Architecture-based regulatory compliance argumentation

Research output: Contribution to journalJournal articleResearchpeer-review

  • Boyan Mihaylov
  • Lucian Onea
  • Klaus Marius Hansen

Standards and regulations are difficult to understand and map to software, which makes compliance with them challenging to argue for software products and development process. This is problematic since lack of compliance may lead to issues with security, safety, and even to economic sanctions. An increasing number of applications (for example in healthcare) are expected to have to live up to regulatory requirements in the future, which will lead to more software development projects having to deal with such requirements. We present an approach that models regulations such that compliance arguments can be made in a principled way based on architectural requirements and architectural decisions. In particular, we discuss how one can form architectural requirements which are linked to regulatory texts. We then argue for completeness and correctness of this bi-directional link. We evaluate the approach on the migration of the telemedicine platform Net4Care to the cloud, where certain regulations (for example privacy) should be concerned. The approach has the potential to support simpler compliance argumentation with the eventual promise of safer and more secure applications.

Original languageEnglish
JournalThe Journal of Systems and Software
Volume119
Pages (from-to)1-30
Number of pages30
ISSN0164-1212
DOIs
Publication statusPublished - 2016

    Research areas

  • Regulatory compliance, Software architecture, Software development

ID: 172101121