Glossary

18F

The US federal government’s digital team (2014–2025), author of a handbook on de-risking government IT contracts. The guide cites its Czech adaptation.Chapter 16: Process and your role

3E (effectiveness, economy, efficiency)

A principle for public money: it should meet the set goal, at the lowest cost for the given quality, and with the best ratio of results to resources spent.Chapter 05: Will it pay off?

8×5 and 24×7 (support hours)

Support 8 hours a day, 5 working days a week, or around the clock, 24 hours a day, 7 days a week. Nonstop support covers 4.2× more hours and costs considerably more.Chapter 21: Support and SLAs

Abnormally low price

A bid price that is suspiciously low for the subject of the contract. The contracting authority must ask for an explanation and may exclude the vendor.Chapter 09: Vendor selection

Above-threshold contract

A public contract above the EU financial threshold (for services for central government, from CZK 3,491,000 excluding VAT in 2026). It has the strictest rules and is also published EU-wide.Chapter 12: Public procurement

Abstraction layer

Your own piece of code between the system and a third-party service, such as an AI model. When you change provider, only this layer changes, not the whole system.Chapter 15: Technology

Acceptance

Formal acceptance of the work or a stage against criteria agreed in advance. Payment, the warranty, and liability for defects all run from it.Chapter 20: Acceptance and launch

Acceptance criterion

A verifiable condition, agreed in advance, under which a requirement counts as met. Acceptance is decided by it, not by impression.Chapter 14: Analysis and scope

Accessibility

Making a website or app usable by people with disabilities too, e.g., blind people using a screen reader or people who can use only a keyboard.Chapter 15: Technology

Accessibility statement

A mandatory document of a public authority under Act No. 99/2019 Coll. stating to what extent its website or app meets accessibility requirements and what does not yet.Chapter 20: Acceptance and launch

Additional work

Work beyond the agreed scope, paid separately. It should not be paid without a signed change order.Chapter 18: Scope changes

ADIS

The automated tax information system the Czech tax administration uses to administer taxes. IBM supplied it under a contract from 1992.Chapter 24: Vendor lock-in

ADR (Architecture Decision Record)

A short record of a technical decision: what was decided, why, and what the alternatives were. It saves a new vendor weeks of investigation.Chapter 15: Technology

Agile development

Development in short cycles (sprints), each ending with a piece of working software. The requirements are refined continuously based on feedback.Chapter 16: Process and your role

AI Act

EU Regulation 2024/1689 on artificial intelligence. It classifies AI systems by risk and imposes obligations mainly on high-risk ones; deadlines keep shifting.Chapter 15: Technology

AI agent

AI that carries out steps in other systems on its own: sends emails, writes to a database, places orders. The more permissions it has, the greater the risk.Chapter 03: A colleague with AI

AI literacy

An obligation under the AI Act to ensure that people who work with AI understand its capabilities, risks, and limitations.Chapter 03: A colleague with AI

Alpha, beta, and live

Phases of UK government service development: alpha tests solutions on prototypes, beta builds the real service for a limited and then wider group of users, live is full operation.Chapter 16: Process and your role

API (Application Programming Interface)

An interface through which systems communicate and exchange data without human intervention.Chapter 15: Technology

App signing keys

Digital keys used to sign a mobile app. Without them, you cannot release an update, so they should be held in your name.Chapter 15: Technology

Auditor General

The top auditor of the Canadian federal government, the counterpart of the head of the NKÚ. Audits how agencies manage money and reports to parliament.Chapter 25: The human factor

Automated tests

Tests that a computer runs instead of a person after every code change. They quickly reveal that a change broke something that used to work.Chapter 22: Maintenance, enhancements

Availability

The share of time the system works, as a percentage per month or year. Without a definition of an outage and a measurement method, it cannot be enforced.Chapter 21: Support and SLAs

AVZ (Public Procurement Association)

A professional association of contracting authorities and public procurement specialists. It published a methodology on how to prevent vendor lock-in and how to get out of it.Chapter 24: Vendor lock-in

AWS (Amazon Web Services)

Amazon’s public cloud, the largest cloud service provider in the world.Chapter 15: Technology

Azure

Microsoft’s public cloud: servers, databases, and other services rented over the internet.Chapter 15: Technology

Backlog

An ordered list of everything that needs to be done. The product owner decides the order; it also contains technical debt items.Chapter 16: Process and your role

Basic registers

The state’s central registers with basic data on people, companies, addresses, and the powers of authorities. Authorities should take data from them, not keep their own copies.Chapter 12: Public procurement

Best Value

A vendor selection method in which quality (team, risks, approach) carries more weight than price. Price usually gets 30%.Chapter 09: Vendor selection

Black swan

A rare event with an enormous impact. For IT projects, a budget overrun of more than 200%, which can threaten the whole organization.Chapter 01: Why it goes over budget

Body shop (staff augmentation)

Renting developers by the hour or day (staff augmentation). Management and responsibility for the result stay with you.Chapter 07: Vendor types

Boy Scout rule

The principle “leave the code a little better than you found it”: whoever touches a module tidies it up a bit along the way.Chapter 23: Technical debt

Budgetary discipline

The obligation to use public money according to the rules under which it was allocated. Breaches are found by audits and lead to repayment and penalties.Chapter 13: Common mistakes

Build

Assembling a runnable application from the source code using scripts. If only the vendor can do the build, you do not fully control the system.Chapter 20: Acceptance and launch

Burn-up chart

A chart in which the line of completed work rises toward the line of total scope. It shows the pace and whether the scope keeps growing along the way.Chapter 17: Meetings and oversight

Business analysis

A description of the organization’s processes, rules, and needs that the software requirements are based on. An analyst does it together with people from operations.Chapter 06: Brief, people, data

Business case

The basis for a decision: why do the project, what it will bring, how much it will cost, and what the risks are. It compares options, including doing nothing.Chapter 05: Will it pay off?

