Abstract The proliferation of fake news presents an emerging and complex cybersecurity challenge in the realm of information systems, with significant implications for security. This study investigates the intersection of fake news and risk management through a Multivocal Literature Review, drawing from academic research, professional practice, and grey literature. The findings demonstrate how fake news acts as a cyber-enabled threat, amplifying risks and complicating decision-making and risk mitigation. Considering the interdisciplinary nature of cybersecurity and modern management, addressing fake news requires integrated strategies that combine technological innovation, policy development, and education. This research emphasizes the importance of proactive prevention, mitigation, and strategic recovery to enhance resilience against information manipulation. By synthesizing diverse perspectives, the study contributes to the broader discourse on data, information, and management security, and advocates for collaborative solutions to strengthen digital trust and organizational integrity. It also identifies key directions for future research, underscoring the need for continuous adaptation in managing the evolving landscape of cyber-enabled disinformation.

Abstract In the context of Information Technology (IT), organizations integrate DevOps to facilitate rapid software delivery; however, mapping the dynamic interrelationship of capabilities, metrics, and processes in practice remains a persistent academic challenge. The current research investigates the relational mechanisms driving successful DevOps adoption. The researchers designed an elaborate single-case study to examine how high-level strategic initiatives influence the complex interplay among technical capabilities, performance metrics, and lifecycle processes. The empirical design applies a qualitative approach grounded in hybrid (abductive) thematic analysis. Established deductive frameworks provided essential baseline constructs, while inductive coding captured emergent organizational phenomena, mitigating the risk of circular reasoning (i.e., confirming a priori assumptions). The researchers employed methodological triangulation by synthesizing 28 semi-structured interviews with longitudinal internal archival documents (DORA metrics), subsequently validating the emergent constructs through an expert focus group to establish a continuous chain of evidence. The synthesized empirical analysis reveals that three specific strategic initiatives functioned as associative enablers during the organizational transformation: (1) a mandated, standardized Continuous Integration/Continuous Delivery (CI/CD) pipeline, (2) a centralized internal service catalog, and (3) a unified cloud-native platform. Archival metrics and interview transcripts mutually indicate these initiatives mitigated the core sociotechnical tension existing between velocity (driven by technical automation) and visibility (demanded by social governance). Grounded explicitly in Sociotechnical Systems (STS) Theory, a revised conceptual framework illuminates how technical tooling and organizational culture do not function in isolation; rather, they operate within a joint-optimization feedback loop. This theoretical model suggests a systemic mechanism for enterprise managers to balance competing sociotechnical priorities during large-scale DevOps transformations.

Context: Many IT organizations are looking towards DevOps to make their software development and delivery processes faster and more reliable, while DevOps revolutionized the industry by emphasizing collaboration between development and operations teams. Nonetheless, there still exist challenges in harmonizing cultural, technical, measurement and process capabilities for its successful adoption. Objective: To research improving DevOps adoption, this study explores DevOps Capabilities relevant to the Life Cycle Processes (LCPs) of the IEEE 2675-2021 DevOps standard. Aiming to provide valuable information on increasing efficiency and outcomes by mapping DevOps Capabilities in each phase of the LCPs. Whereas previous research identified and classified 37 DevOps Capabilities, this study aims to determine which capabilities can enhance each of the 30 phases of the LCPs. Methods: Out of 102 documents identified in the Systematic Literature Review (SLR), relations among DevOps Capabilities and LCPs have been synthesized and organized. An in-depth analysis of data was conducted over the connections across various categories. The mapping revealed how they relate in terms of their application and impact. Results: The SLR shows technical DevOps Capabilities and technical LCPs strongly correlated. DevOps measurement capabilities have a significant impact on agreement processes. Using an impact scale classification, the study identifies eight capabilities that have exceptional impact on LCPs and eleven capabilities that have a very high impact on the supply process, requirements definition, integration process, and validation process. Conclusion: The study demonstrates how DevOps Capabilities together with LCPs can improve software delivery, quality, and reliability. It presents a structured approach for improving processes, as well as evidence of DevOps integration in software development and maintenance. The findings help to assess DevOps Capabilities and LCP relations, which is expected to improve successful adoption. Future research should focus on researching practical cases of DevOps integration into LCPs, while overcoming adoption challenges.

