Automating the Extraction of Rights and Obligations for Regulatory Compliance

  • Authors:

  • Nadzeya Kiyavitskaya;Nicola Zeni;Travis D. Breaux;Annie I. Antón;James R. Cordy;Luisa Mich;John Mylopoulos

  • Affiliations:

  • Dept. of Information Engineering and Computer Science, University of Trento, Italy;Dept. of Information Engineering and Computer Science, University of Trento, Italy;Dept. of Computer Science, North Carolina State University, U.S.A.;Dept. of Computer Science, North Carolina State University, U.S.A.;School of Computing, Queens University, Kingston, Canada;Dept. of Computer and Management Sciences, University of Trento, Italy;Dept. of Information Engineering and Computer Science, University of Trento, Italy

  • Venue:
  • ER '08 Proceedings of the 27th International Conference on Conceptual Modeling
  • Year:
  • 2008

Quantified Score

Hi-index 0.00

Visualization

Abstract

Government regulations are increasingly affecting the security, privacy and governance of information systems in the United States, Europe and elsewhere. Consequently, companies and software developers are required to ensure that their software systems comply with relevant regulations, either through design or re-engineering. We previously proposed a methodology for extracting stakeholder requirements, called rights and obligations, from regulations. In this paper, we examine the challenges to developing tool support for this methodology using the Cerno framework for textual semantic annotation. We present the results from two empirical evaluations of a tool called "Gaius T." that is implemented using the Cerno framework and that extracts a conceptual model from regulatory texts. The evaluation, carried out on the U.S. HIPAA Privacy Rule and the Italian accessibility law, measures the quality of the produced models and the tool's effectiveness in reducing the human effort to derive requirements from regulations.