SaTC: CORE: Small: Collaborative: Enabling Regulatory Compliance for Software Engineering

软件系统在现代社会中无处不在，但工程系统显然符合相关法律法规仍然在理论和实践上具有挑战性。 不幸的是，评估系统的法规遵从性是具有挑战性和昂贵的，这确保了现有法律和法规的执行率较低。 此外，组织没有标准的方法可以用来记录他们的尽职调查和合规工作，随着软件变得更加集成和传统的非软件领域的中心，适用于软件的法规的数量和类型预计会增加。 这项拟议的研究旨在创建一个符合法规的软件开发方法。 使用这种方法的软件工程专业人员将能够管理其开发系统的法规遵从性方面，并向外部审计员，客户和公众展示他们在软件开发生命周期（SDLC）每个阶段的合规性方法。 这项研究有可能影响到每一个软件系统开发使用的监管领域。一般来说，社会首先规范领域，其次才考虑软件。对于仍然依赖于软件的非软件域（例如，医疗保健、汽车、金融等），组织只能测量输入和输出，他们无法了解用于开发控制系统潜在关键要素的软件的完整工程过程。这项工作将通过为组织提供所需的工具来证明他们试图做正确的事情，即使发生故障，从而改变组织对责任和合规性的看法。这项工作的结果将被纳入研究生和本科生课程的主题，如安全和隐私，系统分析，软件测试和软件维护。该奖项解决的核心研究问题是：软件工程师如何在整个软件系统的设计，开发和维护过程中纳入并证明遵守安全和隐私法律，法规，指南和标准？ 该项目的目标是基于当前的实践和研究，开发一个完整的生命周期方法，以帮助软件工程师，政策制定者和监管机构构建和评估软件系统。该目标分为三个阶段：（1）根据当前实践和新研究，为安全和隐私法规合规性制定一个全面的定义、概念、模型和模板核心框架;（2）识别和缓解研究和实践尚未完全解决的SDLC特定阶段的差距（特别是测试和维护）;以及（3）与各种利益相关者进行纵向混合方法交互，以不断探索组织在受监管领域构建软件的当前实践，确定研究与实践之间的差距，并迭代评估此方法。完成后，该框架将解决有意和无意监管模糊性的管理问题，改善不同领域利益相关者之间的沟通（例如，该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Software systems are ubiquitous in modern society, but engineering systems that are demonstrably compliant with relevant laws and regulations remains both theoretically and practically challenging. Unfortunately, assessing a system for regulatory compliance is challenging and expensive, which ensures existing laws and regulations have low enforcement rates. Further, organizations have no standard approach they can use to document their due diligence and compliance efforts, and the number and types of regulations applicable to software is expected to increase, as software becomes more integrated and central to traditionally non-software domains. This proposed research seeks to create a software development methodology for regulatory compliance. Software engineering professionals using this methodology will be able to both manage the regulatory compliance aspects of their systems under development and also to demonstrate to an outside auditor, to customers, and to the public, their approach towards compliance at each stage of the software development lifecycle (SDLC). This research has the potential to affect every software system developed for use in a regulated domain. In general, society regulates domains first and considers software second. For non-software domains that nevertheless depend on software (e.g., healthcare, automotive, finance, etc.), organizations are left measuring inputs and outputs, and they have no insight into the full engineering process used to develop the software that controls potentially critical elements of the system. This work will transform how organizations think about liability and compliance by providing organizations the tools needed to demonstrate that they attempted to do the right thing, even if a failure occurs. The results of this work will be incorporated in graduate and undergraduate courses on topics such as security and privacy, systems analysis, software testing and software maintenance. The core research problem this award addresses is: How can software engineers incorporate and demonstrate compliance with security and privacy laws, regulations, guidelines, and standards throughout the design, development, and maintenance of software systems? The goal of this project is to develop a full-lifecycle methodology, based on current practice and research, to help software engineers, policy makers, and regulators build and assess software systems. This goal is organized into three phases: (1) the development of a comprehensive core framework of definitions, concepts, models, and templates for security and privacy regulatory compliance based on current practices and new research; (2) the identification and mitigation of gaps in particular phases of the SDLC that research and practice have not fully addressed (in particular testing and maintenance); and (3) a longitudinal mixed-method interaction with a variety of stakeholders to continuously explore current practices of organizations building software in regulated domains, identify gaps between research and practice, and iteratively evaluate this methodology. Upon completion, this framework will address management of intentional and unintentional regulatory ambiguity, improve communication between stakeholders from disparate domains, (e.g., lawyers, policy makers, regulatory agencies, developers, managers, and testers), and ameliorate the dearth of methods for testing and maintaining regulatory compliance of software.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.