The unstructured conceptualization of the Central Bank Digital Currency and the absence of the systematized language that can be used in the central bank’s research project is instigating ambiguities and mistakes in its understanding. This research study aims to survey the concepts used by researchers and practitioners to describe CBDC design. The research method used in this study is the multivocal literature review and the qualitative document analysis. To select the scientific papers and practitioner’s published documents, we used the inclusion, exclusion, and quality assessment criteria to select 45 studies that covered state-of-the-art and practice research about the conceptualization of the CBDC information system modeling and implementation. The findings reveal that CBDC function, governance, proposal, participant, layer, life cycle, principle, model, access, digital asset, architecture, infrastructure, type, and use case are concepts used to describe CBDC. We propose the CBDC design domain constructs, which can be used by other researchers who are working with CBDC constructs to propose a model, taxonomy, or ontology related to the CBDC domain, by CBDC project experts’ teams to create the CBDC requirement elicitation or CBDC development process methodology, and by central banks to communicate their design choice option to their stakeholders. This research contributes to improve technical language associated with CBDC design, proposing a valuable resource for countries seeking to standardize their design choices and to accelerate collaboration between experts and stakeholders across legal, social, financial, and technological dimensions of CBDC regulation.

Abstract Data and its valuation have gained vital significance in academia and enterprises, coinciding with diverse data valuation approaches encompassing various layers, dimensions, and characteristics. This paper assesses data value determination through a business capability lens based on the TOGAF standard. The paper encompasses (a) constructing a Data Valuation Business Capability (DVBC) taxonomy and (b) validating the taxonomy using two existing data valuation concepts from academia. The methodology involves information systems taxonomy development techniques backed by a previously conducted systematic literature review of 64 articles. The resultant taxonomy comprises four business capability layers, nine dimensions, and 36 characteristics. These layers and dimensions offer business, technology, and organizational perspectives, reflecting the interdisciplinary nature of data valuation alongside an enterprise architecture. Characteristics within these layers and dimensions are either exclusive or non-exclusive based on their contents. The compiled findings meet both objective and subjective quality criteria. The implications of the DVBC are multifaceted, influencing scholars and professionals alike. Scholars gain a cohesive tool enhancing transparency in the extensively debated data value domain, fostering linkages among information systems, enterprise architecture management, and data management. This empowers the progress in developing comprehensive data valuation concepts. Additionally, professionals may employ the DVBC taxonomy as a lighthouse and guiding tool, fostering internal dialog on data valuation. This entails elevating data valuation to a pivotal business capability, necessitating collaborative, regular assessment, and enhancement involving business and technological stakeholders. By adopting this taxonomy, the challenge of consistently determining data value can be effectively addressed in both academia and enterprises.

Context.To meet the demands of customers and market, Information Technology (IT) organizations are seeking to implement DevOps. While many succeed in DevOps adoption, others lack the knowledge on how to incorporate DevOps culture, process, measurements, and techniques in their business. Thus, successful adoption is still inconsistent, highlighting the need to provide management with relevant information to support the development of DevOps Capabilities effectively. But what are these Capabilities? Unfortunately, there is still a lack of clarity about DevOps Capabilities and their relationships to DevOps Practices and Outcomes among researchers and practitioners.Objective.This research aims to gather community consensus on the relationship between Capabilities and Practices, so a better DevOps implementation can be mapped. Seeking to define DevOps Capabilities and Practices concepts and to identify, organize and summarize Capabilities as they relate to Practices.Method.A Multivocal Literature Review (MLR) is conducted, with 93 documents gathered and thoroughly examined from throughout the community, including books, scientific articles, white papers, and conferences, among others.Results.This survey contributes a list of 37 organized Capabilities, their mentions in literature, and their definitions. The concepts of Practices and Capabilities were mapped and categorized in an ordered taxonomy. It is concluded that industry research has much outweighed scientific research on this topic, with Capabilities evolving dynamically over time, reinforcingteam collaboration and communicationas the most crucial one. The study's Outcomes will assist researchers and practitioners understand how Capabilities and Practices are related at different levels and how to better implement them.

Abstract Among current IT work cultures, DevOps stands out as one of the most adopted worldwide. The focus of this culture is on bridging the gap between development and operations teams, enabling collaborative effort toward quickly producing software, without sacrificing its quality and support. DevOps is used to tackle a variety of issues; as such, there are differing benefits reported by authors when performing their analysis. For this research, we aim to reach consensus on the DevOps benefits reported in existing literature. To accomplish this objective, two systematic literature reviews. The first intends to find all benefits reported in the literature, while the second review will be used to map the benefits found in the first one with DevOps implementation case studies, providing empirical evidences of each benefit. To strengthen the results, the concept‐centric approach is used. During this research it was possible to observe that the most reported benefits are aligned with the DevOps premises of better collaboration between developers and operators, delivering software and products quicker. Based on DevOps implementation case studies, most reported benefits include a faster time to market as well as improvements in synergy and automation. Less reported benefits include a reduction in failed changes and security issues.

