A Method for Identifying Software Requirements Based on Policy Commitments
A Method for Identifying Software Requirements Based on Policy Commitments
复制标题
一种基于策略承诺的软件需求识别方法
DOI：
10.1109/re.2010.17
复制
发表时间：
2010
期刊：
影响因子：
--
通讯作者：
A. Antón
中科院分区：
文献类型：
--
作者：
Jessica D. Young;A. Antón
在线政策文档（如隐私政策、隐私实践通知和使用条款）描述了组织收集、存储和使用消费者个人信息的信息实践。各组织需要确保它们在政策文件中作出的承诺反映其实际的业务做法。这种遵守在美国很重要，因为联邦贸易委员会负责管理公平的商业做法。因此，为组织开发系统的需求工程师需要了解政策文档，以便了解软件必须遵守的信息实践。需求工程师还必须确保这些政策文档中表达的承诺被纳入软件需求中。在本文中，我们提出了一个总结性的案例研究的承诺分析方法。该方法是在对四个医疗保健组织的政策文件进行形成性案例研究期间开发的。在这种方法中，我们根据我们的承诺，特权和权利理论从政策文件中获取需求。在我们的总结性案例研究中，我们将我们的承诺分析方法应用于八个医疗机构的政策文件，以验证该方法。我们讨论了总结性研究的结果，我们发现，大多数的声明表达组织的做法或程序。最常见的分类表示该组织根据组织做法作出的承诺。第二个最常见的分类表示用户有权根据组织实践执行的操作。
Online policy documents—such as privacy policies, notices of privacy practices, and terms of use—describe organizations’ information practices for collecting, storing, and using consumers’ personal information. Organizations need to ensure that the commitments they express in their policy documents reflect their actual business practices. This compliance is significant in the United States where the Federal Trade Commission regulates fair business practices. Therefore, the requirements engineers developing systems for organizations need to understand the policy documents in order to know the information practices with which the software must comply. The requirements engineers also must ensure that the commitments expressed in these policy documents are incorporated into the software requirements. In this paper, we present a summative case study of a commitment analysis approach. The approach was developed during a formative case study of four healthcare organizations’ policy documents. Within this approach, we obtain requirements from policy documents based on our theory of commitments, privileges, and rights. During our summative case study we applied our commitment analysis approach to eight healthcare organizations’ policy documents in order to validate the methodology. We discuss the results of the summative study, in which we found that most of the statements express organizational practices or procedures. The top seen classification conveys pledges made by the organization based on organizational practices. The second most seen classification expresses actions that the user is entitled to perform based on organizational practices.