet recorded
As a Licensee, I want to access a renewal application for my specific license type, complete all required sections, pay fees, and submit for back-office review with the ability to save and resume, so that my license is renewed before expiration.FL-325 FL-326 FL-327 FL-328 FL-329 FL-330 FL-331 FL-332 FL-333 FL-334 FL-335 FL-336 +11 more Planned Not yet recorded
As a DCC Program Staff member, I want the system to support documenting and processing suspension, revocation, application denial, and cancellation actions, so that all enforcement actions are tracked in the centralized system.FL-248 FL-249 FL-250 FL-251 FL-252 FL-253 FL-254 FL-255 FL-256 FL-257 FL-258 FL-259 +88 more Planned Not yet recorded
As a Licensee or DCC Staff member, I want to initiate or process a voluntary license surrender or withdrawal and have the system update the license status accordingly, so that the license record is closed accurately.FL-248 FL-249 FL-250 FL-251 FL-252 FL-253 FL-254 FL-255 FL-256 FL-257 FL-258 FL-259 +19 more Planned Not yet recorded
As a Licensee or DCC Legal staff member, I want the system to support an appeals approval workflow so that appealed decisions are tracked and resolved through the correct approval chain.FL-317 FL-318 FL-319 FL-320 FL-321 FL-322 FL-323 FL-324 FL-433 Planned Not yet recorded
As a Licensee, I want to apply for disaster relief provisions that modify my license obligations during a declared disaster, so that my business is not penalized for circumstances outside my control.FL-291 FL-292 FL-293 FL-294 FL-295 FL-296 FL-297 FL-298 FL-299 FL-300 FL-301 FL-302 +6 more Planned Not yet recorded
As an Applicant or Licensee, I want to retrieve an invoice through the DCC Portal and pay using my preferred method (online, by appointment for cash, or by mail) with cash, check, e-check, or credit/debit card, so that my payment is processed and a receipt generated immediately.FL-103 FL-104 FL-106 FL-107 FL-108 FL-109 FL-110 FL-111 FL-112 FL-113 FL-114 FL-130 +4 more Planned Not yet recorded
As a Cashier, I want to log in, select payment type, process multiple invoices in one session, and generate a receipt with all payment and business details, so that in-person and mail payments are posted accurately.FL-105 FL-106 FL-107 FL-108 FL-109 FL-110 FL-111 FL-112 FL-113 FL-114 Planned Not yet recorded
As an Accounting Staff member, I want to submit a delinquency process request, configure a collections case with notice frequency and FTB escalation options, and write off delinquent accounts upon approval, so that overdue accounts are managed systematically.FL-01 FL-02 FL-03 FL-04 FL-05 FL-06 FL-07 FL-12 FL-13 FL-14 FL-15 FL-16 +5 more Planned Not yet recorded
As a Cashier or Accounting Staff member, I want to submit, review, and process refund requests and apply overpayment credits to future renewals, with notifications sent to the payor and accounting department, so that refunds are processed transparently.FL-118 FL-119 FL-120 FL-121 FL-122 FL-123 FL-124 FL-125 FL-126 FL-127 FL-128 FL-129 Planned Not yet recorded
As an Accounting Staff member, I want to generate accounting reports by date range and region covering monthly delinquency, total payments, refunds, repayments, and write-offs, so that DCC finance has accurate and timely data.FL-08 FL-09 FL-10 FL-11 FL-19 Planned Not yet recorded
As a Compliance Staff member, I want to create an inspection record that separates cases with parent IDs, links them to case numbers, optionally pre-fills fields from prior inspections, and requires all required fields to be completed before submission, so that each inspection is uniquely traceable.FC-04 FC-05 FC-31 FC-32 FC-33 FC-38 FC-39 Planned Not yet recorded
As a Supervisor, I want to view a dashboard showing workload distribution across regions and the current workload and case status for all compliance staff, so that I can balance assignments and identify bottlenecks.FC-30 FC-31 FC-29 Planned Not yet recorded
As a Compliance Staff member, I want to select violation types from a checklist, choose enforcement actions from a dropdown, add free-text notes, and have the system auto-generate a prefilled enforcement letter from the appropriate template, so that enforcement letters are consistent and ready for supervisory review.FC-34 FC-35 FC-38 FC-39 FC-43 Planned Not yet recorded
As a Supervisor, I want to be notified when an enforcement letter is ready for review, approve or reject it with feedback, route it to additional parties, and trigger final dispatch to the responsible party upon approval with notifications at each step, so that enforcement letters meet legal standards.FC-36 FC-40 FC-41 FC-42 FC-44 FC-45 FC-47 FC-48 FC-49 FC-50 FC-51 Planned Not yet recorded
As a Compliance Staff member, I want to select from a full set of case statuses including In Progress, Completed, With Legal, With AG Office, Under Supervisor Review, and Awaiting Licensee Response, so that every inspection case has a clear and current status.FC-38 FC-44 FC-45 Planned Not yet recorded
As a Compliance Staff member, I want to categorize prioritized investigation complaints, retrieve relevant licensee information using keyword searches, and have supervisors assign investigation tasks, so that investigations are assigned efficiently with full licensee context.FC-52 FC-53 FC-54 Planned Not yet recorded
As a Compliance Staff member, I want to input information collected during a field investigation including violation checklists, enforcement action selections, and free-text notes, so that all field findings are captured in the investigation record.FC-55 FC-56 Planned Not yet recorded
As a Compliance Staff member, I want the system to generate a violation letter template from the selected violation, route it to the supervisor on my selection of Supervisor Review, notify me when it is received and again when it is sent, and send the letter and email to the licensee and primary contact, so that enforcement communications are automated and tracked.FC-57 FC-58 FC-59 FC-60 FC-61 Planned Not yet recorded
As a Supervisor, I want to review the completed investigation case and recommended actions, accept or reassign it to compliance staff, and close the case when all actions are resolved, so that investigations are brought to a documented close.FC-62 FC-63 FC-65 FC-66 Planned Not yet recorded
As a Compliance Staff member, I want to view a page that displays the status of all my cases so that I can track current progress across the full investigation lifecycle.FC-64 Planned Not yet recorded
As a member of the General Public, I want to submit an online complaint about a licensed cannabis business by providing a configurable minimum summary, respondent information, my contact details, and a verification checkbox, so that my complaint is received and acknowledged with a confirmation notification.FC-08 FC-10 Planned Not yet recorded