Business continuity

The ability to maintain or quickly restore important activities in a disaster or when a vendor fails. The Cybersecurity Act requires it in contracts too.Chapter 21: Support and SLAs

Buyer profile

The web address where a contracting authority publishes documents for its public contracts and the contracts concluded.Chapter 12: Public procurement

C# and .NET

Microsoft’s C# programming language and .NET development platform. Widespread in enterprise applications, with plenty of developers on the market.Chapter 15: Technology

Case law

Court decisions that have settled how a law is interpreted. Where it is missing, interpretation rests only on the views of legal literature.Chapter 11: Contract and license

Cassation complaint

An appeal to the Supreme Administrative Court against a regional court judgment in an administrative case, e.g., in a dispute with the ÚOHS.Chapter 24: Vendor lock-in

Category A, B, and C defects

Classifying defects by severity: A is critical (prevents acceptance), B is serious (can be worked around), C is minor. Acceptance limits belong in the contract.Chapter 20: Acceptance and launch

CBA (Cost-Benefit Analysis)

All of a project’s costs and benefits quantified in money and compared over time.Chapter 05: Will it pay off?

Centralized procurement

A purchasing approach in which one authority tenders common commodities (paper, energy, IT) for several authorities at once to get better prices.Chapter 02: Buy vs. build

Česko.Digital

A Czech nonprofit and volunteer community that helps the state and the nonprofit sector with digitalization.Chapter 10: Pricing models

Change control

An agreed procedure for how changes are submitted, priced, approved, and recorded. Worth having under every pricing model.Chapter 18: Scope changes

Change order

A document signed by both parties that approves a change, including its price and impact on the schedule. Without it, additional work is not paid.Chapter 18: Scope changes

Change request

A written request to change the scope, with a description, reason, and author. The vendor prices it, and someone with a mandate decides whether to accept it.Chapter 18: Scope changes

Claude Code

An AI tool from Anthropic that writes and edits code directly on the computer based on instructions in plain language.Chapter 03: A colleague with AI

Clickable prototype

A model of the application in which you can click through the screens, but without real logic and data. A cheap way to validate the design with users.Chapter 06: Brief, people, data

Cloud

Computing capacity and services rented over the internet from a provider (Microsoft, Amazon, Google…) instead of your own servers. You pay for what you use.Chapter 15: Technology

Cloud Computing Catalog

A list of cloud services and providers approved by the DIA for public administration. Authorities may use cloud for their systems only from this catalog.Chapter 15: Technology

Code review

A check of the code by another developer before a change is accepted. It catches errors and shortcuts the author does not see.Chapter 03: A colleague with AI

Collection of Deeds

The part of the Commercial Register where companies must file their financial statements and other documents. An unpublished financial statement is a red flag.Chapter 09: Vendor selection

Commercial Register (OR)

A public list of companies with their registered office, statutory representatives, shareholders, and history of changes. Extracts are free at justice.cz.Chapter 09: Vendor selection

Competitive dialogue

A procurement procedure for complex contracts where the authority knows the goal but not the solution: it first works it out with vendors, and only then do they submit bids.Chapter 12: Public procurement

Competitive procedure with negotiation

A procurement procedure in which the authority negotiates with bidders about their bids, and they can improve them. Suitable when the solution cannot be described precisely in advance.Chapter 12: Public procurement

Cone of uncertainty

A chart of how far a cost and time estimate can be off depending on the project phase: up to 4× either way in the idea phase, around 10% after detailed design.Chapter 01: Why it goes over budget

Container

A standard “box” with an application and everything it needs to run. It can run at different providers; the best-known tool is Docker.Chapter 15: Technology

Continuous integration (CI)

A server that builds the application and runs tests and scans on its own after every code change. Errors show up immediately, not at handover.Chapter 17: Meetings and oversight

Contract for work

A contract under which the vendor undertakes to create a work and the customer to pay for it. By itself, it does not include a software license.Chapter 11: Contract and license

Contract modification

In a public contract, any change to the contract after it has been signed. It is governed by Section 222 of ZZVZ; a substantial modification cannot be made without a new procurement procedure.Chapter 18: Scope changes

Contracting authority

The one who awards a public contract: a ministry, region, municipality, state-owned company, or other entity covered by ZZVZ.Chapter 12: Public procurement

Contractual penalty

An amount agreed in advance that a party pays for breaching the contract, e.g., per day of delay. A court can reduce a disproportionately high one.Chapter 19: When it goes wrong

Copyleft license

An open-source license (e.g., GPL) that requires derived software distributed further to be under the same license and with its code published.Chapter 11: Contract and license

Copyright Act

Czech Act No. 121/2000 Coll. It also protects computer programs as copyrighted works and determines who may use the code and how licenses are granted.Chapter 11: Contract and license

Court of Justice of the EU (CJEU)

The court of the European Union in Luxembourg. Its interpretation of EU law, including public procurement rules, is binding on the courts of the member states.Chapter 24: Vendor lock-in

CRA (Cyber Resilience Act)

EU Regulation 2024/2847 on cyber resilience: security requirements for products with digital elements placed on the EU market.Chapter 15: Technology

CRM (Customer Relationship Management)

A system for managing customers, sales opportunities, and communication with them.Chapter 02: Buy vs. build

CSV and JSON

Common open data formats: CSV is a table in a text file (even Excel opens it), JSON is structured data for exchange between systems.Chapter 14: Analysis and scope

Cybersecurity Act

Czech Act No. 264/2025 Coll., in force since November 1, 2025, which transposes the EU NIS2 Directive. It requires regulated organizations to take security measures and report incidents.Chapter 15: Technology

Cybersecurity manager

A role under the Cybersecurity Act responsible for managing security in the organization, including requirements for new systems.Chapter 14: Analysis and scope

Data Act

EU Regulation 2023/2854 on data. Among other things, it gives the right to switch to another cloud provider within set deadlines and abolishes switching fees.Chapter 24: Vendor lock-in

Data anonymization

Modifying data so that it is impossible to tell who it is about. You can safely show an anonymized sample to a vendor or use it for testing.Chapter 06: Brief, people, data

Data migration

Moving data from the old system to the new one, including cleanup and checks. The most commonly underestimated part of a project.Chapter 20: Acceptance and launch

Data model

A description of what data the system stores, how it is organized, and how it relates. Without it, the data is hard to move elsewhere.Chapter 24: Vendor lock-in

Data processing agreement (DPA)

A mandatory contract with a company that handles personal data for you (Article 28 GDPR): what it may do with the data, how it protects it, and when it deletes it.Chapter 07: Vendor types

