Nowadays, the evolution of the information system (IS) is very fast and companies have to manage a very huge amount of sensitive and critical information. Therefore, the information system managers are urged to accurately design their IS and to provide the accurate access rights to this information. In that regards, although the advantage of this strict definition of the IS, we observe that this evolution also tends to reduce and to limit the employees' personal initiatives to act and to behave for the well-being of the company, especially in the case of professional ethical reasons. In this context, this paper takes up the challenge to show to the information security specialists the importance of addressing ethical issues along the management of the access rights and proposes a model-based technical approach to face this problem.

Every year, governments introduce new or revised regulations that are imposing new types of requirements on software development. Analyzing and modeling these legal requirements is time consuming, challenging and cumbersome for software and requirements engineers. Having regulation models can help understand regulations and converge toward better compliance levels for software and systems. This paper introduces a systematic method to extract legal requirements from regulations by mapping the latter to the Legal Profile for Goal-oriented Requirements Language (GRL) (Legal GRL). This profile provides a conceptual meta-model for the anatomy of regulations and maps its elements to standard GRL with specialized annotations and links, with analysis techniques that exploit this additional information. The paper also illustrates examples of Legal GRL models for The Privacy and Electronic Communications Regulations. Existing tool support (jUCMNav) is also extended to support Legal GRL modeling.

Most systems and business processes in organizations need to comply with more than one law or regulation. Different regulations can partially overlap (e.g., one can be more detailed than the other) or even conflict with each other. In addition, one regulation can permit an action whereas the same action in another regulation might be mandatory or forbidden. In each of these cases, an organization needs to take different strategies. This paper presents an approach to handle different situations when comparing and attempting to comply with multiple regulations as part of a goal-oriented modeling framework named LEGAL-URN. This framework helps organizations find suitable trade-offs and priorities when complying with multiple regulations while at the same time trying to meet their own business objectives. The approach is illustrated with a case study involving a Canadian health care organization that must comply with four laws related to privacy, quality of care, freedom of information, and care consent.

Within the context of business processes design and deployment we introduce and illustrate the use of goal models for capturing compliance requirements applicable over business processes configurations. More specifically we explain how a goal-oriented approach can be used together with the ISO/IEC 15504 standard in order to provide a formal framework according to which the compliance of business processes against regulations and their associated requirements can be assessed and measured. The overall approach is discussed and illustrated through the handling of a real business case related to the Basel II Accords on operational risk management in the financial sector.

Developing high quality requirements specifications is a necessity for a number of critical industrial systems. An integrated toolset, called FAUST, is proposed to assist in the production of such specifications based on the KAOS goal-driven methodology. The tool suite is designed to naturally extend the existing semiformal modeling framework and to allow formalizing only the relevant critical parts. Two tools from the toolset are presented. The requirements checker performs KAOS goal-level checks using existing model checking technology. The requirements animator produces domain-level animations hiding formality even further.

Software engineering tools currently available on the market are focused on solution design rather than on problem description. So-called requirement engineering (RE) tools enable companies to manage their requirements only once they got them out. But poor requirements, even well managed, will cause projects to fail. The presentation shows how CEDITI engineers proceed to produce requirements documents with GRAIL, a tool designed by RE practitioners for RE practitioners to enable them to do real requirements engineering. The tool relies on KAOS, the goal-driven requirements methodology. KAOS (Dardenne et al., 1993) advocates for modelling problems in the same flavor as engineers build models to describe solutions but with an appropriate ontology and notation.

The use of a proper data model is a way to introduce rigour in requirements analysis, traditionally considered the most informal stage of software development, and responsible for the more costly errors. Several data models have emerged, but their comparative value is unclear. We think that an appraisal is only possible if the nature — and not only the goal — of requirements analysis is clearly perceived. We investigate this point and emphasise that requirements analysis is an activity of acquiring real-world knowledge, thereby forming a theory in which objectives can be stated and a solution specified. A suited language should thus restrict as little as possible the freedom of expression when describing some part of the world. A number of requirements are derived from this statement, such as the possibility to describe individual objects, as well as groups of objects, to explicitly refer to a global continuous time, to handle undefinedness, to allow simultaneous events, etc. When assessing the various existing data models with respect to these requirements, the entity-relationship model is found a suitable basis, but still lacking essential features. We extend it in a model called ERAE (entity, relationship, attribute, event), which is presented informally and illustrated on examples.

Requirements engineering, the phase of software development where the users' needs are investigated, is more and more shifting its concern from the target system towards its environment. A new generation of languages is needed to support the definition of application domain knowledge and the behavior of the universe around the computer. This paper assesses the applicability of classical knowledge representation techniques to this purpose. Requirements engineers insist, however, more on natural representation, whereas expert systems designers insist on efficient automatic use of the knowledge. Given this priority of expressiveness, two candidates emerge: the semantic networks and the techniques based on logic. They are combined in a language called the ERAE model, which is illustrated on examples, and compared to other requirements engineering languages.