As a member of the General Public, I want to submit a complaint about unlicensed cannabis activity using a similar intake form, so that unlicensed activity is reported to DCC for investigation.FC-180 FC-181 FC-182 Planned Not yet recorded
As a System, I want to automatically verify and flag complaints as spam before they enter the complaint process and send an automatic acknowledgment to the complainant upon successful validated submission, so that only legitimate complaints reach analysts.FC-09 FC-181 Planned Not yet recorded
As a Compliance Analyst, I want the system to automatically create a digital complaint file with a predefined naming convention, detect and associate any attachments, and generate a complaint worksheet for the case, so that each complaint has an organized record from submission.FC-183 FC-184 FC-185 Planned Not yet recorded
As a Compliance Analyst, I want the system to automatically analyze new complaints for potential duplicates based on content and complainant information, flagging them for my review so I can combine, reject, or validate them, so that duplicate complaints do not create redundant investigations.FC-188 FC-189 Planned Not yet recorded
As a System, I want to assign complaints to analysts based on prior working relationships first and then workload balancing, and automatically prioritize by urgency and deadline, so that the most time-sensitive complaints reach the right analyst.FC-186 FC-187 Planned Not yet recorded
As a Compliance Manager, I want to review analyst-recommended dispositions, automatically see complaints flagged for closure review, and approve or reject with feedback, returning rejected complaints to the analyst, so that dispositions meet the required standard before closure.FC-192 FC-193 FC-196 FC-197 FC-198 FC-199 FC-200 Planned Not yet recorded
As a Compliance Analyst or Manager, I want to check whether a complaint needs ISB referral and transfer it with all associated documents so that escalated investigations reach the right team without manual file transfer.FC-194 FC-195 Planned Not yet recorded
As a System, I want to route complaints to the appropriate external regulatory agency when needed and automatically notify both the agency and the complainant that the complaint has been transferred, so that inter-agency referrals are transparent.FC-128 FC-129 FC-130 Planned Not yet recorded
As a member of the General Public, I want to submit a complaint referral about a licensed entity through the DCC Portal with all required fields and a spam verification check, so that only legitimate referrals reach the compliance team.FC-08 FC-09 FC-10 Planned Not yet recorded
As a Compliance Analyst, I want the system to verify whether a complaint contains multiple allegations and automatically separate it into individual cases, prompting me to confirm the separation, so that each allegation has its own investigation record.FC-124 FC-125 Planned Not yet recorded
As a Compliance Analyst, I want the system to automatically verify the complainant's license status during intake, so that the referral is correctly categorized from the start.FC-126 Planned Not yet recorded
As a Compliance Analyst, I want to conduct a desk investigation from within the system and process the associated worksheet with all necessary supporting documents, so that the referral is fully documented before any field action.FC-127 Planned Not yet recorded
As a System, I want to route referrals to the appropriate regulatory agency and automatically send email notifications to both the agency and the complainant, so that referrals are transferred without manual coordination.FC-128 FC-129 FC-130 Planned Not yet recorded
As a Compliance Staff member in the Recalls Unit, I want the system to receive referral information, send a Derived Package Report request to Metrc, create a recall profile with all relevant details, and implement Metrc holds on recalled items once confirmed, so that recalled products are immediately frozen in the track-and-trace system.FC-67 FC-68 FC-70 FC-71 FC-73 Planned Not yet recorded
As a Compliance Staff member, I want the system to prioritize recalls by category and produce the correct letter (Pre-Embargo, Notice of Adulteration, or both) based on evidence type, sending it to the licensee, so that the correct legal notice is issued automatically.FC-69 FC-71 FC-72 FC-74 FC-75 FC-76 Planned Not yet recorded
As a Compliance Staff member, I want to submit a case as a Voluntary Recall, Mandatory Recall, or Embargo based on the licensee's response, with the system automatically drafting and routing the recall letter for supervisor approval, so that each pathway follows the correct procedural track.FC-77 FC-78 FC-79 FC-80 FC-81 FC-84 Planned Not yet recorded
As a Supervisor or ISB staff member, I want the system to support Affirm, Modify, and Set Aside decision branching with traceable actions, route informal hearing requests, send decisions to executives and legal stakeholders, and remove Metrc holds when a recall is set aside, so that every decision is documented and enforceable.FC-84 FC-85 FC-86 FC-91 FC-92 FC-95 Planned Not yet recorded
As a System, I want to send mandatory recall letters to retailers, send automated reminders on a configurable schedule to non-responsive retailers, and escalate unresponsive retailers to ISB automatically, so that compliance is enforced downstream without manual follow-up.FC-82 FC-83 FC-87 FC-88 FC-89 FC-98 FC-100 Planned Not yet recorded
As a Compliance Staff member or ISB, I want the system to initiate the post-recall process, send executive notices for approval, issue destruction and remediation letters, track footage submissions, remove Metrc holds on completion, and escalate non-compliance to ISB, so that every recall is fully resolved with documented evidence.FC-101 FC-102 FC-103 FC-104 FC-105 FC-106 FC-107 FC-108 FC-109 FC-110 FC-111 FC-112 +11 more Planned Not yet recorded
As an Environmental Scientist, I want to be assigned new remediation cases prioritizing existing working relationships with workload balancing, receive immediate notification, be notified when licensee documents arrive, and track a 15-business-day SLA with automated reminders, so that corrective action plans are reviewed on time.FC-131 FC-132 FC-133 FC-134 FC-135 FC-136 FC-137 FC-138 FC-139 FC-140 Planned Not yet recorded
As a System, I want to monitor the remediation inbox, register incoming emails, identify their type (failed batch, remediation plan, retest, general inquiry), and route each to the correct workflow or inbox, so that no remediation communication is missed.FC-141 FC-142 FC-143 FC-144 FC-145 FC-146 FC-147 FC-148 FC-149 FC-150 FC-151 FC-152 +2 more Planned Not yet recorded
