Assessing regulatory change through legal requirements coverage modeling

Abstract

Abstract-Developing global markets offer companies new opportunities to manufacture and sell information technology (IT) products in ways unforeseen by current laws and regulations. This innovation leads to changing requirements due to changes in product features, laws, or the locality where the product is sold or manufactured. To help developers rationalize these changes, we introduce a preliminary framework and method that can be used by requirements engineers and their legal teams to identify relevant legal requirements and trace changes in requirements coverage. The framework includes a method to translate IT regulations into a legal requirements coverage model used to make coverage assertions about existing or planned IT systems. We evaluated the framework in a case study using three IT laws: California's Confidentiality of Medical Records Act, the U.S. Health Information Portability and Accountability Act (HIPAA) and amendments from the Health Information Technology for Economic and Clinical Health (HITECH) Act, and the India 2011 Information Technology Rules. Further, we demonstrate the framework using three scenarios: new product features are proposed; product-related services are outsourced abroad; and regulations change to address changes in the market.

The Implications of ‘Soft’ Requirements

“…Society: this category encompasses social, political and economic values and issues, the implications of which are frequently emergent. Some implications may be implemented in law where legal-oriented requirements have been extensively researched [55]. Society values also impinge on individual choice via social media and cultural influences.…”

The General Data Protection Regulation: Requirements, Architectures, and Constraints

“…Even when such obstacles could be remedied, it should be emphasized that small software development enterprises seldom have the resources to collaborate with lawyers during requirements elicitation-let alone in the whole development process during which stakeholders should be involved in agile software development. Further problems are caused by the fact that like all requirements, also requirements elicited from legal regulations change over time [19]. Stakeholders and users may also have non-regulatory security, privacy, and data protection requirements of their own [20].…”

Mapping legal requirements to IT controls

“…Among the tools that are currently being developed, of note are (a) a visualization tool for the different layers of regulations and how they map to controls, (b) a verification tool to support the coverage model presented by Gordon and Breaux [10], which may be used to determine regulatory coverage for IT organizations.…”