Case study
Redesigning a national cyber service without making users relearn everything
DSPT, CAF, and the product discipline of continuity under institutional change
Redesigning a live public service is difficult even when the interface is stable. Redesigning one around a major framework shift is harder: users still need orientation, confidence, and continuity while the conceptual model beneath them changes.
A redesign sounds clean in planning language. New framework. New structure. Updated product. In reality, this one started with a more uncomfortable question: how do you change a trusted national service without making people feel they have to learn it from scratch?
For users, framework transitions are interpretation events — the product has to answer what changed, what stayed stable, and what can still be trusted.
The Data Security and Protection Toolkit was already established and used at scale. At the same time, the underlying reference point was shifting from the National Data Guardian Standards toward the Cyber Assessment Framework. That was not cosmetic. It changed how assurance needed to be framed and interpreted.
For users, framework transitions are interpretation events. They ask practical questions: what changed, what stayed stable, and what can still be trusted? If the product cannot answer clearly, uncertainty spreads fast.
Discovery here was less about feature ideation and more about assumption exposure. Stakeholder workshops and Lean UX Canvas work helped surface where confusion risk was highest, and where continuity was non-negotiable.
Research, prototype testing, and playback shaped direction, but this was not a context for purely incremental release. A larger coordinated change made more sense than parallel partial states that would have produced competing interpretations.
The NHS design system helped preserve familiar interaction patterns and legibility while deeper structural shifts happened underneath. That familiarity was not conservatism. It was risk control.
This reinforced a principle I now carry into products like Restormel and SOPHIA: continuity is often part of quality. Good change protects user confidence while improving system integrity.