We present our ongoing work on requirements specification and analysis for the geographically distributed software and systems. Developing software and systems within for different countries or states or even within for different organisations means that the requirements to them can differ in each particular case. These aspects naturally impact on the software architecture and on the development process as a whole. The challenge is to deal with this diversity in a systematic way, avoiding contradictions and non-compliance. In this paper, we present a formal framework for the analysis of the requirements diversity, which comes from the differences in the regulations, laws and cultural aspects for different countries or organisations. The framework also provides the corresponding architectural view and the methods for requirements structuring and optimisation.
To ensure legal compliance, requirements engineers need tools to determine existing software requirements' compliance with relevant law. We propose using a production rule model for requirements engineers to query as they check software requirements for legal compliance. In this paper, we perform a case study using our approach to evaluate the iTrust Medical Records System requirements for compliance with the u.s. Health Insurance Portability and Accountability Act (HIPAA). We identifY 12 new compliance requirements beyond the 63 functional requirements with which we began our analysis. In the United States, federal and state regulations prescribe stakeholder rights and obligations that must be satisfied by the requirements for software systems. These regulations are typically wrought with ambiguities, making the process of deriving system requirements ad hoc and error prone. In highly regulated domains such as healthcare, there is a need for more comprehensive standards that can be used to assure that system requirements conform to regulations. To address this need, we expound upon a process called Semantic Parameterization previously used to derive rights and obligations from privacy goals. In this work, we apply the process to the Privacy Rule from the U.S. Health Insurance Portability and Accountability Act (HIPAA). We present our methodology for extracting and prioritizing rights and obligations from regulations and show how semantic models can be used to clarify ambiguities through focused elicitation and to balance rights with obligations. The results of our analysis can aid requirements engineers, standards organizations, compliance officers, and stakeholders in assuring systems conform to policy and satisfy requirements. While new laws and regulations address organisations, with their processes and information systems, the problem of defining suitable methods and techniques to support the design of law-compliant systems is getting increasing attention. We proposed a novel requirements engineering framework that includes a systematic process to derive law-compliant system requirements taking into account laws and strategic goals of stakeholders of a given domain. In this paper, we focus on the conceptual meta-model this framework rests on, defining it and discussing its use. The increasing complexity of IT systems and the growing demand for regulation compliance are main issues for the design of IT systems. Addressing these issues requires the developing of effective methods to support the analysis of regulations and the elicitation of any organizational and system requirements from them. This work investigates the problem of designing regulation-compliant systems and, in particular, the challenges in eliciting and managing legal requirements.