Data protection officer (DPO)

The person who oversees GDPR compliance in an organization and advises on it. Public authorities and some companies must appoint one.Chapter 14: Analysis and scope

Datlab

Datlab Institute, a Czech analytical organization focused on public procurement. It measured the extent of vendor lock-in in government IT.Chapter 24: Vendor lock-in

Definition of Done

A shared agreement on when a task is really done: tested, documented, and deployable. Without it, “done” is just an opinion.Chapter 16: Process and your role

Delegated access

Access you grant the vendor to an account held in your name, which you can revoke at any time. The account and the data stay yours.Chapter 24: Vendor lock-in

Demo

A demonstration of a finished part of the running software at the end of a sprint, on your test environment, not in a slide deck.Chapter 17: Meetings and oversight

Deployment

Installing a new version of the system into production or a test environment. A well-run team deploys often and in small steps.Chapter 17: Meetings and oversight

Designated information system

A public administration system that uses the basic registers or provides services to them, is linked to them, or serves at least 5,000 users a year with a verified identity.Chapter 12: Public procurement

DIA (Digital and Information Agency)

The central authority for the digitalization of the Czech state. It manages eGovernment, reviews authorities’ IT projects through the OHA, runs the Cloud Computing Catalog, and issues methodologies.Chapter 12: Public procurement

DIA evaluation cards

DIA templates of quality criteria for public IT contracts with described scoring levels, e.g., for the quality of the delivery team.Chapter 09: Vendor selection

Discovery (initial analysis)

A short paid engagement at the start: it maps the problem, users, and risks, and delivers requirements, an estimate, and a prototype. It can also end with a decision not to build.Chapter 08: Approaching the market

Do-nothing option

A comparison scenario of what happens and what it costs if you do not do the project. Without it, every project looks like the only option.Chapter 05: Will it pay off?

Docker

The most widely used container tool: it packages an application with everything it needs so that it runs the same way anywhere.Chapter 15: Technology

DORA (DevOps Research and Assessment)

A long-term research program, now under Google, on what makes software development teams perform well. The metrics of deployment speed and stability are named after it.Chapter 17: Meetings and oversight

Economic rights (copyright)

The rights to use a work and to grant licenses to it. The author cannot transfer them; for an employee work, the employer exercises them, otherwise a license is needed.Chapter 11: Contract and license

Economic rights holder

Someone who exercises the economic rights instead of the author, e.g., the employer for an employee work. May use the work and grant licenses.Chapter 11: Contract and license

Effort breakdown

Breaking a proposal down into individual activities and roles with the number of person-days. It shows what the vendor has accounted for and what it left out.Chapter 08: Approaching the market

eGovernment

Electronic public administration: government services online and interconnected systems, so citizens do not have to carry papers from one office to another.Chapter 01: Why it goes over budget

Employee work

A work an employee creates as part of their job. The employer exercises the economic rights; under Section 58(7) of the Copyright Act, the same applies to a program commissioned directly from its author.Chapter 11: Contract and license

EN 301 549

The European accessibility standard for ICT products and services, which adopts the WCAG rules. Accessibility of public authorities’ websites and apps is assessed against it.Chapter 15: Technology

End of life (end of support)

The date after which the manufacturer stops issuing fixes and patches for a component or platform. Then you need to move to a new version.Chapter 22: Maintenance, enhancements

End-to-end test

A test of a whole process from the user’s point of view across all parts of the system, from input to result.Chapter 20: Acceptance and launch

ERP (Enterprise Resource Planning)

An enterprise system that handles accounting, warehousing, purchasing, production, and HR in one place.Chapter 02: Buy vs. build

Escalation

Passing a problem one level up when it is not resolved at a lower one: from the team to the product owner, to the steering committee, to senior management.Chapter 19: When it goes wrong

Escalation of commitment

The tendency to continue a bad project because a lot of money and reputation have gone into it, instead of deciding based on what it will still cost and bring.Chapter 25: The human factor

Estimated value

An estimate of the price of a public contract excluding VAT, set by the contracting authority in advance (Section 16 of ZZVZ), including options. It determines the threshold and thus the procedure.Chapter 12: Public procurement

Exclusive license

A license that the licensor may not grant to anyone else while it lasts and must itself refrain from using the work, unless agreed otherwise.Chapter 11: Contract and license

Exclusive rights

Rights held by only one vendor (typically copyright), so that no one else can perform. They justify a contract without competition only if the authority did not create them.Chapter 12: Public procurement

Exit package (handover package)

Everything another vendor needs to take over: code, build procedure, documentation, data, access, and licenses. It should be kept up to date and tested once a year.Chapter 24: Vendor lock-in

Exit plan (exit strategy)

An agreed procedure, deadlines, and price for handing the system over to another vendor. It belongs in the contract from the start, not only at the breakup.Chapter 11: Contract and license

Extreme urgency

A ground for a contract without competition when serious harm is imminent and the contracting authority neither caused the situation nor could foresee it. Urgency caused by its own inaction does not count.Chapter 12: Public procurement

Feature freeze

A stop on adding new features so that the team finishes work in progress and stabilizes the system.Chapter 19: When it goes wrong

Fixed monthly fee

A fixed monthly payment for agreed capacity or service, such as a certain number of person-days of support. Unused hours usually expire.Chapter 22: Maintenance, enhancements

Forensic audit

A detailed independent investigation of a project after problems, often as a basis for assigning responsibility.Chapter 19: When it goes wrong

Framework

A ready-made skeleton for building an application (e.g., Spring, .NET, Django, Laravel) that developers build on. It determines who else can develop the system further.Chapter 15: Technology

Framework agreement

A contract with one or more vendors that sets terms and prices for a certain period. Specific contracts are then ordered under it, with several vendors through a mini-competition.Chapter 10: Pricing models

Freelancer

A self-employed developer working alone or with a few colleagues. The entire risk rests on one person.Chapter 07: Vendor types

Gartner

A US research and advisory firm known for its overviews and recommendations for selecting and managing IT.Chapter 02: Buy vs. build

Gateway Review

A UK system of short independent project reviews at key points (Gate 0–5) that assess the level of confidence that the project will succeed.Chapter 25: The human factor

