1
AgencyRequirements list the documentsName, quantity, and format
(Case study) Public sector · Education・Polish 3D / Polish AI / Polish+
Teachers look up venues and plan teaching itineraries on a single platform
Teachers across Taiwan planning outdoor field trips need to search for venue information and cross-check it. The platform brings outdoor education venues across Taiwan together, so teachers can explore venues on a map, judge distances and plan a teaching itinerary.
(Challenge)
Venue information sits in several systems, and trip planning needs one place to search
Teachers planning outdoor trips have to find time beyond a busy workload to search for venue information, compare options repeatedly and learn from other teachers' experiences and reputations before knowing whether a venue is suitable.
The platform's original focus was building and managing data. Each county and city has its own outdoor education data, and a teacher planning one trip switches between several systems to look things up, so the search and usage flow was the part to be integrated this time.
(Approach)
Learning from commercial platforms and turning the map into a discovery tool
Interviews with teachers showed that outdoor teaching resources are no longer limited to traditional recreation sites. Historical museums, ecological sites and small neighborhood shops can all become suitable resources when the itinerary has educational value.
The team studied commercial trip-planning sites and interviewed front-line educators. The needs that emerged: teachers need to know what a place suits teaching and how close it is to school; too many details, such as highway transit options, make the information complicated; and searching and choosing venues should be as simple as booking a hotel online.
The focus therefore went to a highly customized interactive map that is easy to browse and easy to search.
(Key design)
Three key designs
Interactive map
Users can find and save nearby teaching venues as easily as with a map service, upload and share personal outdoor teaching plans, and discuss classroom situations and how to respond. Venue providers such as museums and farms can list activities for reference.
Desktop
The list and map side by side, with filters updating at once
The venue list sits beside the interactive map and can be filtered by theme, season, facilities, opening hours, fees, transport and school level, and the venues in the list and on the map update accordingly. Zooming in turns numbered clusters into single venues step by step, and the animal mascot at the lower right offers a way to get live help.
Dedicated characters
A series of dedicated animal characters serves as the platform's identity. The characters suit families and draw on successful outdoor-education practice in Europe, the United States and Japan, serving both tourism promotion and venue displays. The forest species that represent land-based education and the marine creatures that symbolize ocean education each have a distinct brushwork, style and body design.
Modular building blocks
The system is split into reusable modules: multi-role login with a permission system, an interactive map template that updates in real time, an automated data editor that takes hundreds of records in one upload and checks the format, and a workflow that combines official-document procedures with agile development. When needs change, modules are adjusted and deployed in priority order, saving communication time and development cost.
(Delivery)
Acceptance follows the requirements document, and operations records are kept
Following the supervising agency's requirements: scans, fixes for medium and high risks, appeals for false positives, and a handover from the design tender to the engineering tender.
Document names and counts are matched word for word before quoting and dividing the work.
Requirements and quote
Performance and maintenance
Acceptance
Agency
Development team
2
Development teamTranscribe into a checklistCompare with the client’s plan; items in none of the three columns move out of scope
3
AgencySupervise and audit periodicallyEnforcement Rules, Article 7
4
Development teamScripts write the maintenance filesIntegrity, logs, monthly report
5
AgencyPreliminary and final acceptanceAcceptance records kept
6
Development teamSubmit under the exact names and quantitiesDocument obligations listed separately
Compiled from the Government Procurement Act, its Enforcement Rules, and the outsourcing provisions of Taiwan’s cybersecurity rules
The development team reads and fixes what the agency's scans report.
- Host vulnerability scanProduces the results
- Someone interpretsHigh false-positive rate
- False positivesAppealOne item at a time
- Medium and high riskPatchBy the development team
For projects with a requirements document and security duties, the first meeting can check the scope item by item.
(Result)
From 5 venues to 60+ new venues in a single week
At the start, only 5 venues had joined the platform. As the platform matured and teachers kept offering design feedback, participation and data uploads rose clearly, reaching 60+ new venues in a single week recently.
The project involved several departments and a more complex chain of decisions, so a new way of working was introduced together with the competent authority. Messages moved to a trackable, categorized collaboration platform, documents moved entirely to online collaborative versions, and task cards made the progress of every change, build and adjustment visible at a glance.
Communication became more efficient, the collaboration culture improved, and the relationship shifted from outsourced vendor to partner team on the platform.
