ABSTRACT Cybersecurity is a critical global concern, particularly for small‐ and medium‐sized enterprises (SMEs) with limited resources and expertise. The authors are developing CyberESP, a tailored cybersecurity framework supported by a semi‐automated tool to ensure Spanish SMEs' cybersecurity management. Following the Design Science Research (DSR) methodology and grounded in international standards, the authors identified six requirements to be satisfied by a cybersecurity framework for SMEs, which should support the identification of assets, vulnerabilities, threats, and risks. This paper presents the first part of the CyberESP framework dealing with asset management, particularly their identification and analysis of dimensions and cost. A prototype supporting these activities was developed and validated through a case study in a retail SME, showing the solution's potential and identifying particular improvements. The paper also addresses threats to validity and limitations, noting the framework's focus on hardware, software, and networks. Future work includes vulnerability management and will explore the use of cloud and IoT deployment, positioning CyberESP as a practical solution to enhance SMEs' cybersecurity resilience.

Cybersecurity continues to be one of the principal issues in the computing environment. Organizations and researchers have made various efforts to mitigate the risks of cyberspace. The treatment of cyber risk is a fundamental stage in risk management. In the risk treatment stage, countermeasures are carried out to reduce the probability of risk materialization. This article presents a systematic mapping review of the principal catalogues/taxonomies of countermeasures applied in cybersecurity, involving studies between 2010 and 2021. Seventy-four (74) studies were assessed, and 25 studies were selected for further analysis. We identified 26 catalogues/taxonomies used to address cybersecurity-related risks. After analyzing these 26 catalogues/taxonomies, we identified: (1) the related trends, (2) the type of risks and sectors that these catalogues/taxonomies focus on, (3) the complexity of these taxonomies, and (4) what mentions they make about residual risk. We have identified that institutional taxonomies, which were not created for cybersecurity risks, are fitted for this purpose. The predominant risks in these taxonomies are those related to awareness and cyber-attacks. We note that the complexity of the catalogues/taxonomies is defined by the number of taxa and the number of countermeasures. Another relevant result is the lack of complexity in non-institutional catalogues/taxonomies. Finally, we have identified a lack of relevant information on residual risk in the studies.

Small‐sized software enterprises have tried for years to make major changes to improve the software development process and, consequently, the quality of their products. Many small companies are focusing their efforts on conducting software process improvement (SPI) initiatives to mature their software processes and to deliver products on time and on budget. Nevertheless, these initiatives are not always successful because human factors are still difficult to control leading to a high failure rate due to lack of involvement and motivation. Gamification can be used to motivate staff and increase participation and commitment to improve the chances of success when an SPI initiative is conducted in these companies. In this study, a gamification strategy was designed to add game‐like elements into the GamiSPI tool for supporting SPI activities. Significant research has been carried out, but the authors’ approach aims to apply gamification in a distributed way by enabling employees from different enterprises to share information and knowledge, combine efforts, support communication, and collaborate with others toward common improvement goals. The effects of gamification were assessed using quantitative and qualitative methods to show that this strategy can increase the involvement, motivation, and ambition of the participating staff.

Abstract Information technology infrastructure library (ITIL) framework is a set of comprehensive publications providing descriptive guidance on the management of IT processes, functions, roles, and responsibilities related to IT service management. However, and in spite of its repercussion and popularity, the ITIL framework does not suggest an implementation order for their processes. This decision constitutes the first challenge that an organization must overcome when starting an ITIL implementation, the enterprise size being one of the leading factors to be considered in the decision‐making process. In the scenario of small and medium enterprises dedicated to producing software, this paper is devoted to investigating which processes are the most selected to start the implementation of ITIL in these organizations. This is performed by means of two different instruments, first, a systematic literature review on the topic and second, a survey conducted among experts and practitioners. Results show in both cases that incident management process should be the first process when implementing ITIL framework. Copyright © 2015 John Wiley & Sons, Ltd.