GDPR

The EU General Data Protection Regulation (2016/679). It sets out how companies and authorities may process personal data; violations carry high fines.Chapter 11: Contract and license

GDS (Government Digital Service)

The UK Government Digital Service. It sets standards for government digital services and their phases: discovery, alpha, beta, and live.Chapter 20: Acceptance and launch

GFŘ (General Financial Directorate)

The authority that manages the Czech tax offices and runs the tax information systems, including ADIS.Chapter 24: Vendor lock-in

Git

The most widely used version control system for code. It records every change with its author and date, so you can trace what changed and when.Chapter 24: Vendor lock-in

GitHub Copilot

An AI assistant for developers from GitHub (Microsoft) that completes and generates code as they write.Chapter 03: A colleague with AI

Given / When / Then

A format for an acceptance criterion: the initial state, the user’s action, and the expected result. The vendor can turn it directly into an automated test.Chapter 14: Analysis and scope

Go/no-go

A formal decision at a key point, typically just before launch: is the system ready (go) or not (no-go)? It is made against criteria set in advance.Chapter 20: Acceptance and launch

Google Cloud

Google’s public cloud: servers, databases, AI, and other services rented over the internet.Chapter 15: Technology

Groupthink

A cohesive group with a dominant leader suppresses dissent and reaches unanimity without real discussion.Chapter 25: The human factor

High-risk AI system

An AI Act category for AI that makes decisions about people, e.g., in hiring, education, lending, or access to public services. It carries strict obligations.Chapter 15: Technology

Hosting

Renting servers or space from a provider on which the application runs, including their operation.Chapter 04: True cost (TCO)

Hybrid model

A combination of a fixed framework (budget cap, stages with a decision on whether to continue) and agile development within the stages.Chapter 16: Process and your role

Hypercare

A period of increased support right after launch: a reinforced vendor team, shorter deadlines, and daily meetings on issues. It ends according to criteria set in advance.Chapter 20: Acceptance and launch

ICT

Information and communication technology: computers, software, networks, and telecommunications.Chapter 04: True cost (TCO)

Incident

An outage or error that keeps the system from working as it should. The goal is to restore operation as soon as possible, even with a temporary workaround.Chapter 21: Support and SLAs

Independent review

A critical, independent assessment of a plan or project by someone with no stake in its approval, with the aim of finding weak spots.Chapter 25: The human factor

Independent technical oversight

An independent expert or firm that continuously checks the technical quality and risks of the project on the customer’s behalf.Chapter 17: Meetings and oversight

Information asymmetry

A situation in which one party knows considerably more than the other, typically the vendor knowing more about the system’s flaws than the customer.Chapter 25: The human factor

Information strategy

A document in which a public authority sets out the goals and development plan for its information systems over several years (Decree No. 360/2023 Coll.). The Czech Republic has a national one too.Chapter 12: Public procurement

Infrastructure

The servers, networks, storage, and other equipment the system runs on, whether your own or in the cloud.Chapter 22: Maintenance, enhancements

Insolvency Register

A public list of insolvency proceedings. It shows whether anyone has filed an insolvency petition against a company or its statutory representatives.Chapter 09: Vendor selection

IROP

Integrated Regional Operational Programme: an EU funding program managed by the MMR, which also finances the digitalization of public administration.Chapter 19: When it goes wrong

ISDŘ

The state register for long-term management of public administration information systems. Authorities record their systems in it and apply for OHA opinions.Chapter 12: Public procurement

ISO 27001 and ISO 9001

International standards: ISO/IEC 27001 for information security management, ISO 9001 for quality management. A certificate only makes sense if its scope covers development.Chapter 09: Vendor selection

ISVS (public administration information system)

An information system a public authority uses to carry out its agenda. Act No. 365/2000 Coll. sets obligations for it, e.g., cloud only from the catalog.Chapter 12: Public procurement

ISVZ (Public Procurement Information System)

The state system in which public contracts and their results are published, including the Public Procurement Journal. It is run by the MMR.Chapter 24: Vendor lock-in

Java

A widespread programming language for enterprise, banking, and government systems. There are many developers on the market.Chapter 15: Technology

JavaScript

The programming language of web browsers. It runs in every web application and, through Node.js, on servers too.Chapter 15: Technology

JŘBU (negotiated procedure without prior publication)

A contract without public competition: the authority approaches only a selected vendor. The law allows it only exceptionally, e.g., because of exclusive rights or extreme urgency.Chapter 12: Public procurement

Key person

A vendor person without whom the project cannot proceed, such as the architect or team lead. Named in the contract, replaceable only with your consent.Chapter 07: Vendor types

Key user

A person from operations who will use the system every day. Helps with the requirements, attends demos, and tests.Chapter 16: Process and your role

Kubernetes

A system for running and automatically managing many containers across multiple servers. For smaller systems it tends to be unnecessarily complex.Chapter 15: Technology

Legal succession

The transfer of a vendor’s rights and obligations to another company, e.g., in a merger or sale of the business. In a public contract, it is not a substantial modification.Chapter 18: Scope changes

Library (software)

A ready-made piece of someone else’s code that developers use instead of writing it themselves. It ages and needs updates like the rest of the system.Chapter 22: Maintenance, enhancements

License

Permission to use software to the agreed extent. It is not ownership: what you may do (modify it, hand it to another company, how long you may use it) is set by the license terms.Chapter 11: Contract and license

License assignment

Transferring a license or the exercise of economic rights to another person, for example when switching vendors. The license terms must allow it.Chapter 11: Contract and license

Licensee

The party that has received a license from the author or the rights holder, i.e., permission to use the work to the agreed extent.Chapter 11: Contract and license

Lifecycle

The whole period from acquisition through operation and further development to switching the system off. Costs should be assessed over this entire period.Chapter 04: True cost (TCO)

Line-of-business system

An information system in which a public authority runs a specific agenda (e.g., drivers or buildings) and which should take data from the basic registers.Chapter 12: Public procurement

Linear price scoring

Scoring the price with a simple formula based on its ratio to the other bids. According to the DIA, it leads to extreme bids winning.Chapter 09: Vendor selection