Phone
On a phone, the list comes first and the map opens on demand
On a phone, venues are browsed as a list first. Choosing the map view opens a full-screen map where clusters, name labels and category icons update as it zooms, and the Back to list button at the lower left returns to the list at any time.
(Field notes)
Methods and measurements, open each one
Vulnerability Scanning vs Penetration Testing: Required Frequency and Public-Sector Experience
Scanning lists possible problems; penetration testing shows how far an attack can go
Vulnerability scanning
- Identify the systemsOperating systems, applications, open ports
- Match against a known-vulnerability databaseOutdated versions, missing patches, misconfigurations
- List the findingsHigh false-positive rate; a person has to review the results
Scan results
Penetration testing
- Find likely targetsOften starts from vulnerability scan results
- Chain multiple vulnerabilitiesSimulates a real attack
- See how far it goesHow much access is gained, and whether defenders can detect it
Paraphrased from NIST SP 800-115.
How often the regulation requires testing
| Responsibility level | Vulnerability scanning | Penetration testing |
|---|---|---|
| Level A | All core information and communication systems, twice a year | All core information and communication systems, once a year |
| Level B | All core information and communication systems, once a year | All core information and communication systems, once every two years |
| Level C | All core information and communication systems, once every two years | All core information and communication systems, once every two years |
Delivery and Maintenance Evidence for Public-Sector Projects in Taiwan
Maintenance checks run on a schedule: two weekly, one monthly
Weekly runMonthly output
Month 1Month 2
- IntegrityWeekly, compared with the prior week
- Log digestWeekly, covering the past week
- System reportOne per month
Only the three items with a documented cycle are drawn; the disk-usage alert fires on a threshold and the restore drill is described in the text, so neither is drawn. Position shows frequency only.
After a Vulnerability Scan Report: Triage, Disputing False Positives, and Retesting
The third party scans and retests, the development team classifies and repairs, and the owner confirms in between
Report
Classification
Repair
Retest
Third party
System owner
Development team
1
Third partyScan and test, then issue the reportRun by a qualified third party
2
System ownerReceive the report and pass it to the development team
3
Development teamReproduce each finding and sort it as real or false positiveA reason written for each one
4
System ownerConfirm the classification and any dispute
5
System ownerConfirm this round's scope and what is deferred
6
Development teamFix by exploitabilityKeep before-and-after comparisons
7
Third partyRetest and judge whether each finding passes
8
Development teamExplain each fix and present the evidence
An illustration of roles; the actual division depends on each project's contract and the agency's requirements.
Confirm it is real first, then whether it can be exploited; each finding takes one of three paths
- Reproduce the findingReplay the report's request in a test environment
- Check it against the system's actual configurationWhether version, path, and existing mitigations match the report
- Reproducible and exploitable directly from outsideFix immediatelyKeep a request-and-response comparison from before and after the fix
- Reproducible, but needs specific preconditions or is already mitigatedSchedule for the next roundRecord the preconditions and the basis for deferring
- Not reproducible, or inconsistent with the system's actual configurationFile a false-positive disputeAttach the reproduction steps and configuration evidence
Evaluating a Software Vendor: A Scorecard and Pre-Contract Checklist
The envisioned feature list comes last, and an item-by-item check sets the scope Related method
Read in order
Check item by item
Result
Client materials
Development team
1
Client materialsObligation documentsThird-party duties and audit clauses
2
Client materialsExisting systems
3
Client materialsEnvisioned feature listUsually 1.5–3x a reasonable scope
4
Development teamCheck item by itemRequired, or covered by quotation
5
Development teamMove out of scopeItems with neither
Checking security and operations: track record, retest records, then SLA Related method
- Similar projectsScale and role played
- Scan and retest recordsHow findings were fixed
- SLA in the contract
- All three check outCompare quotes
- No record to showAsk for evidence
SLA terms are agreed per project and belong in the contract.
