Measurement-oriented comparison of multiple regulations with GRL

Rifaut, André; Ghanavati, Sepideh

doi:10.1109/relaw.2012.6347801

Cited by 9 publications

(4 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In order to handle a set of regulations, we aim to adapt our Hohfeldian meta-model and Legal GRL framework to support the method presented in a related measurement framework [16]. This method uses system-based and performance-based descriptions for the set of regulations to improve the analysis of convergence and divergence between regulations and business processes.…”

Section: Discussionmentioning

confidence: 99%

Legal goal-oriented requirement language (legal GRL) for modeling regulations

Ghanavati¹,

Amyot

Rifaut³

2014

Proceedings of the 6th International Workshop on Modeling in Software Engineering

Self Cite

View full text Add to dashboard Cite

Every year, governments introduce new or revised regulations that are imposing new types of requirements on software development. Analyzing and modeling these legal requirements is time consuming, challenging and cumbersome for software and requirements engineers. Having regulation models can help understand regulations and converge toward better compliance levels for software and systems. This paper introduces a systematic method to extract legal requirements from regulations by mapping the latter to the Legal Profile for Goal-oriented Requirements Language (GRL) (Legal GRL). This profile provides a conceptual meta-model for the anatomy of regulations and maps its elements to standard GRL with specialized annotations and links, with analysis techniques that exploit this additional information. The paper also illustrates examples of Legal GRL models for The Privacy and Electronic Communications Regulations. Existing tool support (jUCMNav) is also extended to support Legal GRL modeling.

show abstract

Section: Discussionmentioning

confidence: 99%

Legal goal-oriented requirement language (legal GRL) for modeling regulations

Ghanavati¹,

Amyot

Rifaut³

2014

Proceedings of the 6th International Workshop on Modeling in Software Engineering

Self Cite

View full text Add to dashboard Cite

show abstract

“…Early work in this area provided an approach to model software artifacts that contributed to compliance, focusing on scenarios where a single artifact alone could not establish compliance [15]. Recently, Ghanavati et al have begun examining requirements engineering modeling and analysis for systems that must comply with multiple regulations [17], [18], [19]. In this paper, we examine legal implementation readiness, which may benefit from an understanding of compliance contributions.…”

Section: Related Workmentioning

confidence: 99%

“…Ingolfo and Silva Souza developed an adaptive approach to legal requirements engineering intended to provide flexibility to requirements for systems that must comply with multiple legal texts in multiple jurisdictions [22]. Rifaut and Ghanavati support measurementbased methodologies for comparing multiple regulations using the Goal-Oriented Requirements Engineering Language (GRL) [19]. We consider multi-jurisdictional concerns to be out of scope for the work presented herein.…”

Section: Related Workmentioning

confidence: 99%

Evaluating Legal Implementation Readiness Decision-Making

Massey

Otto

Antn

2015

IIEEE Trans. Software Eng.

View full text Add to dashboard Cite

Software systems are increasingly regulated. Software engineers therefore must determine which requirements have met or exceeded their legal obligations and which requirements have not. Requirements that have met or exceeded their legal obligations are legally implementation ready, whereas requirements that have not met or exceeded their legal obligations need further refinement. In this paper, we examine how software engineers make these determinations using a multi-case study with three cases. Each case involves assessment of requirements for an electronic health record system that must comply with the US Health Insurance Portability and Accountability Act (HIPAA) and is measured against the evaluations of HIPAA compliance subject matter experts. Our first case examines how individual graduate-level software engineering students assess whether the requirements met or exceeded their HIPAA obligations. Our second case replicates the findings from our first case using a different set of participants. Our third case examines how graduate-level software engineering students assess requirements using the Wideband Delphi approach to deriving consensus in groups. Our findings suggest that the average graduate-level software engineering student is ill-prepared to write legally compliant software with any confidence and that domain experts are an absolute necessity.

show abstract

“…Automated methods, such as ReqSimile, can analyze sets of requirements and calculate similarity scores based on metrics such as word frequency or phrase structure [21]. This can also be achieved through goaloriented requirements language methodologies, such as those employed by Rifaut et al [26]. The metrics used for regulatory comparison in the water marking framework measure terms and phrases from each requirement that conceptually subsume those found in other requirements, as well as modality differences (may, shall, should) [2].…”

Section: Related Workmentioning

confidence: 99%

The regulatory world and the machine: Harmonizing legal requirements and the systems they affect

Gordon

2013

2013 21st IEEE International Requirements Engineering Conference (RE)

View full text Add to dashboard Cite

The past decade has seen a substantial increase in the issuance of privacy and security regulations governing personal information. Ensuring system and organizational compliance is both more important and more difficult than ever before, as the penalties have become more severe, and regulations more complex and nuanced. This also presents substantial difficulties for multi-national companies, as different states, countries, or regions do not adhere to a uniform standard, resulting in a mixed set of regulations for the systems they govern. In this work, I describe a framework to address this issue, referred to as requirements water marking, wherein requirements from different jurisdictions that govern the same system may be evaluated and reduced to a single standard of care, establishing a "high water mark" for regulatory compliance and reducing requirements complexity. The framework, which draws on work in requirements specification languages and requirements comparison, allows engineers and legal experts to systematically simplify compliance and determine both high and low standards of care, while maintaining traceability back to the original legal text. In addition, I investigate the proposed value of legal requirements models, demonstrating the relationship between proposed value of these models to organizational decision-making and the validity of the model.

show abstract

Measurement-oriented comparison of multiple regulations with GRL

Cited by 9 publications

References 23 publications

Legal goal-oriented requirement language (legal GRL) for modeling regulations

Legal goal-oriented requirement language (legal GRL) for modeling regulations

Evaluating Legal Implementation Readiness Decision-Making

The regulatory world and the machine: Harmonizing legal requirements and the systems they affect

Contact Info

Product

Resources

About