We propose a staged digital transformation capability maturity model framework that enables organizations to assess their present digital capability and establish a plan of improvements to move to a higher level. It was developed using a design science research approach, building on the ISO/IEC 330xx family of standards to provide structure to a set of digital transformation processes identified using a systematic literature review. At a time when companies look for orientation to navigate their digital transformation, the contribution of this paper is a framework, from a process perspective, rooted in solid scientific concepts, to guide practitioners on how to assess digital transformation initiatives.

Digital Transformation (DT) has a direct impact on relations and forms of consumption. New technologies are being incorporated continuously into our day-to-day life, introducing new shapes for traditional and original kinds of businesses. Nevertheless, it is interesting to notice that most novelty is based mainly on processes, rather than on technology. A DT initiative should start with conceptual modeling to organize and structure knowledge of its scope. However, there is not a specific proper language to model DT initiatives. Based on an extensive literature review, we propose an Ontology - the DI-BPM-Onto - with this purpose. The ontology proposed conceptualizes three aspects: Digital Transformation and Innovation (DT&I), Business Process Management Contextual Factors, and Digital Technology, which are independent layers, but orthogonally related. On the other side, modeling tools like the well-known standard ArchiMate are widely used by companies to provide an unambiguous understanding of their businesses, and already support the description, analysis, and visualization of most enterprise architecture (EA) elements. Therefore, in this paper, to better model DT initiatives, we propose a Reference Model that extending the ArchiMate with the main concepts of DT identified in the DI-BPM-Onto to better model DT&I initiatives and to discuss to what extent ArchiMate would support the implementation of DT&I initiatives. A practical modelling scenario concerning UBER is used to carry out a preliminary evaluation of the proposal.

COBIT 5 is a widely-used framework for implementing sound governance of enterprise IT (GEIT). Despite the existence of official guidance, there are still several challenges that we can encounter. Currently, the ISACA's official implementation solution follows a sequentially ordered process corresponding to a traditional approach, however, organizations are increasingly embracing more agile ones for managing projects where the solution is not clear from the beginning. Using the Design Science Research Methodology, the authors analyse the current state of art and provide a Scrum based methodology for managing at team level a COBIT 5 programme. With a hybrid agile-traditional approach, the authors aim to eliminate some known challenges of COBIT 5, such as lack of support from top management and misaligned scopes and solutions. Additionally, in this paper, the authors present the results obtained from applying the designed methodology in a COBIT 5 programme in the Portuguese Finance Ministry, as well as inspect two series of interviews: 10 performed with experts from both Scrum and COBIT 5 areas to evaluate the solution, and 6 others with the team involved in the demonstration programme, to understand if the objectives where achieved. The article ends with lessons learned, limitations and future work.

Models are perceived as effective tools for stakeholder communication and analysis concerning a given system. Enterprise Architecture assists organizational change with the creation and maintenance of models as a means to mitigate the business-IT misalignment and supporting decision-making regarding the strategic vision of the enterprise. Literature has acknowledged the topic of enterprise architecture evolution as a relevant issue that requires research efforts. In particular, how can enterprise architecture models be used not only for capturing both the current and future states of the enterprise but also as tools for documenting and analyzing the rationale behind an enterprise architecture evolution, thus supporting decision-making and communication. This paper proposes a model-based viewpoint, as an extension of the enterprise architecture model, defining the concepts and relationships that express the evolution-specific concerns with respect to the architecture of the enterprise.

A metamodel is an important aspect of defining a modeling language. It specifies the language’s syntax through a set of constructs as well as how the language models are ought to be composed. Modeling languages, and thus their metamodels, are subject of constant evolution due to changing language requirements as consequence of business changes. Therefore, perceiving the essential aspects responsible for altering the structure of metamodels when a change requirement arises can become an issue. The Enterprise Ontology theory and its methodology (DEMO) provide ontological knowledge about organizations resulting in organizational self-awareness. Applying this methodology to the context of metamodeling can be a starting point for uncovering the essential aspects, i.e., the ontological knowledge regarding metamodel evolution. For that purpose, we modeled two diagrams using the DEMO methodology. The input for both diagrams was a set of coupled operations defined in Herrmannsdorfer’s evolutionary metamodeling research. In the end we stated the main conclusions of our work and themes for future work.

Cloud Computing is revolutionizing the Information Technology (IT) industry by enabling organizations to have flexible costs by buying a service instead of owning their assets. Nevertheless, decision makers (DM) in IT organizations have difficulties in evaluating Cloud services because there are no guidelines or any structured form to decide what Cloud services they should use. In this paper, we propose a model based on a set of criteria to evaluate Cloud services that consists in six groups of thirty measurement criteria. In order to evaluate our proposal we have made demonstrations with Google Apps and Microsoft Office 365. We have also made twelve interviews with clients, suppliers, and experts of Cloud services. The results showed that the model was globally accepted and can help the decision-making about Cloud services.