As an Environmental Scientist or ISB staff member, I want the system to receive the lab test failure spreadsheet, reconcile daily failure data, email distributor licensees, update the Failed Goods Tracker, route batches to ISB, and assign a Notice to Comply on non-compliant activity, so that failed goods are tracked from lab result to resolution.FC-155 FC-156 FC-157 FC-158 FC-159 FC-160 FC-161 FC-162 FC-163 FC-164 FC-165 FC-166 +9 more Planned Not yet recorded
As a Senior Environmental Scientist or ISB staff member, I want the system to enforce a 2-business-day SLA for general inquiry responses and a 15-business-day SLA for corrective action plan reviews, automatically escalating to ISB when deadlines are missed, so that remediation cases do not stall.FC-134 FC-145 Planned Not yet recorded
As a Field Employee, I want to select Issue Citation when retrieving a license on the DCC Portal, complete DCC Form 8107, have the system generate the applicable fee from the selected template, and upload Proof of Service and Green Receipt, so that citations are drafted accurately before supervisory review.FG-01 FG-02 FG-03 FG-42 FG-43 Planned Not yet recorded
As a Supervisor, ABC, Legal, or Authorized Approver, I want to receive citations for review, modify or add comments, forward to the next level, have Legal update the fee amount, and update the status to Issue Citation upon final authorization, so that every citation is legally accurate and properly authorized.FG-04 FG-05 FG-06 FG-07 FG-08 FG-09 FG-11 FG-12 FG-13 Planned Not yet recorded
As a Licensee, POC, or DCC Legal staff member, I want to create an informal conference request tied to a citation, upload supporting documents, have it routed to a POC for review, allow modification of the citation based on the conference outcome, and update status to Dismissed or Modified, so that licensees have a documented process to contest citations informally.FG-14 FG-15 FG-16 FG-17 FG-18 FG-19 FG-20 FG-21 FG-22 FG-23 FG-24 FG-25 +2 more Planned Not yet recorded
As a Licensee or Legal POC, I want to create a formal hearing request, upload supporting documents, have Legal upload external process documents and configure a payment plan based on the final decision, and update the citation status, so that formal disputes are tracked through a legally documented process.FG-32 FG-33 FG-34 FG-35 FG-36 FG-37 FG-38 FG-39 Planned Not yet recorded
As a Licensee or Cashier, I want to pay citation invoices through the DCC payment vendor portal or cash/check with a configurable payment plan, have the system adjust the final invoice for overpayments, stop invoice notifications on dismissal, and update status to Paid on full settlement, so that citation fees are collected accurately.FG-10 FG-20 FG-26 FG-27 FG-28 FG-29 FG-30 FG-31 FG-46 Planned Not yet recorded
As an Applicant, Licensee, or DCC Staff member, I want to upload multiple documents at once with associated categories, have the system validate file formats and sizes, reject blank or restricted file types, notify me of acceptable types, and allow me to view, add, modify, and delete files before and after submission, so that all documentation is accurate from intake through the record lifecycle.FC-03 FC-11 FC-12 FC-13 FC-14 FC-15 FC-16 FC-17 FC-18 FG-50 FG-51 FG-52 +7 more Planned Not yet recorded
As a System, I want to automatically create a named folder for each licensee using their name and license number, and automatically add all received documents to the correct folder based on the licensee identifier, so that all licensee documents are organized without manual filing.FC-25 FC-26 Planned Not yet recorded
As a DCC Program Staff member, I want to indicate when an uploaded file is for internal use only so that it is not visible to the applicant or licensee through the portal, so that confidential review materials are protected.FC-14 FG-54 Planned Not yet recorded
As a DCC Program Staff member or ITSD administrator, I want to sort, archive, apply statuses, edit, and delete documents within any application or license record, configure external user document permissions, and access all non-DOJ-clearance-required documents, so that document management is organized, current, and appropriately secured.FG-61 FG-62 FG-83 Planned Not yet recorded
As an Applicant, Licensee, or DCC Staff member, I want to download my application and all uploaded documents in PDF format at any point in the process, so that I have a portable, complete record of my submission.FC-22 FG-78 Planned Not yet recorded
As an ITSD or DCC Program Staff administrator, I want to configure and modify workflows, business rules, criteria, fee tables, and decision logic across all license categories without requiring significant development effort, so that DCC can respond to regulatory and legislative changes quickly.FC-02 FG-49 NF-MT-01 NF-MT-02 Planned Not yet recorded
As a DCC Program Staff member, I want to re-order case priorities, assign applications to myself or another analyst within a division, create internal flags on records, enter custom field data not visible to applicants, and approve conditional licenses when mitigation is in place, so that case management is flexible.FC-27 FG-55 FG-56 FG-57 FG-81 FG-82 FC-46 Planned Not yet recorded
As a DCC Program Staff member or Auditor, I want the system to maintain a thorough, reportable audit log of all internal and external user activities and a complete version change history from application submission through the full license lifecycle, so that every action is traceable.FG-67 FG-68 NF-AU-01 NF-AU-02 NF-AU-03 NF-AU-04 NF-AU-05 NF-AU-06 NF-AU-07 NF-AU-08 NF-AU-09 NF-AU-10 +25 more Planned Not yet recorded
As a DCC Program Staff member, I want to create custom fields and custom tables that are not visible to applicants and add internal flags within any application or license record, so that internal review tracking can be added without changing the external-facing form.FG-56 FG-82 Planned Not yet recorded
As an Applicant or DCC Staff member, I want a progress bar within each business process that indicates the current status of the workflow, so that both applicants and staff can see at a glance where a case or application stands.FC-23 FG-79 FL-188 FL-204 Planned Not yet recorded
As any system user, I want to receive role-specific notifications at each major workflow step based on case status and outcome so that I am immediately informed of actions requiring my attention, so that no workflow step is missed.FC-177 FG-63 Planned Not yet recorded
