“…In particular, being a goal-oriented methodology, 12-14 GOReM allows to suitably derive the requirements from the analysis of (i) the goals of the involved stakeholders, (ii) the business scenarios, and (iii) the expected applications' models.*This paper is an extended version of the In addition, the methodology uses the graphical UML notation, which allows an easier process of communication and sharing among stakeholders.GOReM has already been successfully employed in the past in the context of industrial research projects, involving industrial partners such as ACI Informatica 15 and Poste Italiane, 16 and its practical application allowed to highlight and identify some interesting aspects during the requirements engineering phase. 17,18 In this paper, GOReM is exploited for supporting the conceptualization and subsequent implementation of cybersecurity compliance analysis services. In particular, after identifying the stakeholders involved in the SecaaS domain along with their goals, the security information and event management (SIEM) scenario, in which the Cloud Security Alliance (CSA) classifies cybersecurity compliance analysis services, is considered and two main application scenarios for cybersecurity compliance analysis are identified: (i) compliance analysis of an existing IT system/application, which aims at producing a report about the conformance of the system with respect to the cybersecurity rules and regulations in force as well as a set of indications on its possible enhancement; (ii) compliance analysis of an IT system/application under development, which aims at evaluating whether such system/application is able to meet security requirements coming from related cybersecurity rules and regulations.The paper presents and discusses both the application scenarios and, thanks to GOReM, provides a clear understanding of them so as to guide their concrete implementation.…”