Climate change calls for action from all sectors of our global economy, including ICT. Therefore, it is important to change the way we develop software to address the challenges posed by sustainability. Our goal is to contribute with a reusable sustainability requirements catalogue that helps developers be aware of sustainability-related properties worth considering during software development. The information for this catalogue was gathered via a systematic mapping study, whose results were synthesised in feature models and then modelled using iStar for a more expressive and configurable representation. A qualitative evaluation of the catalogue’s readability, interest, utility, and usefulness by 50 participants from the domain, showed that around 79% of the respondents found the catalogue “Good” or “Very Good”. However, more than 5% of the expert participants found weaknesses regarding most of the evaluated questions and around 25% are neutral in their overall evaluation. This led us to evolve the initial version of the catalogue for the social and technical dimensions of sustainability to improve its completeness and usefulness. This is achieved by aligning the information gathered in the systematic mapping study with the well-established quality model of the ISO/IEC 25010:2011, as we expect most of the experts are familiar with those qualities and respective hierarchies. During this process, we found information that led us to propose two additional qualities that were not covered by the ISO standard: fairness and legislation. We applied this evolved version of the catalogue to the U-Bike project comparing the requirements elicited without the catalogue with those identified using the catalogue. The result suggests that new sustainability requirements were worth considering from a sustainability point of view, supporting the usefulness of the catalogue.

Managers rarely have deep knowledge of cyber security and yet are expected to make decisions with cyber security implications for software-based systems. We investigate the decision-making conversations of seven teams of senior managers from the same organisation as they complete the Decisions & Disruptions cyber security exercise. We use grounded theory to situate our analysis of their decision-making and help us explore how these complex socio-cognitive interactions occur. We have developed a goal-model (using iStar 2.0) of the teams’ dialogue that illustrates what cyber security goals teams identify and how they operationalise their decisions to reach these goals. We complement this with our model of cyber security reasoning that describes how these teams make their decisions, showing how each team members’ experience, intuition, and understanding affects the team’s overall shared reasoning and decision-making. Our findings show how managers with little cyber security expertise are able to use logic and traditional risk management thinking to make cyber security decisions. Despite their lack of cyber security–specific training, they demonstrate reasoning that closely resembles the decision-making approaches espoused in cyber security–specific standards (e.g., NIST/ISO). Our work demonstrates how organisations and practitioners can enrich goal modelling to capture not only what security goals an organisation has (and how they can operationalise them) but also how and why these goals have been identified. Ultimately, non–cyber security experts can develop their cyber security model based on their current context (and update it when new requirements appear or new incidents happen), whilst capturing their reasoning at every stage.

Context: User stories are often used for elicitation and prioritisation of requirements. However, the lack of a widely adopted user story template, covering benefit and the usage (or not) of a persona, can affect user stories’ quality, leading to ambiguity, lack of completeness, or accidental complexity. Objectives: Our goal was to analyse the differences between 4 alternative user story templates when creating and understanding user stories. Methods: We conducted a quasi-experiment. We asked 41 participants to perform creation and understanding tasks with the user story templates. We measured their accuracy, using metrics of task success; their speed, with task duration; visual effort, collected with an eye-tracker; and participants’ perceived effort, evaluated with NASA-TLX. Results: Regarding the impact of the different templates in creating user stories, we observed statistically significant differences in some of the metrics for accuracy, speed and visual effort. For understanding user stories, we observed small differences in terms of visual effort. Conclusions: Although some templates outperformed others in a few metrics, no template obtained the best overall result. As such, we found no compelling evidence that one template is "better" than the others.

Context: Recent research has shown gender differences in problem-solving, and gender biases in how software supports it. GenderMag has 5 problem-solving facets related to gender-inclusiveness: motivation for using the software, information processing style, computer self-efficacy, attitude towards risk, and ways of learning new technology. Some facet values are more frequent in women, others in men. The role these facets may play when building social goal models is largely unexplored. Objectives: We evaluated the impact of different levels of GenderMag facets on creating and modifying iStar 2.0 models. Methods: We performed a quasi-experiment. We characterised 100 participants according to each GenderMag facet. Participants performed creation and modification tasks on iStar 2.0. We measured their accuracy, speed, and ease, using metrics of task success, time, and effort, collected with eye-tracking, EEG and EDA sensors, and participants' feedback. Results: Although participants with facet levels frequently seen in women had lower perceived performance and speed, their accuracy was higher. We also observed some statistically significant differences in visual effort, mental effort, and stress. Conclusions: Participants with a comprehensive information processing style and a more conservative attitude towards risk (characteristics more frequently seen in women) solved the tasks with a lower speed but higher accuracy.