As a DCC Program Staff member, I want to generate flexible ad-hoc reports for my business unit and perform advanced back-office searches across all data stored in the system, so that operational insights are available without relying on the BI team.FC-24 FG-80 FL-08 FL-09 FL-10 FL-11 FL-143 FL-144 Planned Not yet recorded
As an ITSD or BI Team member, I want the system to replicate data in real time to DCC's reporting-only database and data warehouse so that the BI platform always reflects the current state of licensing and compliance activity.NF-NS-11 Planned Not yet recorded
As a Compliance Manager or Supervisor, I want to view dashboard summaries of recall status by case type and response time, open recalls by status, and auto-generated recall outcome reports, so that program performance is visible at a glance.FC-97 FC-99 FC-121 Planned Not yet recorded
As an Accounting Staff member, I want to generate accounting reports by date range and region covering monthly delinquency, total payments, refunds, repayments, and write-offs, so that DCC finance has accurate, timely data.FL-08 FL-09 FL-10 FL-11 FL-19 Planned Not yet recorded
As a System, I want to exchange data bi-directionally with Metrc including package hold placements, releases, and Derived Package Report requests with success and failure reporting, so that DCC track-and-trace actions are reflected in Metrc without manual entry.FC-68 FC-73 FC-85 FC-107 FG-93 FG-94 FG-95 Planned Not yet recorded
As a System, I want to verify business entity details against the Secretary of State registry using registration numbers for LLCs, LPs, and Corporations and save the results to the application record, so that entity information is validated at the source.FL-163 FL-199 Planned Not yet recorded
As a System, I want to verify APN, physical address, and jurisdiction for each license application via an external source and save the results, so that licenses are only issued for valid premises in the correct jurisdiction.FL-20 FL-21 Planned Not yet recorded
As a System or DCC Program Staff member, I want to support standardized API integrations with partner state agencies for bi-directional licensing-related data exchange, so that multi-agency regulatory coordination is automated.FC-20 FG-77 NF-NS-02 Planned Not yet recorded
As an ITSD or Integration Partner, I want all system interfaces to use standardized REST APIs aligned with OWASP API Security Top 10 and REST Security Top 10, each documented in an approved Interface Control Document, so that all integrations are secure and maintainable.NF-NS-02 NF-NS-03 NF-NS-04 NF-NS-10 NF-IA-07 Planned Not yet recorded
As a DCC Internal Staff member, I want to sign in using my existing DCC credentials via Single Sign-On integrated with DCC's MS Azure Active Directory, so that I do not need a separate username and password for the new system.NF-IA-19 NF-IA-20 NF-IA-21 NF-IA-22 NF-IA-23 NF-UM-01 Planned Not yet recorded
As any user, I want the system to require multi-factor authentication for all internal and external user accounts including privileged accounts, so that unauthorized access to sensitive data is prevented.FG-47 NF-IA-24 NF-IA-25 NF-IA-26 NF-IA-06 Planned Not yet recorded
As an ITSD Administrator or DCC Program Staff member, I want all system activities to be authorized by role-based permissions following a least-privilege model, with no shared or guest accounts and configurable session locking, so that each user can only access data and functions appropriate to their role.FG-59 FG-70 NF-AC-06 NF-AC-07 NF-AC-10 NF-AC-16 NF-AC-17 Planned Not yet recorded
As an ITSD Administrator, I want to create, update, delete, suspend, assign roles, reset passwords, and disable temporary accounts after a defined period, with all account management events logged automatically, so that user access is controlled and auditable.FG-59 FG-60 NF-AC-20 NF-AC-21 NF-IA-13 NF-AU-04 NF-AC-05 Planned Not yet recorded
As an ITSD Administrator or any User, I want the system to lock accounts after a configurable number of failed login attempts, alert administrators on lockout, enforce configurable session timeouts, and display a warning banner on every login, so that brute-force attacks and unauthorized session access are mitigated.NF-AC-12 NF-AC-13 NF-AC-14 NF-AC-15 NF-AC-16 NF-AC-17 NF-AU-01 NF-AU-02 NF-AU-03 Planned Not yet recorded
As a member of the General Public, I want to search for any DCC licensee by license number, business name, or individual name and see their current license status, expiration date, and any public disciplinary actions, so that I can verify whether a cannabis business is legally operating.FG-71 Planned Not yet recorded
As a member of the General Public, I want to search for a licensee and submit an online complaint that is pre-populated with that licensee's information, receiving a confirmation on successful submission, so that my complaint is accurately linked from the start.FG-71 FC-08 Planned Not yet recorded
As a member of the General Public, I want to see any public disciplinary actions associated with a licensee when I perform a license search, so that I can make informed decisions as a cannabis consumer.FG-71 Planned Not yet recorded
As an Applicant or DCC Staff member, I want the system to use AI to detect potential data entry errors, identify missing or deficient information, and flag issues with suggested corrections after I enter data or upload documents, so that I submit accurate and complete information with fewer rework cycles.FG-64 Planned Not yet recorded
As a DCC Program Staff member, I want the system to process uploaded document images using OCR to improve legibility and extract key information, attaching the processed result without overwriting the original, so that scanned documents are usable and searchable.FG-64 NF-DM-03 Planned Not yet recorded
As an Applicant or DCC Staff member, I want the system to suggest email or message content based on the context of my current task, allowing me to edit the draft before sending, with the system recording that AI assistance was used, so that communications are faster and consistent without losing human oversight.FG-64 Planned Not yet recorded
As an ITSD Administrator, I want AI-enabled administration features including plain-language data queries, plain-language configuration updates, and configuration validation checks, so that system maintenance tasks are accessible without deep technical knowledge.FG-65 Planned Not yet recorded
As a DCC Program Staff member, I want to view system data on an interactive map with boundaries, points, and heat map formats, filter by defined attributes, see contextual tooltips, and export selected data in CSV, GeoJSON, or Shapefile format, so that geographic patterns in licensing and compliance data are visible and shareable.FG-69 Planned Not yet recorded
