365 non-functional requirements, governed across vendors, through CMS certification.

A state was modernizing its Medicaid data platform as a set of modules from several vendors, all of it headed for CMS certification. Each vendor could show that its own module worked. Nobody owned whether the whole thing met the 365 non-functional requirements for performance, interoperability, scalability, security, and operations, or whether the evidence would stand up to an auditor.

The contract tied key performance indicators and service levels to liquidated damages, so a requirement that could not be measured was a financial risk, not just a quality gap. And the state tracked requirements in Jama while the engineering teams worked in Azure DevOps.

I took the role that sat between architecture, engineering, and the PMO, with one job: make design, implementation, and operational readiness meet CMS, HIPAA, contractual, and data-governance standards, and prove it.

That started with a 372-requirement workshop that gave every non-functional requirement a definition of done, acceptance criteria, and an evidence-based verification method. I defined and governed the KPI and SLA frameworks so each obligation mapped to something measured, and built the executive dashboards the program used in its weekly governance forums.

To keep the state's traceability without slowing engineering, I built a pipeline that produced the requirements traceability matrix from Azure DevOps in the state's Jama format. A master roster standardized staffing, access, and training across the vendor and IBM teams, and a data security and privacy onboarding process made the audit trail start on day one.