List of assumptions

What the vendor took for granted when calculating the price, for example that the data is clean. If an assumption does not hold, the price changes.Chapter 08: Approaching the market

Logs (event logs)

Records of who logged in when, what they changed, and what errors occurred. Without them, you cannot investigate an incident or prove what happened.Chapter 21: Support and SLAs

Low-code

A platform where applications are assembled from ready-made blocks with little programming. It is fast, but the application runs only on that platform and the license is paid continuously.Chapter 02: Buy vs. build

Lower and higher obligations regimes (cybersecurity)

Two levels of obligations under the Cybersecurity Act. The higher regime, e.g., for critical services, has stricter measures and stricter requirements for vendors.Chapter 21: Support and SLAs

Measure of a general nature

An act of a public authority that applies not to one person but to an indefinite group of addressees. NÚKIB can use it to restrict or ban supplies from certain vendors.Chapter 07: Vendor types

Median

The middle value: half of the values are lower, half higher. Unlike the average, a few extremes do not distort it.Chapter 04: True cost (TCO)

METR

A US nonprofit research organization that measures the capabilities of AI models and their impact on work, including developer speed.Chapter 03: A colleague with AI

MF (Ministry of Finance)

The Czech Ministry of Finance. It manages the state budget and the methodologies for financial control and public purchasing, and oversees the tax administration.Chapter 05: Will it pay off?

Microservices

An architecture in which the system consists of many small independent services communicating over a network. Suitable for many teams, but complex to operate.Chapter 15: Technology

Milestone

An agreed point in the schedule by which a certain part should be done. A payment or a contractual penalty is often tied to it.Chapter 10: Pricing models

Mini-competition

A quick competition among the vendors of a framework agreement for a specific contract. The DIA knowledge base calls it a “minitrh”.Chapter 10: Pricing models

MK (Ministry of Culture)

The Czech Ministry of Culture.Chapter 13: Common mistakes

MMR (Ministry of Regional Development)

The Czech Ministry of Regional Development. Responsible for the public procurement methodology and its information system, building permits, and the IROP funding program.Chapter 12: Public procurement

Modular monolith

A single application internally divided into modules with clear interfaces. Simple to operate, and it can be split later.Chapter 15: Technology

Monitoring

Automated checks of whether the system is running, how fast it responds, and whether it is running out of space or capacity, with alerts when there is a problem.Chapter 21: Support and SLAs

Monolith

An application as a single unit that is developed and deployed all at once. The simplest for smaller systems, but hard to change without internal structure.Chapter 15: Technology

MoSCoW

Sorting requirements by priority: Must (must have), Should (should have), Could (could have), and Won’t (not this time).Chapter 06: Brief, people, data

MPSV (Ministry of Labour and Social Affairs)

The Czech Ministry of Labour and Social Affairs; among other things, responsible for the systems that pay out social benefits.Chapter 13: Common mistakes

MV (Ministry of the Interior)

The Czech Ministry of the Interior. Among other things, it publishes the overview of typical ICT rates and is responsible for some state systems, e.g., the basic registers.Chapter 04: True cost (TCO)

MV overview of typical ICT rates

A regular analysis by the Ministry of the Interior of what public authorities pay for IT work by role under their contracts. Published twice a year.Chapter 04: True cost (TCO)

MVP (Minimum Viable Product)

The smallest version of the system that real users will actually use. It contains only the essential features; the rest comes in later stages.Chapter 14: Analysis and scope

MZe (Ministry of Agriculture)

The Czech Ministry of Agriculture.Chapter 04: True cost (TCO)

MZV (Ministry of Foreign Affairs)

The Czech Ministry of Foreign Affairs.Chapter 04: True cost (TCO)

NAO (National Audit Office)

The UK supreme audit institution, the counterpart of the Czech NKÚ.Chapter 25: The human factor

National architecture (NAR, NAP)

The National Architecture Framework and Plan: rules on how state systems should fit together and share services. The OHA assesses whether a project complies with them.Chapter 12: Public procurement

Native app

A mobile app written separately for iOS and separately for Android. It can use all phone features, but means two codebases and double the cost.Chapter 15: Technology

NDA (Non-Disclosure Agreement)

A confidentiality agreement. References “under NDA” cannot be verified.Chapter 09: Vendor selection

Nearshore and offshore

Development in another country for lower rates: nearshore is close by (e.g., elsewhere in Europe), offshore is far away (e.g., in Asia). Saves on rates, adds management and communication.Chapter 07: Vendor types

Next.js

A framework built on React for websites and web applications that also handles the server side, fast loading, and search engines.Chapter 15: Technology

NFC (Near Field Communication)

Contactless transfer over a few centimeters that a phone uses, for example, to pay or to read the chip in an ID card.Chapter 15: Technology

NKÚ (Supreme Audit Office)

An independent constitutional body that audits how the Czech state manages money and property. It publishes its findings in audit conclusions.Chapter 13: Common mistakes

NKÚ audit conclusion (KZ)

A public NKÚ report on the result of an audit, labeled with the audit number, e.g., KZ 17/24.Chapter 13: Common mistakes

Non-functional requirements

How well the system should work: speed, availability, security, accessibility, backups. They should be stated in numbers and standards, not adjectives.Chapter 14: Analysis and scope

NSS (Supreme Administrative Court)

The highest court in administrative matters. Among other things, it decides cassation complaints in public procurement disputes with the ÚOHS.Chapter 24: Vendor lock-in

NÚKIB (National Cyber and Information Security Agency)

The Czech National Cyber and Information Security Agency. It supervises compliance with the Cybersecurity Act, issues warnings, and can restrict high-risk vendors.Chapter 07: Vendor types

Objections

A vendor’s formal challenge to the contracting authority’s procedure. Filed before a petition to the ÚOHS; until the authority decides on it, it may not sign the contract.Chapter 12: Public procurement

Off-the-shelf software (COTS)

A ready-made product that you buy and configure, the same for all customers (COTS). The opposite of custom development.Chapter 02: Buy vs. build

OHA (Office of the Chief Architect)

The Office of the Chief Architect of eGovernment at the DIA. It issues opinions on authorities’ IT projects and assesses their compliance with the national architecture.Chapter 12: Public procurement

Open data format

A publicly documented format (e.g., CSV, JSON, XML) that common tools can read without the original vendor’s software.Chapter 11: Contract and license