As an ITSD Administrator, I want the system to be hosted entirely in a GovCloud-compliant cloud SaaS environment certified at FedRAMP Moderate or higher with no on-premise hardware required, so that DCC meets California and federal cloud security standards.NF-AC-03 NF-AM-01 NF-AM-02 NF-AM-03 NF-AM-04 Planned Not yet recorded
As any user including internal field staff and external applicants, I want the system to be fully accessible on mobile and handheld devices, compliant with WCAG 2.0, California Government Code Sections 7405 and 11135, supported on the latest five browser versions, and usable without any plug-ins or extensions, so that all users can access the system regardless of device or ability.NF-AC-01 NF-AC-02 NF-MC-01 NF-NS-01 NF-NS-05 Planned Not yet recorded
As an ITSD or DCC ISO staff member, I want the system to log all login, logout, failed login, account management, role assignment, data deletion, data modification, and configuration change events with timestamps and protect audit records from unauthorized access, so that DCC ISO can investigate security incidents and demonstrate compliance.NF-AU-01 NF-AU-02 NF-AU-03 NF-AU-04 NF-AU-05 NF-AU-06 NF-AU-07 NF-AU-08 NF-AU-09 NF-AU-10 NF-AU-11 NF-AU-12 +51 more Planned Not yet recorded
As an ITSD Administrator, I want the system to scale to an unrestricted number of business rules and unlimited document, record, data field, and API consumption without degrading performance or SLA compliance, so that the system grows with DCC's needs without architectural changes.NF-SC-01 NF-SC-02 NF-SC-03 NF-SC-04 NF-SC-05 Planned Not yet recorded
As an ITSD Administrator or Contractor DevOps engineer, I want the system to comply with a CI/CD DevOps model using DCC-approved tools that automate the build and deployment process for each sprint, so that new functionality reaches production quickly and reliably.NF-DO-01 NF-DO-02 Planned Not yet recorded
As an ITSD Administrator, I want the system to conduct regular backups consistent with recovery time and recovery point objectives, test backups annually, fail closed on security errors, and recover to a known state after any disruption, so that DCC data is protected and the system can be restored quickly.NF-CP-01 NF-CP-02 NF-CP-03 NF-CP-04 NF-CP-05 Planned Not yet recorded
As a DCC Program Staff member or ITSD Administrator, I want the system to support configuration and management of up to five new legislatively-mandated license types and modification of existing license types including fees, rules, and disclosures without code changes, so that DCC can respond to new legislation quickly.FG-93 FG-94 FG-95 Planned Not yet recorded
As a Licensing Analyst, I want the system to automatically interface with partner agencies (DPR, DTSC, SWRCB, CDFW, GIS) via API to verify environmental and premises information submitted with an application, so that all regulatory agency checks are completed without manual outreach.FL-20 FL-21 NF-NS-02 Planned Not yet recorded
As an Applicant, I want the system to check whether my business entity or owners have existing active licenses or pending applications that conflict with the new license type I am applying for, display a regulatory warning disclaimer I must acknowledge, and still allow me to proceed, so that I am fully informed of regulatory restrictions before submitting.FL-210 FL-212 FL-213 Planned Not yet recorded
As an Applicant, I want to indicate whether my premises is located on Tribal Land and have the system check if another license already exists at the same address or APN, so that potential jurisdiction conflicts are flagged for analyst review before the application is routed.FL-20 FL-21 FL-22 FL-23 Planned Not yet recorded
As a Licensee, I want to submit an amendment request to modify my existing license (such as adding activities, changing premises, or updating ownership), upload supporting documents, and receive a confirmation with an amendment case number, so that my license record accurately reflects my current business operations.FL-98 FL-99 FL-100 FL-101 FL-102 Planned Not yet recorded
As a Licensing Analyst and Division Manager, I want to review submitted license amendment requests, record approval or denial determinations, and have the system automatically update the active license record upon approval, so that license amendments are processed and reflected in the system without manual record updates.FL-55 FL-56 FL-57 FL-58 FL-59 Planned Not yet recorded
As an Owner, I want to complete my owner registration by providing demographic information (race, ethnicity, gender, veteran status, prior convictions), uploading a government-issued photo ID, and optionally uploading fingerprints, so that my owner profile is complete for background screening and equity evaluation.FL-175 FL-176 FL-177 FL-178 Planned Not yet recorded
As an Applicant, I want to add non-owner individuals and entities with a financial interest in my business to the license application, providing their name, contact information, and financial interest percentage, so that DCC has a complete picture of all financial stakeholders before reviewing the application.FL-165 FL-166 FL-167 FL-168 FL-169 FL-170 Planned Not yet recorded
As a Staff Service Manager, I want to generate an Annual Applications Report that lists all license applications submitted for review within a selected date range, filtered by payment status and region, so that I can identify new paid applications ready for processing and track submission volume over time.FL-08 FL-09 FL-10 FL-11 Planned Not yet recorded
As a Compliance Analyst, I want the system to automatically create an electronic complaint file using the DCC naming convention, add attached documents and the complaint worksheet to the file, assign the complaint based on predefined rules (prior relationship first, then workload), and prioritize cases by deadline, so that unlicensed activity complaints are organized and queued for review without manual filing.FC-183 FC-184 FC-185 FC-186 FC-187 Planned Not yet recorded
As a Compliance Analyst, I want to conduct a desk investigation from within the system, complete a pre-filled complaint worksheet, recommend a disposition (Advised, ISB Referral, Outside DCC, No Violation, Not Enough Information, or Refer Enforcement), and have the system route the complaint accordingly with automatic closure where applicable, so that each complaint reaches its correct resolution path without manual case transfer.FC-192 FC-193 FC-196 FC-197 FC-198 FC-199 FC-200 Planned Not yet recorded