Organizations are struggling to move and manage their IT Services and/or IT-enabled Services to the Cloud, slowing the adoption of Cloud services. In our research we intend to help organizations adopt Cloud services and demystify fears and concerns. In order to accomplish this, we propose a method based on the Outsourcing Lifecycle and the continuous approach of the Capability Maturity Model Integrated (CMMI) models, resulting in a Cloud Maturity Model. The model allows organizations to know which processes need to be performed, and how they should be improved when moving and managing services in the Cloud. To evaluate the Cloud Maturity Model we performed a set of twelve semi-structured interviews with seven Cloud clients and five suppliers. Although some changes were suggested, the interviews allowed us to conclude that the model was accepted by the interviewees.

Background: Primary Healthcare (PHC) reforms are presently addressing chronic-disease management. It is of importance to science and society to understand how eHealth services could be developed and used to address the challenges of health services integration like community pharmacies within PHC. Method: Focusing on the two initial steps of Design Science Research Methodology, a mixed methods approach was used with an online survey to collect data on use of Information Technologies (IT) in community pharmacy, followed by an exploratory observational time and business processes study, using the shadowing method. Results: The current state of IT usage in Portuguese community pharmacies is mainly focused on medicine dispensing. Pharmacists spend 50% of their time in patients' interactions, 38% on administrative tasks. Patterns of used time reflect a need to internal reorganization of pharmacies in order to enable eHealth pharmaceutical services provision.

Enterprise Architecture (EA) and IT Service Management (ITSM) are two complementary IT governance approaches, with distinct IT and organizational perspectives. Nowadays, ITIL is the de facto standard for implementing ITSM. However, it is still unclear how to measure the value that ITIL brings to organizations. This paper addresses the EA of organizations that use ITIL best practices to perform ITSM, focusing on the modeling and assessment of ITIL value in those architectures. Therefore, this paper's goal is threefold: (1) to find out if ITIL already contains the concepts that are usually needed to represent value, (2) to model these concepts according to an EA point of view and (3) to demonstrate how to use an architecture-based approach to choose between ITIL implementation projects.

ITG has been recognized as a CIO top-10 issue for more than five years and has risen in priority between 2007 and 2009. Several Frameworks exist to help organizations in ITG implementation but lack scientific viewpoint, are complex, and also overlap each other. In this paper we make a literature review to leverage the ITG Contingency factors, ITG general guidelines and main ITG and ITM areas in order to provide a scientific viewpoint validation. Such artefacts are used to build an integrated ITG and ITM framework. We also evaluate our artefacts with expert's interviews in order to provide practitioner viewpoint validation. Finally, we conclude our research with main contributions and future work.

Due to increasing requirements, standards and tight oversight from governments, along with the immediate need to effectively manage the increasing business and operational risks inherent to competing in a complex global market, integrated Governance, Risk and Compliance (GRC) is becoming one of the most important business requirements for organizations. In particular, IT requirements, standards and best practices play a crucial role in IT organizations/departments. The lack of guidance in this domain, namely scientific research, results in unaided attempts to improve efficiency and effectiveness in organizations. In this paper we propose a business architecture that describes the integration of the main processes for IT Governance, IT Risk Management and IT Compliance (IT GRC). Based on a process model for IT GRC and a conceptual model for GRC, we use ArchiMate to model the behavioural, structural and informational structure of the business viewpoint - business processes, roles and business objects respectively. To end with, we discuss the final result and draw some conclusions about the constructed artifact.

Information Technology Infra-structure Library (ITIL) is the most popular “best practices” framework for managing Information Technology (IT) services. However, implementing ITIL not only is very difficult but there also are no best practices for implementing ITIL. As a result, ITIL implementations are usually long, expensive, and risky. In this paper, we propose a maturity model to assess an ITIL implementation and provide a roadmap for improvement based on priorities, dependencies, and guidelines. We then demonstrate a practical application of the proposed model with a questionnaire to assess the ITIL Incident Management process that was evaluated in two real-world organizations.

We propose electronic contract negotiation-a sub-part of the more general area of electronic commerce-as an example application for mobile agents. We start by presenting a set of requirements that an application should fulfil in order to take advantage of mobile agents and show that not all distributed applications meet these requirements. We then present contract negotiation, an example of an application that can potentially take full advantage of mobile agents. The paper also contains an introduction to a mobile agent system being developed at Hamburg University and show how it can be used to implement contract negotiation.

Current RPC mechanisms for persistent languages are either pass by reference-in which case they do not scale-or pass by copy-in which case they duplicate objects and destroy sharing relationships. In this paper we argue that to build very large distributed persistent applications a compromise between these two mechanisms is needed. The ultimate goal of our research is to build a scalable persistent RPC while still maintaining object sharing type safety, type completeness and semantics that are readily understood by application programmers.