Managing legal compliance through security requirements across service provider chains: A case study on the German federal data protection act

Abstract

Future service customer-provider as well as inter-provider relationships will see the increased application of dynamic service composition providing a broad diversity of functions. However, currently existing deficiencies of processes and tools force service providers and service consumers to trade off profitability against security compliance. This is predominately due to the ignorance or manual resolution of policy and configuration dependencies, caused by distinct terminologies and languages used at both the service provider and service customer. We report on the research design for the Collaborative Security Requirement Management System (CoSeRMaS), a collaborative and semi-automated tool to manage, define and validate inter organizational requirements. We demonstrate the capabilities of CoSeRMaS to establish and validate the legal compliance that is demanded by the German Bundes Datenschutzgesetz (BDSG) when two or more customers and providers exchange data as part of their service composition.