Open procedure

The most common type of procurement procedure: the contract is published and anyone can submit a bid. There is no negotiation on the bids.Chapter 12: Public procurement

Open source

Software with published source code that you may use, modify, and distribute free of charge under its license. The licenses do have conditions that must be followed.Chapter 11: Contract and license

Open standard

A publicly available specification of a format, protocol, or interface that anyone can use, so the solution cannot be locked to one manufacturer.Chapter 15: Technology

Open-weight model

An AI language model whose maker has published the trained parameters (weights). A company can run it on its own server. It is not necessarily open source; the license may have restrictions.Chapter 03: A colleague with AI

OpenAPI

A standard for describing APIs that any vendor and tool can work with. A documented interface shortens onboarding of a new team.Chapter 15: Technology

Operations documentation

A description of how to run the system: installation, backups, recovery, monitoring, contacts. For a designated information system, the administrator submits it to the DIA before launch.Chapter 20: Acceptance and launch

Option

A reserved right to order further deliveries, such as another stage. In a public contract, it must be in the tender documentation (Section 100 of ZZVZ) and in the estimated value.Chapter 10: Pricing models

Out of scope

An explicit list of what the project will not deliver. It is signed together with the specification and protects against disputes over additional work.Chapter 14: Analysis and scope

OutSystems and Mendix

Commercial low-code platforms for business applications. Their price lists are not public.Chapter 02: Buy vs. build

OWASP ASVS

Application Security Verification Standard: a catalog of verifiable security requirements for applications at three levels. It fits directly into a contract.Chapter 15: Technology

OWASP Top 10

A ranking of the ten most common security risks of web applications by the nonprofit OWASP; the latest edition is from 2025.Chapter 15: Technology

P1–P4 (incident priorities)

Incident severity levels from critical (P1, the system is down) to low (P4, cosmetic issue or question). The SLA deadlines follow the priority.Chapter 21: Support and SLAs

Parallel running

A period when both the old and the new system run and are paid for at the same time. Without a date for switching off the old one, it becomes a hidden permanent cost.Chapter 04: True cost (TCO)

Payment per accepted increment

The vendor invoices only finished parts (increments) that you have tested and accepted according to the agreed Definition of Done.Chapter 10: Pricing models

Penetration test (pentest)

A controlled attempt by experts to break into the system like an attacker, so holes are found before a real attack. It should be done by a third party, not the system’s author.Chapter 20: Acceptance and launch

Percentage point

The difference between two percentages: going from 30% to 50% is an increase of 20 percentage points, but of 67%.Chapter 17: Meetings and oversight

Performance test

Verifying that the system can handle the planned number of users and responds fast enough. A load test looks for where it breaks.Chapter 20: Acceptance and launch

Person-day

One day of work by one person, usually 8 hours. The basic unit of estimates and prices in IT.Chapter 04: True cost (TCO)

Peter principle

People tend to be promoted based on their performance in their current role until they reach a role they cannot handle well.Chapter 25: The human factor

PHP

A programming language for web applications and online stores. A large share of websites run on it, e.g., the WordPress content management system.Chapter 15: Technology

Pilot

A live rollout on a limited sample, such as one workplace, before everyone gets the system. Errors show up with little impact.Chapter 20: Acceptance and launch

Planned downtime

A shutdown of the system announced in advance for maintenance. The contract should say whether it counts toward availability.Chapter 21: Support and SLAs

PMI (Project Management Institute)

An international professional organization of project managers. It publishes project management standards and surveys of project success.Chapter 14: Analysis and scope

PostgreSQL

A widespread open-source database for business systems, with no license fees and a large community.Chapter 15: Technology

Power Apps

Microsoft’s low-code tool connected to Microsoft 365. The Premium license is paid per user per month.Chapter 02: Buy vs. build

Preliminary market consultation (PTK)

Non-binding consultation of the market before a public contract (Section 33 of ZZVZ) so the authority can better set the requirements, qualification, and schedule. It must report the results in the documentation.Chapter 12: Public procurement

Premortem

A meeting at which the team imagines the project has already failed and writes down why. Risks get named before they happen.Chapter 25: The human factor

Procurement procedure

The formal procedure under ZZVZ by which a public authority selects a vendor: from launch through submission and evaluation of bids to signing the contract.Chapter 12: Public procurement

Product owner

Your person with the mandate to decide priorities, answer questions, and accept finished parts. The most common brake on a project is when they do not have time for it.Chapter 16: Process and your role

Production (live operation)

The system on which the company’s or authority’s work actually runs, with real data and users. The opposite of a test environment.Chapter 03: A colleague with AI

Project sponsor

A senior manager who pushed the project through, holds its budget, and is accountable for its benefits. Usually chairs the steering committee.Chapter 05: Will it pay off?

Prompt injection

An attack in which someone slips the AI their own instructions, e.g., hidden in a document or email, to make it do something it should not.Chapter 03: A colleague with AI

Proprietary

Closed and owned by a single manufacturer, without public code or a standard. Proprietary services and components are hard to take over or replace.Chapter 24: Vendor lock-in

Pseudonymization

Replacing names and other identifiers with codes that can be traced back using additional information. Unlike anonymization, under GDPR this is still personal data.Chapter 03: A colleague with AI

Psychological safety

A shared belief that in the team it is safe to admit a mistake, ask a question, or say something unpleasant without punishment.Chapter 25: The human factor

PWA (Progressive Web App)

A website that behaves like an app on a phone (icon, notifications, offline work) but does not need an app store.Chapter 15: Technology

Python

A widespread programming language, popular for data analysis, AI, automation, and web applications.Chapter 15: Technology

Qualification requirements (public procurement)

Conditions a vendor must meet to take part in a public contract: experience, turnover, experts. They must be proportionate to the subject of the contract.Chapter 07: Vendor types

Quartile

The value below which a quarter of the values lie (lower quartile), or three quarters (upper quartile). Between them lies the “typical” half of the market.Chapter 04: True cost (TCO)

Randomized controlled trial

An experiment in which chance decides how participants are assigned to groups (e.g., with AI and without AI). The results are therefore less distorted by the choice of people.Chapter 03: A colleague with AI