As a Compliance Analyst, I want to complete the AGPA review workflow for a licensed complaint, enter a recommended disposition, and route the case for manager review, so that the manager can approve closure, return it to me for correction, or transfer to ISB, and the final action is documented with timestamps at each step.FC-192 FC-193 FC-196 FC-197 FC-198 FC-199 FC-200 Planned Not yet recorded
As a Compliance Staff member, I want to open a pending DCC investigation in the system, input the outcome, mark it complete, and have the system automatically assign it to the supervisor for final review and closure, so that every investigation ends with documented supervisor sign-off and a timestamped closure record.FC-62 FC-63 FC-65 FC-66 Planned Not yet recorded
As a Compliance Staff member, I want to log in and see a dashboard of my pending investigations and team workload by region, update a case status to In Progress, have the system auto-create a named folder and auto-save my entries, pre-fill fields from prior data, add investigator notes and code section selections, and submit the case with supporting documents, so that active cases are managed efficiently with minimal duplicate data entry.FC-30 FC-31 FC-32 FC-33 FC-38 FC-39 FC-37 Planned Not yet recorded
As a Compliance Staff member or Supervisor, I want to generate on-demand reports identifying all licenses associated with an owner, all licenses and owners associated with a business entity, and an entity relationship diagram showing ownership structure, so that I have complete ownership context when conducting or reviewing an inspection case.FC-24 FL-38 FL-39 FL-40 FL-41 Planned Not yet recorded
As an Applicant, I want to complete all extended fields in the General License Application including manufacturing type selection, business activities (extraction, infusion, packaging, labeling), on-site manager contacts, employee count, premises information, tribal land flag, license-specific activity data, and a checklist progress bar, so that my application captures all information required for DCC review before I pay and submit.FL-217 FL-218 FL-219 FL-220 FL-221 FL-222 FL-223 FL-224 FL-225 FL-226 FL-227 FL-228 +24 more Planned Not yet recorded
As an Owner, I want to select whether I am a Person or an Entity owner, have my previously registered information pre-populated, and upload supporting business documents with identified document types, so that my owner registration accurately reflects my ownership type and is complete from the start.FL-396 FL-397 FL-398 Planned Not yet recorded
As an Applicant, I want the system to notify qualifying owners and the Designated Responsible Party to attest to the business entity registration, and to allow a user to provide the registration number of an entity that owns part of the registering business, so that all ownership relationships are confirmed before the entity record is finalized.FL-393 FL-394 FL-395 Planned Not yet recorded
As an Applicant for a Cannabis Event Organizer license, I want to select CEO as the license type, review and update pre-populated DRP and entity information, upload required documents, and pay the application fee, so that my CEO application is complete and routed to the regional supervisor queue.FL-404 FL-405 FL-406 FL-407 Planned Not yet recorded
As a Cannabis Event Organizer Licensee, I want to select Temporary Cannabis Event as the license type, upload event supporting documents, have the system route the application to the correct regional supervisor queue, and receive an analyst-visible flag if my application was submitted within 60 days of the event date, so that late submissions are flagged for expedited review.FL-399 FL-400 FL-401 FL-402 FL-403 Planned Not yet recorded
As a Division Manager, I want to view a list of internal users in my division, assign applications to specific analysts for Business/Ownership Review, Admin Review, and Environmental Evaluation simultaneously, and have the system place each assignment into the respective analyst's pending review queue, so that all review tracks can begin in parallel without sequential dependency.FL-342 FL-343 FL-344 FL-345 Planned Not yet recorded
As a Licensing Analyst, I want the system to automatically identify the Point of Contact for the local jurisdiction and send the verification request email, timestamp and log the outreach on the internal documents tab, and allow me to upload the verification results back into the application record, so that the local verification audit trail is complete and automated.FL-346 FL-347 FL-348 Planned Not yet recorded
As a Licensing Analyst, I want to upload Department of Justice Live Scan fingerprint results to the application record under the internal documents tab, so that background screening outcomes are stored securely and accessible only to authorized internal reviewers.FL-349 Planned Not yet recorded
As a System, I want to send an approval notification with invoice to the DRP when all sections are approved and status is set to Approved-Pending Payment, send a deficiency notification to the DRP when any section is marked deficient, allow managers and analysts to toggle abandonment status, and return the application to the analyst queue with Pending Review status when the applicant responds to the deficiency, so that the approval and deficiency lifecycle is fully automated.FL-350 FL-351 FL-352 FL-353 FL-354 Planned Not yet recorded
As a Licensing Analyst, I want the system to verify the applicant's seller permit against the California Department of Tax and Fee Administration (CDTFA) and display the result, and to allow me to review submitted premises ownership information (rented or owned, with property deed or rental agreement), so that administrative compliance for tax and property is confirmed as part of the admin review.FL-355 FL-356 Planned Not yet recorded
As a Licensing Analyst, I want to amend an existing application under review to switch the license type, invoice local verification checks for the new type, review applicant updates to the change, generate a new application fee, and approve the application upon payment, with the license record updating to Approved-Pending Payment automatically, so that license type changes are fully managed within the system.FL-357 FL-358 FL-359 FL-360 FL-361 FL-362 FL-363 Planned Not yet recorded
As an Applicant, I want to pay my invoice by credit/debit card or e-check by providing my card or bank account details, and as a Cashier I want to search and retrieve a DCC record number and its associated invoice, so that both external and internal payment workflows begin with the correct invoice matched to the correct account.FL-364 FL-365 FL-366 FL-367 Planned Not yet recorded