Taking Over an Existing System: A Full Code Audit from Candidate Findings to a Usable Report
Nearly 10% of about seventy candidate findings were overturned before the report Related method, figures from another project
- Candidate findingsabout seventyMerged from seven parallel scans, each finding verified against the code
- Overturned in rebuttalnearly 10%Mostly patches that earlier developers left on purpose
- Kept for the reportabout sixtySorted into red, yellow, and green
One full audit; figures are approximate
Every finding gets a verdict: fix now, schedule the fix, or keep and record Related method
- Verify against the codeConfirm the problem exists
- Try to overturn itCheck whether it is a patch left on purpose
- It can hurt people, lose data, or invite attackFix nowRated red, with who should fix it and the estimated time
- It carries risk but is not yet redSchedule the fixRated yellow, placed in the maintenance plan after handover
- It looks like a defect but proves to be a deliberate patchKeep and recordWrite down why it must not be removed, so no one fixes it by mistake
The first month sees the current state clearly and handles red findings first, without reworking old problems Related method
Before handover
Audit
Red findings
New code
Customer
Development team
1
CustomerPrepare materialsSource code or access to it, the current deployment method, problems from the last six months
2
Development teamScan, verify, rebutSeven areas scanned in parallel, each finding verified against the code, then deliberately challenged
3
CustomerRead the report and set the orderWho should fix it and the estimated time are written in each red entry
4
Development teamFix red findings firstEach fix comes with a check that fails if it breaks
5
Development teamNew code follows the rulesParameterized queries, ownership checks, signed callbacks
Phases show order, not a fixed number of days
Cross-Ministry Campaign Data: Merging Survey Sheets, Deduplicating Venues, and Designing IDs
Survey sheets are cleaned and validated row by row before import, and the front end and outward-facing documents read the same data Related methodWriting Client Goals into Acceptance: From Requirements to Outcome Indicators
Goals explained at the start move through questionnaire drafts and test tasks to the acceptance presentation and the test result reportFor figures cited in the report, the back-office traffic analysis and exported tables fill in what GA4 does not coverTwo Lines in Long-Term Outsourcing: Contract Terms and Relational Governance
Matters the contract does not cover are handled in a way that fits the type of matterAfter the event ends, analysis and feedback each go back and forth once, and become input for the next year's planningFrom Design Tender to Engineering Tender: How Public-Sector Projects Carry System Knowledge Forward
Data from the existing system has a fallback export prepared in advance, and in the worst case tables can be exported from the back endWhen no ready-made list exists, POLISH sets the rules first, the project team compiles a spreadsheet, and POLISH takes over the processingWriting a Useful SLA: Severity Levels, Consequences and Project-Specific Targets
Whether a service target has a defined consequence for missing it determines if it is an SLA or an SLOThe quotation is split into two columns before signing, so every later report can be classified before it is handledResponding to System Incidents: Reporting, Repair, Notification and Post-Incident Reports
Any one of three conditions escalates a report to an incidentEvery report is logged, owned and closed with a replyRoutine Maintenance After Launch: Handling Reports, Periodic Checks and Maintenance Reports
Every report is logged, assigned to an owner, and closed in the same replyMonthly reports and scans and the annual penetration test run on fixed cycles, each leaving its own recordWhy Systems Need Maintenance After Launch: Software Evolution, Security Updates, and Technical Debt
Post-launch work is first split into routine and exception, and both are entered into the monthly maintenance reportMonthly host scan reports are fixed by the specified deadline, and the project team reports the handling notes to the supervising agencyPOC Beyond the Agreed Scope: Validate the Opportunity First, Then Let the Client Decide on Inclusion
POLISH handles the proposal and validation, and the project team and the supervising agency decide whether it enters the formal scopeOnce the validation results are handed to the client, only two paths remain: inclusion or the existing scopeOn the same topic
(Client note)
The Outdoor Education Resource Platform was fortunate to find the POLISH team to build its website. Throughout the process, they made good use of a range of software tools and guided us step by step through discussing and clarifying the problems. What was especially reassuring is that they went beyond surface issues. Through careful discussion and analysis, they effectively led us to the core problems, which is what made it possible to launch the platform we are so pleased with today.
LaiPlatform PO・NUTCThe first meeting takes 15 to 30 minutes and gives a direction, a budget range and a draft timeline.
Polish 3DPolish AIPolish+Next case: Tower, floor, unit and 360 interior, joined into one viewing path
(Contact)
Start a project.
Three steps to a clear direction and budget range.
- 01Book the first meeting: choose a time. A full specification is not required.
- 02A 15 to 30 minute online consultation: direction, budget range, and draft timeline.
- 03After materials are reviewed, a quote and delivery specification follows in about 3 to 5 working days.
- hello@polish-design.com.tw
- Mailing address
- 3F, No. 191-1, Zhifu Rd., Zhongshan Dist., Taipei 104, Taiwan
Book the first meeting
Monday to Friday, 16:00–18:0030 minutes online
Choose a time, then confirm with a Google account or an email address. A confirmed booking can be added to the calendar.
Choose a time
