Overview
Requirements engineering frameworks have historically been developed in the context of cybersecurity and have tended to focus almost exclusively on the technical and operational aspects of data security. Now, however, frameworks are being stretched to support interdisciplinary and multiorganizational information systems, requirements, and risks, securing downstream processes such as data analytics and balancing cross-domain priorities and perspectives. In this paper, we (i) explore the purpose of frameworks and their function in facilitating requirements engineering in information systems, (ii) perform an analysis of the relationships and lineages of common frameworks in professional use today, and (iii) propose the Properties, Processes, and Perspectives Inter-Framework (P3IF). P3IF enables flexible requirements engineering for complex information systems by providing a modular abstraction layer between existing frameworks, extending their value without replacing them. Factors from frameworks used across disparate domains are multiplexed to harmonize vocabularies and narratives across different organizations and needs, to create new approaches to managing information risk, and to enhance the cognitive security of decisions-makers by expanding security considerations beyond cybersecurity to include the entire information pipeline from sourcing to semantics.
Overview source: Curated paper metadata.
Methods and contributions
Read the source for the full argument, qualifications, and evidence.
Findings and contributions
- All dimensions and attributes of the examined frameworks fit into one of three emergent categories: Properties, Processes, or Perspectives.
- Derivative frameworks tend to be released as standalone replacements and are generally not backwards compatible.
- The more expansive multi-factor frameworks were the most difficult to document due to inconsistent documentation, variable proliferation and visualization limits.
- The paper proposes P3IF, a modular abstraction layer between existing frameworks that extends rather than replaces them.
- The authors state the analysis is not an exhaustive or systematic meta-analysis but an initial snapshot of a sample of frameworks.
Methods
- Snowball citation-tracking review of combinatorial requirements frameworks — Starting from well-known frameworks (CIA triad, McCumber Cube, DoDAF), manual citation tracking identified antecedent and derived frameworks; 41 were included as of August 2023.
- Coda.io knowledge base and UI for framework collection — Built a front-end UI and knowledge management system on the low-code Coda.io platform to store bibliographic, visual and textual aspects of each framework.
- Phylo-memetic lineage trees of framework clades — Parent/child relationships from citation histories and direct references were arranged into phylogenetic-type trees grouping frameworks into seven context clades.
- Sorting framework dimensions into Properties, Processes, Perspectives — Dimensions and attributes of the collected frameworks were categorized into three general categories that form the basis of the proposed P3IF.
Summary sources: Paper metadata and evidence · Extracted source text.
Document downloads
PDFs are hosted here; supporting sources may use pinned archives.
- 2023_P3IF.pdf PDF · 3.27 MiB · extracted-text source
Citation
Citation metadata follows the unified bibliography.
Catalog details and resources
Related works
Ranked by recorded methods, topics, contributors and associated software, with contributor roles and domain-only matches labelled. Metadata overlap is not a citation or a scientific equivalence.