As an Internal User, I want to retrieve a DCC record, open a paid invoice, add a delinquency of a specified type (Under Payment, Non Payment, etc.) with an amount, fee, and comments, submit it for processing, and have the system update the license status to Delinquent, notify the DRP by email, send automated reminders, and save all communications to the DCC record, so that delinquencies are tracked and enforced systematically.FL-368 FL-369 FL-370 FL-371 FL-372 FL-373 FL-374 FL-375 FL-376 FL-377 FL-378 FL-379 +1 more Planned Not yet recorded
As an Internal User, I want to generate a daily reconciliation report by date range, communicate with payors through the DCC Portal for issues, manually apply payments to invoice records where needed, and upload the daily payment vendor report to the DCC system, so that daily payment activity is reconciled and discrepancies are resolved within the system.FL-381 FL-382 FL-383 FL-384 FL-385 Planned Not yet recorded
As an Internal User, I want to submit a refund request to the Cashiering unit by providing specific refund details such as license number, refund type, amount, and reason, so that refunds initiated internally on behalf of a licensee are processed through the same queue as external refund requests.FL-386 FL-387 Planned Not yet recorded
As an Accounting Staff member, I want the system to send configured Collections Notices to the licensee, send an additional FTB notice when the case is configured for Franchise Tax Board escalation, generate a complete Collections Package (notices, invoices, FTB notice, and legal documentation), and allow me to access a case page showing all existing cases for a licensee, so that the collections process is fully documented and automated.FL-247 FL-339 FL-340 FL-341 Planned Not yet recorded
As a Licensee, I want to submit a Surrender or Withdrawal request through the DCC Portal, and as DCC Staff, I want the system to enforce all business rules (30-day expiration window, Do Not Execute list, address match for replacement), route the request through manager and analyst consent within 3 days, set and execute a configurable surrender date, update the license status, and notify all parties, so that surrenders and withdrawals are executed accurately and on schedule.FL-248 FL-249 FL-250 FL-251 FL-252 FL-253 FL-254 FL-255 FL-256 FL-257 FL-258 FL-259 +19 more Planned Not yet recorded
As a DCC Program Staff member, I want to create a License Case selecting the action type (Suspension, Revocation, App Denial, Cancellation), provide case details and generate or upload an action letter, route it to Legal for review, and have the system execute the action on the specified date, update the license status, send notifications, and auto-reinstate suspended licenses on the Suspension Lift Date, so that all enforcement actions are tracked and executed without manual intervention.FL-277 FL-278 FL-279 FL-280 FL-282 FL-283 FL-284 FL-285 FL-286 FL-287 FL-288 FL-289 +11 more Planned Not yet recorded
As a Licensee, I want to submit a Disaster Relief request and accept terms and conditions, and as a Disaster Relief Team member I want to review, approve or deny it, set active/inactive dates, issue an approval letter, and have the system automatically update the license to Inactive status with notifications, support early reinstatement with fee calculation and payment, and expire the license if not reinstated by the Reactivation Date, so that Disaster Relief is fully managed within the system.FL-291 FL-292 FL-293 FL-294 FL-295 FL-296 FL-297 FL-298 FL-299 FL-300 FL-301 FL-302 +6 more Planned Not yet recorded
As a DCC Program Staff member, I want to create a Renewal Review case for a license, provide referred-by and referred-to POC details, notify the licensee of the hold and the POC upon activation, flag the license record, and have the system automatically update the license status based on whether the hold is lifted before or after expiration, so that renewal review holds are tracked and resolved with automated lifecycle management.FL-308 FL-309 FL-310 FL-311 FL-312 FL-313 FL-314 FL-315 FL-316 FL-426 FL-427 FL-428 +4 more Planned Not yet recorded
As a DCC Team member, I want to retrieve a license or application record, select Submit Appeal Request Approval, have the system extract the current and desired status and Execution Date from the Appeals Approval letter, allow me to adjust the data, save the status change, execute it on the Execution Date, send a confirmation notification to the licensee, and upload all documents to the record, so that approved appeals result in automated status changes with a full audit trail.FL-317 FL-318 FL-319 FL-320 FL-321 FL-322 FL-323 FL-324 FL-433 Planned Not yet recorded
As a Licensee, I want to select Renew License on the DCC Portal, declare any changes or submit Form 226 if changes exist, upload gross revenue documentation, have the system verify owners against DOJ and SOS, check for conflicts, generate a renewal application number, process the renewal through the standard review and payment workflow, and receive configurable renewal reminders, so that my license is renewed accurately with all verifications automated.FL-325 FL-326 FL-327 FL-328 FL-329 FL-330 FL-331 FL-332 FL-333 FL-334 FL-335 FL-336 +9 more Planned Not yet recorded
As a Compliance Staff member or ISB, I want all recall-related interactions with licensees and retailers to be automatically logged, have the ability to add manual override comments at any step, and receive role-based notifications at each major milestone (approval, escalation, closure), so that the recall process is fully auditable and key stakeholders are always informed.FC-90 FC-94 FC-96 FC-93 Planned Not yet recorded
As a Case Administrator, I want the system to generate a unique identifier for each recall or remediation case, create a dedicated profile dashboard housing all recall/remediation information, allow me to sign off on case prioritization, and track real-time recall status through the dashboard, so that every case has a single source of truth with administrator-controlled prioritization.FC-28 FC-174 FC-175 FC-176 Planned Not yet recorded
As a Compliance Staff member, I want the system to separate investigation cases with parent IDs linked to their case numbers, and provide a dropdown menu to select recommended enforcement actions, so that parent-child case relationships are maintained and action recommendations are standardized across all investigation records.FC-06 FC-07 Planned Not yet recorded
As a Compliance Analyst, I want to track the status of each complaint case to ensure it is resolved and closed in a timely manner, and upload supporting evidence documents (screenshots, reports, website captures) directly into the digital complaint file, so that each complaint has a complete documented record from intake to closure.FC-190 FC-191 Planned Not yet recorded