Nowadays, the demand for higher quality in software products causes the increased complexity of these products. These two aspects (quality and complexity) combined with productivity are key elements for improving the competitiveness between software companies and differentiating success from failure in the software industry. In this sense, software reuse, and requirements reuse in particular, has been widely recognized as an effective way to improve software quality and productivity. In this paper, we propose a model to reuse the software requirements in a Requirements Catalog. This research aims to define the guidelines to carry out the requirements reuse process through four principal activities: searching, selecting, adapting, and implementing. Also, the commercial tool Computer-Aided Requirements Engineering Rational RequisitePro was tailored to make feasible the implementation of the proposed model; in this sense, a tool plug-in was developed. Finally, a case study is presented to demonstrate the feasibility of the proposed model. Copyright © 2014 John Wiley & Sons, Ltd.

ABSTRACT Most organizations that use the Capability Maturity Model Integration (CMMI) stop their process improvement journey at Maturity Level 3 or less. The discussion about CMMI high‐maturity levels has always been controversial, going most of the times through the consideration of return of investment, provider selection, and interpretation issues. Achieving Level 5 is not an easy task; it derives a lot of steps during the way. This article will show an example of the implementation of Level 5 in a consultancy company in two constellations: development and service. It depicts the example in steps, to help the understanding of the whole process. Copyright © 2014 John Wiley & Sons, Ltd.

ABSTRACT Starting from the documentation of high sprint velocity fluctuations in a Scrum project, this paper presents a thorough approach to identify the sources of issues arising in the context of Scrum implementation. Given that Scrum provides guidance on identifying process issues but not their root causes, various approaches are explored. This is of great relevance because Scrum defines project schedules relying heavily on sprint velocity and because it is the most widely used agile methodology. The findings provide a new approach to evaluate such fluctuations and establish a more realistic project assessment than what is currently defined by Scrum. In this respect, this paper contributes to improve the understanding of the software development process using this agile framework. Copyright © 2014 John Wiley & Sons, Ltd.

Currently, software acquisition is strategic for organizations. Companies need support to succeed in software acquisition projects because such projects commonly present high failure rates. To solve this problem, it is necessary to design mechanisms for software acquisition, such as risk classification to identify the typical risks that may affect the success of a software acquisition project. Thus, herein, we present a case study, showing the implementation of a risk taxonomy whose structure is designed using a method for its construction, with a mechanism to reduce the risk of acquisition projects that adversely affect their success.

SUMMARY This paper describes a multi‐model methodology that implements a smooth and continuous process improvement, depending on the organization's business goals and allowing users to establish their improvement implementation pace. The methodology focuses on basic process components known as ‘best practices’. Besides, it covers following the topics: knowledge management and change management. The methodology description and the results of a case study on project management process are included. Copyright © 2010 John Wiley & Sons, Ltd.

SUMMARY Top‐down process improvement approaches provide a high‐level model of what the process of a software development organization should be. Such models are based on the consensus of a designated working group on how software should be developed or maintained. They are very useful in that they provide general guidelines on where to start improving, and in which order. However, the majority of them have only worked in scenarios within large companies. We aim to help small software development organizations to adopt an iterative approach by providing a Process Improvement Web‐based Tool (SysProVal). This paper presents research into the proposal that a small organization may use this tool to define and implement a set of project management practices that can be strengthened using the CMMI‐DEV 1.2 model as reference. Copyright © 2010 John Wiley & Sons, Ltd.

This paper presents a case study that describes TSPi teaching (Introduction to the Team Software Process) to 4th year students, grouped by teams, at the Computer Science School, Polytechnic University of Madrid (UPM). The achievements of the teams, due to training and the use of TSPi, were analyzed and discussed. This paper briefly discusses the approach to the teaching and some of the issues that were identified. The teams collected data on the projects developed. They reviewed the schedule and quality status weekly. The metrics selected to analyze the impact on the students were: size, effort, productivity, costs and defects density. These metrics were chosen to analyze teams' performance evolution through project development. This paper also presents a study related to the evolution of estimation, quality and productivity improvements these teams obtained. This study will prove that training in TSPi has a positive impact on getting better estimations, reducing costs, improving productivity, and decreasing defect density. Finally, the teams' performance are analyzed.

Team Software Process is an integrated framework that guides development teams in producing high-quality software-intensive systems. This paper analyzes the effects of TSPi training and the improvements achieved by 44 teams, comprising fourth-year students on the software engineering degree programme, corresponding to two academic years. This study shows the benefits of using defined models such as TSPi to improve the students’ skills and knowledge. The metrics of size and effort estimation, defects, productivity and costs are collected to measure the improvements through two development cycles.