React

A library from Meta for building the user interface of web applications, now one of the most widely used.Chapter 15: Technology

Records management system

A system for registering, routing, and archiving documents. Public authorities must have one under the Czech Archives and Records Management Act.Chapter 02: Buy vs. build

Refactoring

Changing the internal structure of code without changing its behavior, so that it is easier and cheaper to work with.Chapter 23: Technical debt

Reference class forecasting

Estimating based on a group of comparable completed projects: you adjust your own plan according to how similar projects turned out, not according to your own optimism.Chapter 25: The human factor

Register of beneficial owners

A register of the people who actually own or control a company. Since December 17, 2025, it has not been publicly accessible; ask the vendor for an extract.Chapter 09: Vendor selection

Register of Contracts

The public register of public sector contracts (Act No. 340/2015 Coll.). A contract over CZK 50,000 excluding VAT takes effect only once published; otherwise it is canceled after 3 months.Chapter 11: Contract and license

Regulated entity

A company or public authority that provides a regulated service and must comply with the Cybersecurity Act, under the lower or higher regime.Chapter 15: Technology

Regulated service

A service that brings an organization under the Cybersecurity Act. The criteria are set by an implementing decree.Chapter 07: Vendor types

Repository

Storage for source code with the complete history of changes: who changed what and when. Usually runs on Git.Chapter 17: Meetings and oversight

Reserved change (review clause)

A contract change that the authority described clearly in advance in the tender documentation (Section 100 of ZZVZ), so it may later use it without a new tender.Chapter 18: Scope changes

Response time

How long it takes the vendor to acknowledge a ticket and start working on it. It says nothing about when the system will work again.Chapter 21: Support and SLAs

Responsible authority

The authority or unit responsible for a particular area, such as the law the system is supposed to implement.Chapter 16: Process and your role

Retention

Part of the price that the customer withholds until the end of the warranty or another period as security that the vendor will fix defects.Chapter 20: Acceptance and launch

RFI (Request for Information)

A request for information: you ask the market, without obligation, how it would solve your problem, what ready-made options exist, and roughly what it would cost.Chapter 08: Approaching the market

RFP (Request for Proposal)

A binding request for proposals with described requirements, evaluation criteria, and a deadline.Chapter 08: Approaching the market

Risk register

A list of project risks with probability, impact, mitigation, and owner. It should be reviewed regularly by the steering committee.Chapter 17: Meetings and oversight

Roadmap

A plan for the system’s further development over 12–24 months: which features and changes will come and in what order, based on their benefit.Chapter 22: Maintenance, enhancements

Rollback

Returning the system to its previous working state when a deployment or migration fails. It should be prepared and tested in advance.Chapter 20: Acceptance and launch

RPO (Recovery Point Objective)

How much data you can afford to lose in a disaster, expressed in time, e.g., the last hour of work. It determines how often backups must run.Chapter 21: Support and SLAs

RTO (Recovery Time Objective)

How long recovery after a disaster may take before the system is running again.Chapter 21: Support and SLAs

SaaS (Software as a Service)

Software as a service: you rent the application over the internet, the manufacturer runs and updates it, and you pay a subscription.Chapter 02: Buy vs. build

SAP

A German maker of enterprise systems (ERP) for accounting, logistics, production, and HR, one of the largest in the world.Chapter 02: Buy vs. build

SBOM (Software Bill of Materials)

A list of all components of the system, their versions, and licenses. It helps track vulnerabilities, end-of-life dates, and license risks.Chapter 15: Technology

Scope creep

Gradual, creeping growth of scope: requirements are added bit by bit, verbally and without a price, until there is a whole stage nobody ordered.Chapter 18: Scope changes

Screen reader

A program that reads the screen content aloud to blind users or converts it to Braille.Chapter 15: Technology

Security patch

A small update that fixes a vulnerability. A system without patches is open to known attacks.Chapter 22: Maintenance, enhancements

Security scan

An automated check of the code, the libraries used, and the running application for known vulnerabilities. It typically runs with every build.Chapter 20: Acceptance and launch

Seniority

A developer’s level of experience (junior, mid-level, senior). A senior with a higher rate often costs less overall, needing less time and making fewer mistakes.Chapter 04: True cost (TCO)

Shadowing

A way of handing over knowledge: the new team works alongside the original one and watches how it runs and changes the system before taking over responsibility.Chapter 24: Vendor lock-in

Significant supplier

Under the Cybersecurity Act, a vendor whose performance affects the security of a regulated service. The contract with it has mandatory content.Chapter 07: Vendor types

Simplified below-threshold procedure

A simpler type of procurement procedure for contracts between the small-scale limit and the above-threshold limit, with shorter deadlines.Chapter 12: Public procurement

SLA (Service Level Agreement)

An agreement on service levels: it states in numbers how quickly and how well the vendor will help, and what it will pay if it does not deliver in time.Chapter 21: Support and SLAs

Sound financial management

A principle of Act No. 231/2025 Coll., on Management and Control of Public Finances (from January 1, 2027): handle public money effectively, economically, and efficiently.Chapter 05: Will it pay off?

Source code

A program in readable form, as developers write it. Only with it can the system be modified and rebuilt.Chapter 11: Contract and license

Source code escrow

Depositing the source code with a third party that releases it if the vendor goes bankrupt or fails to perform for a long time. It does not solve vendor dependency by itself.Chapter 24: Vendor lock-in

Spring Boot

A widespread framework for the Java language used to build the server side of enterprise applications.Chapter 15: Technology

Sprint

A short development cycle, usually two weeks, ending with a demo of the finished work.Chapter 16: Process and your role

Staging environment

The last test environment, as close to production as possible, where a new version is verified just before deployment.Chapter 17: Meetings and oversight

State organizational unit

A ministry or other state authority without its own legal personality that manages assets on behalf of the state (Act No. 219/2000 Coll.).Chapter 19: When it goes wrong

Static code analysis

An automated check of code without running it: it looks for complexity, duplication, suspicious spots, and rule violations.Chapter 23: Technical debt

Statutory representative

A person on a company’s statutory body, e.g., a managing director or board member, who acts and signs on its behalf.Chapter 09: Vendor selection

