Document Type
Article
Publication Date
12-30-2017
Publication Title
Requirements Engineering
Abstract
Companies and government organizations are increasingly compelled, if not required by law, to ensure that their information systems will comply with various federal and industry regulatory standards, such as the NIST Special Publication on Security Controls for Federal Information Systems (NIST SP-800-53), or the Common Criteria (ISO 15408-2). Such organizations operate business or mission critical systems where a lack of or lapse in security protections translates to serious confidentiality, integrity, and availability risks that, if exploited, could result in information disclosure, loss of money, or, at worst, loss of life. To mitigate these risks and ensure that their information systems meet regulatory standards, organizations must be able to (a) contextualize regulatory documents in a way that extracts the relevant technical implications for their systems, (b) formally represent their systems and demonstrate that they meet the extracted requirements following an accreditation process, and (c) ensure that all third-party systems, which may exist outside of the information system enclave as web or cloud services also implement appropriate security measures consistent with organizational expectations. This paper introduces a step-wise process, based on semantic hierarchies, that systematically extracts relevant security requirements from control standards to build a certification baseline for organizations to use in conjunction with formal methods and service agreements for accreditation. The approach is demonstrated following a case study of all audit-related controls in the SP-800-53, ISO 15408-2, and related documents. Accuracy, applicability, consistency, and efficacy of the approach were evaluated using controlled qualitative and quantitative methods in two separate studies.
Recommended Citation
Hale, Matthew L. and Gamble, Rose F., "Semantic hierarchies for extracting, modeling, and connecting compliance requirements in information security control standards" (2017). Interdisciplinary Informatics Faculty Publications. 33.
https://digitalcommons.unomaha.edu/interdiscipinformaticsfacpub/33
Files over 3MB may be slow to open. For best results, right-click and select "save as..."
Included in
Funded by the University of Nebraska at Omaha Open Access Fund
Comments
© 2017 Hale and Gamble. This article is an open access publication and is distributed under the terms of the Creative Commons Attribution 4.0 International License (http ://crea tive comm ons.org/lice nses /by/4.0/), which permits unrestricted use, distribution, and reproduction in any medium, provided you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license, and indicate if changes were made.