Assurance via workflow+ modelling and conformance

Diskin, Zinovy; Annable, Nicholas; Wassyng, Alan; Lawford, Mark

doi:10.48550/arxiv.1912.09912

Cited by 1 publication

(1 citation statement)

References 16 publications

(28 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Other related approach is enriching assurance cases with extra information. For instance, Workflow+ [29] proposes an approach to model the process and control flow, dataflow (with input-output relationships), and argument flow or constraint derivation. Although the authors do not mention traceability to specific standard requirements or privacy compliance, the approach can be translated to our context.…”

Section: Related Workmentioning

confidence: 99%

Modeling ecosystems of reference frameworks for assurance: a case on privacy impact assessment regulation and guidelines

et al. 2022

View full text Add to dashboard Cite

To assure certain critical quality properties (e.g., safety, security, or privacy), supervisory authorities and industrial associations provide reference frameworks such as standards or guidelines that in some cases are enforced (e.g., regulations). Given the pace at which both technical advancements and risks appear, there is an increase in the number of reference frameworks. As several frameworks might apply for same systems, certain overlaps appear (e.g., regulations for different countries where the system will operate, or generic standards in conjunction with more concrete standards for a given industrial sector or system type). We propose the use of modelling for alleviating the complexity of these reference frameworks ecosystems, and we provide a tool-supported method to create them for the benefit of different stakeholders. The case study is based on privacy data protection, and more concretely on privacy impact assessment processes. The European GDPR regulates the movement and processing of personal data, and, contrary to available software engineering privacy guidelines, articles in legal texts are usually difficult to translate to the underlying processes, artefacts and roles that they refer to. To facilitate the mutual comprehension of legal experts and engineers, in this work we investigate how mappings can be created between these two domains of expertise. Notably, we rely on modelling as a central point. We modelled the legal requirements of the GDPR on data protection impact assessments, and then, we selected the ISO/IEC 29134, a mainstream engineering guideline for privacy impact assessment, and, taking a concrete sector as example, the EU Smart Grid Data Protection Impact Assessment template. The OpenCert tool was used for providing technical support to both the modelling and the creation of the mapping models in a systematic way. We provide a qualitative evaluation from legal experts and privacy engineering practitioners to report on the benefits and limitations of this approach.

show abstract

Section: Related Workmentioning

confidence: 99%