Transparency & Legal Compliance in Information Systems

Research Areas: End System Security, Policy, Law and Management,

Principal Investigator: Eugene Spafford

Analysts need mechanisms to disambiguate regulations so they may be clearly specified as software requirements. Additionally, those responsible for certifying compliance within relevant systems need controls and assurances that measure conformance with policies and regulations. Our goal is to develop methods, tools, and procedures to help software designers and policy makers achieve transparency and consistency by bringing regulations, policies and system requirements into better alignment.

Results: There are three main expected results of this work. First, we will produce tools to assist software designers in determining a clear set of actionable requirements for system design and access control from regulations and legislation. Second, we will produce methods to develop audit mechanisms and procedures that may be used to verify that a functioning system meets its requirements. This will aid organizations as they conduct policy and legal compliance. Third, we will develop a realistic corpus of synthetic electronic patient record data that can be used to test any such experimental system. We will make this available so that other researchers can use it.

Keywords: software requirements, policy, assurance