We use Grounded Theory to study the evolution of requirements practices of 16 software startups as they grow and introduce new products and services. These startups operate in a dynamic environment, with significant time and market pressure, and rarely have time for systematic requirements analysis. Our theory describes the evolution of practice along six dimensions that emerged as relevant to their requirements activities: requirements artefacts, knowledge management, requirements-related roles, planning, technical debt and product quality. Beyond the relationships among the dimensions, our theory also explains the turning points that drove the evolution along these dimensions. These changes are reactive, rather than planned, suggesting an overall pragmatic lightness, i.e., flexibility, in the startups' evolution towards engineering practices for requirements. Our theory organises knowledge about evolving requirements practice in maturing startups, and provides practical insights for startups' assessing their own evolution as they face challenges to their growth. Our research also suggests that a startup's evolution along the six dimensions is not fundamental to its success, but has significant effects on their product, their employees and the company.

Context: i* is one of the most influential languages in the Requirements Engineering research community. Perhaps due to its complexity and low adoption in industry, it became a natural candidate for studies aiming at improving its concrete syntax and the stakeholders' ability to correctly interpret i* models. Objectives: We evaluate the impact of semantic transparency on understanding and reviewing i* models, in the presence of a language key. Methods: We performed a quasi-experiment comparing the standard i* concrete syntax with an alternative that has an increased semantic transparency. We asked 57 novice participants to perform understanding and reviewing tasks on i* models, and measured their accuracy, speed and ease, using metrics of task success, time and effort, collected with eye-tracking and participants' feedback. Results: We found no evidence of improved accuracy or speed attributable to the alternative concrete syntax. Although participants' perceived ease was similar, they devoted significantly less visual effort to the model and the provided language key, when using the alternative concrete syntax. Conclusions: The context provided by the model and language key may mitigate the i* symbol recognition deficit reported in previous works. However, the alternative concrete syntax required a significantly lower visual effort.

Requirements Engineering (RE) approaches, following paradigms such as goal-oriented [1] or scenario-based [2], provide expressive model elements for requirements elicitation and analysis. However, these approaches are still struggling when it comes to managing the quality of their models. Problems in quality can cause difficulties in anaging and understanding requirements, which in turn leads to increased development costs. The models' quality should then be a permanent concern. We propose a quantitative assessment of the goal-oriented and scenario-based models' quality, namely its complexity, completeness, appropriateness recognizability, understandability and learnability. To this end, we propose a combination of techniques to be applied to the RE models, the modelling process, and the models' notation. We are going to define metrics about the models, through the Goal-Question-Metric (GQM) approach, and incorporate them in a common evaluation framework that helps in the requirements modelling process. The quality of the RE models, the modelling process and the model's notation will be measured by collecting biometric data from stakeholders, by using eye-tracking devices, electroencephalography (EEG) scanners, and electro-dermal activity (EDA) scanners. Furthermore, we will collect metrics about the model during the modelling process, and the subjective opinion of stakeholders about the usage of these models, through questionnaires like NASA TLX [4] (which measures perceived effort while working on tasks). All metrics and biometrics are going to be theoretically and experimentally evaluated, through a set of case studies and experiments with different types of participants (including researchers, practitioners and students).

The i* community has published guidelines, including model layout guidelines, for the construction of models. Our goal is to evaluate the effect of the layout guidelines on the i* novice stakeholders' ability to understand and review i* models. We performed a quasi-experiment where participants were given two understanding and two reviewing tasks. Both tasks involved a model with a bad layout and another model following the i* layout guidelines. We evaluated the impact of layouts by combining the success level in those tasks and the required effort to accomplish them. Effort was assessed using time, perceived complexity (with NASA TLX), and eye-tracking data. Participants were more successful in understanding than in reviewing tasks. However, we found no statistically significant difference in the success, time taken, or perceived complexity, between tasks conducted with models with a bad layout and models with a good layout. Most participants had little to no prior knowledge in i*, making them more representative of stakeholders with no requirements engineering expertise. They were able to understand the models fairly well after a short tutorial, but struggled when reviewing models. In the end, adherence to the existing i* layout guidelines did not significantly impact i* model understanding and reviewing performance.