Quality Matters: Systematizing Quality Deficiencies in the Documentation of Business Security Requirements

The ever increasing need for businesses to ensure compliance with various laws and regulations as well as internal and external policies increasingly requires businesses to manage a plethora of documentation on different business security requirements. However, business security requirement documentation often suffers from quality deficiencies and faults due to negligence, inconsistencies, conflicts or unclear responsibilities in globally distributed businesses. A key factor to successfully address these deficiencies and to support continuous quality improvement of business security requirements documentation is to know exactly what faults to look for in a structured manner. Based on a think-aloud study, we identify and categorize specific quality deficiencies that can be found in the documentation of business security requirements and classify the faults that might cause them. We conclude by proposing a taxonomy that covers the specification, interaction, and life-cycle faults that are at the root of observable failures in the documentation of business security requirements.