As a System, I want to support bi-directional interfaces with the DCC payment processor, address validation service, Bing Maps, and California ArcGIS, and uni-directional interfaces with Kaseware (case data), Everbridge (notifications), the DCC track-and-trace system, the Google Data Warehouse reporting database, and Franchise Tax Board/Dept. of Child Support, so that all platform integrations are operational and returning correct values.FG-84 FG-85 FG-86 FG-87 FG-88 FG-89 FG-90 FG-91 FG-92 Planned Not yet recorded
As a System, I want to capture and manage account codes and invoice amounts associated with each accounting code across all license and compliance records, so that financial transactions are accurately coded and reportable by account type.FG-58 Planned Not yet recorded
As an Applicant or Licensee, I want to save my application or form at any point and return later to pick up exactly where I left off or navigate back to the beginning, so that I am not required to complete long forms in a single session.FC-21 Planned Not yet recorded
As an ITSD Administrator, I want the system to enforce all DCC-configured password policies including complexity, expiry, reuse limits, forced change on first login, and secure password reset via a Forgot Password feature (no recovery, only reset), with all credentials stored as one-way hashed with random salt, so that user credential security meets OWASP Password Storage and NIST standards.NF-IA-04 NF-IA-05 NF-IA-08 NF-IA-10 NF-IA-11 NF-IA-12 NF-IA-14 NF-IA-15 NF-IA-16 NF-IA-17 NF-IA-18 Planned Not yet recorded
As an ITSD Administrator, I want the system to enforce no shared or guest accounts, no user-level accounts with privilege roles, controlled external system connections, OWASP session management, privilege separation, non-local maintenance MFA, and a session lock that shows a blank public image, so that all access controls meet NIST 800-53b and OWASP guidelines.NF-AC-04 NF-AC-08 NF-AC-09 NF-AC-11 NF-AC-18 NF-AC-19 NF-AC-22 NF-AC-23 NF-AC-24 NF-MA-01 Planned Not yet recorded
As a DCC ISO staff member, I want the system to log all extended audit event types beyond basic login/logout, including role management, data deletion and modification, configuration changes, server lifecycle events, service loading, software changes, system alerts, password changes, sensitive data access, audit log clearing, and application events, with all records including date, time, user ID, event type, source, and outcome, so that security incident investigation has complete coverage.NF-AU-05 NF-AU-06 NF-AU-07 NF-AU-08 NF-AU-09 NF-AU-10 NF-AU-11 NF-AU-12 NF-AU-13 NF-AU-14 NF-AU-15 NF-AU-16 +18 more Planned Not yet recorded
As a DCC ISO staff member, I want the system to continuously monitor internal and external events for attacks, unauthorized connections, and malicious code, provide intrusion detection and prevention, alert administrators on compromise indicators, scan all files for malicious code before use, enforce OWASP input validation and error handling, minimize error information displayed to end users, and centrally log all errors, so that the system is actively defended against threats.NF-SI-01 NF-SI-02 NF-SI-03 NF-SI-04 NF-SI-05 NF-SI-06 NF-SI-07 NF-SI-08 NF-SI-09 NF-SI-10 NF-SI-11 NF-SI-12 +2 more Planned Not yet recorded
As an ITSD Administrator, I want the contractor to perform automated SAST and DAST on every sprint build, produce CVE/CWE reports covering OWASP Top 10 and SANS Top 25, track all verified vulnerabilities in DCC's enhancement tool and POAM, align the SDLC with NIST SSDF, and comply with updated security standards within one year of publication, so that the system is continuously tested for and protected against known vulnerabilities.NF-AM-06 NF-RA-01 NF-RA-02 NF-SA-01 NF-SA-02 NF-SA-03 NF-SA-04 NF-SA-05 Planned Not yet recorded
As a DCC ISO staff member, I want all contractor staff to sign NDAs, complete required security training, and provide fingerprint data for background checks when handling rap sheet data, and as ITSD I want the system to track, document, and report security incidents to designated officials with defined SLAs for Severity 1 incidents and authorized DCC access to all environments for investigation, so that personnel and incident response obligations are fully met.NF-AT-01 NF-AT-02 NF-CF-01 NF-CF-02 NF-IR-01 NF-IR-02 NF-IR-03 NF-IR-04 Planned Not yet recorded
As any user, I want the system to support upload of digital media and scanned documents with OCR processing, and as ITSD I want all data classified by the data owner per DCC ISO policy, all sensitive data encrypted at rest and in transit using FIPS 140-3 AES-256, all structured and unstructured data available to DCC in industry-standard formats, and a maintained Data Dictionary with all tables and fields documented, so that data management and encryption obligations are fully met.NF-DM-01 NF-DM-02 NF-NS-06 NF-NS-07 NF-NS-08 NF-NS-09 NF-SC-06 NF-SC-07 Planned Not yet recorded
As an ITSD Administrator, I want the system to provide automated job monitoring with failure notifications, track document storage usage and performance metrics in monthly M&O reports, conduct and test backups per RTO/RPO objectives, maintain a catalog of all third-party libraries in a private repository, configure the system to provide only essential capabilities with unnecessary ports/services blocked, and display clear user-facing warning and error messages with suggested next steps, so that operational and compliance obligations are continuously met.NF-CM-01 NF-MO-01 NF-MO-02 NF-NS-12 NF-NS-13 NF-TP-01 Planned Not yet recorded
As an Applicant or Licensee, I want to provide an electronic signature on required forms and documents so that it can be filed and reviewed by internal DCC users without requiring a physical signature.FG-66 Planned Not yet recorded
As a System, I want to generate and send reminder notices to the Designated Responsible Party for fee deferral deadlines, generate a summary list of cannabis businesses owned by an applicant on the analyst dashboard, verify that the business entity has been approved for a fee waiver or deferral before proceeding, and notify the DRP of submission timelines prior to auto-abandonment, so that equity applicants are kept informed and processing is accurate.FL-389 FL-390 FL-391 FL-392 Planned Not yet recorded
As any user, I want all external links to open in a new browser window, have access to tooltip instructions for completing application forms, and be able to export data in common formats and upload common file types, so that the interface is intuitive, non-disruptive, and interoperable with standard tools.NF-UI-01 FC-19 FG-76 FG-40 FG-41 FL-134 FL-145 FL-388 Planned Not yet recorded