Steering committee

A regular meeting of the customer’s and vendor’s management. It decides on the budget, changes, escalations, and whether the project continues.Chapter 17: Meetings and oversight

Stop criteria

Conditions agreed in advance under which the project is stopped, scaled down, or sent back for approval. They are written at the start, not in a crisis.Chapter 19: When it goes wrong

Strangler fig (incremental replacement)

Gradual replacement of an old system: the new one takes over function by function until the old one can be switched off. Named after the fig that gradually overgrows a tree.Chapter 23: Technical debt

Sub-processor

A company to which your personal data processor passes part of the work with the data, e.g., cloud or hosting. It may be engaged only with your consent.Chapter 11: Contract and license

Sublicense

The licensee’s right to pass the authorization on, for example to another vendor that will develop the system further. Without an explicit clause, you do not have it.Chapter 11: Contract and license

Sunk costs

Money already spent that will not come back, whether or not you finish the project. It should play no role in deciding whether to continue.Chapter 25: The human factor

Super user

A trained colleague at the workplace who helps others with the system and collects their problems for the vendor.Chapter 20: Acceptance and launch

Support hours

The hours during which the vendor accepts and handles tickets. SLA deadlines run only within them; time outside them does not count.Chapter 21: Support and SLAs

Systems integrator

A large IT company that delivers extensive systems and connects them to others, often using its own and third-party products.Chapter 07: Vendor types

SZIF (State Agricultural Interventional Fund)

The state paying agency that pays out agricultural subsidies from EU and national sources.Chapter 22: Maintenance, enhancements

SZR (Basic Registers Authority)

The authority that ran the operation of the state’s basic registers.Chapter 13: Common mistakes

TCO (Total Cost of Ownership)

Total cost of ownership: everything you pay for a system over its entire life, not just the development price.Chapter 04: True cost (TCO)

Team velocity

How much work the team actually completes per sprint. Deadline estimates should be based on it, not on the original plan.Chapter 17: Meetings and oversight

Technical debt

Shortcuts and postponed cleanup in the code that save time today but make every further change more expensive, like interest on a loan.Chapter 23: Technical debt

Tender documentation

The set of conditions of a public contract: requirements, qualification, evaluation criteria, and the draft contract. What is missing from it is hard to add later.Chapter 12: Public procurement

Test coverage

What share of the code actually runs and is verified by automated tests. It does not guarantee quality by itself, but its trend is worth tracking.Chapter 23: Technical debt

Test environment

A separate copy of the system outside production where a new version is shown and tested without risk to real data.Chapter 17: Meetings and oversight

Thoughtworks

An international software and consulting company that regularly publishes the Technology Radar with recommendations on which technologies to use and which to avoid.Chapter 15: Technology

Time and materials (T&M)

Payment for the time actually worked at agreed rates. The customer bears most of the risk, so agree on it with a cap and a monthly report of hours used.Chapter 10: Pricing models

Trial sprint

A short paid engagement (1–2 weeks) in which the finalists of a selection show their work on your real requirements.Chapter 09: Vendor selection

Two-envelope method

An evaluation in which quality is scored first and the price proposals are opened only afterward, so they do not influence the evaluators.Chapter 09: Vendor selection

TypeScript

Microsoft’s extension of JavaScript with data types that help catch errors earlier. Common in larger web applications.Chapter 15: Technology

UAT (user acceptance testing)

User acceptance testing: your key users verify on real scenarios and data that the system can actually be used for work.Chapter 20: Acceptance and launch

Unit and integration tests

Developers’ automated tests: unit tests check small pieces of code, integration tests check how they work together and connect to the database or other systems.Chapter 20: Acceptance and launch

ÚOHS (Office for the Protection of Competition)

Supervises public procurement: decides on vendors’ petitions, can cancel a tender, prohibit performance of a contract, and impose a fine.Chapter 12: Public procurement

User story

A short description of a need in the form “As a [role], I want [what] so that [why].” The basic unit of requirements in agile development.Chapter 14: Analysis and scope

Utilities contracting entity

A contracting entity operating in sectors such as energy, water, or transport. It has higher financial thresholds for its contracts.Chapter 12: Public procurement

Vendor lock-in

Dependency on a single vendor that you cannot leave without disproportionate cost. It arises mainly in the contract, license, documentation, and data.Chapter 24: Vendor lock-in

Verified electronic identity

A verified electronic identity of a person (e.g., an electronic ID card, bank identity, or mobile key) used to log in to online government services.Chapter 12: Public procurement

Vibe coding

Building an application by describing to an AI in plain language what you want while it writes the code. Possible even without programming skills, but a layperson will not spot an error in the code.Chapter 03: A colleague with AI

Vulnerability

A weak spot in software that an attacker can exploit. Manufacturers fix them with security patches.Chapter 22: Maintenance, enhancements

VZMR (small-scale public contract)

A contract for supplies and services up to CZK 3 million excluding VAT. It need not go through a procurement procedure under ZZVZ, but the principles of transparency and equal treatment apply.Chapter 12: Public procurement

Warranty

The vendor’s promise that the work will be free of defects for a certain period; defects during it are fixed free of charge. It does not cover new features or upgrades to new platform versions.Chapter 20: Acceptance and launch

Waterfall

An approach in which everything is first specified, then built, and finally handed over. Problems often surface only at acceptance.Chapter 16: Process and your role

Watermelon report

A report that is green on the outside and red inside: the traffic light says everything is fine even though the project has serious problems.Chapter 17: Meetings and oversight

WCAG (Web Content Accessibility Guidelines)

International web accessibility guidelines. The common requirement is level AA; the current version is 2.2.Chapter 15: Technology

Whistleblower protection

Act No. 171/2023 Coll. protects people who report wrongdoing in a company or public authority from retaliation. Organizations must have an internal reporting system.Chapter 25: The human factor

Work made for hire

A concept of US copyright law: a commissioned work or one created by an employee belongs directly to the commissioning party. Czech law does not work this way; a license must be agreed.Chapter 11: Contract and license

ZZVZ (Public Procurement Act)

Czech Act No. 134/2016 Coll. It sets out how public authorities and other contracting authorities must tender for vendors; the ÚOHS supervises it.Chapter 12: Public procurement

No such term in the glossary yet.