How responsibility modelling leads to security requirements

When a technical system is placed in a social context organisational requirements arise in addition to the functional requirements on the system. Security is a good example of such an organisational requirement. A means of identifying these organisational requirements is needed and also a way of specifying them that is meaningful both to users and systems designers. This paper proposes that the concept of responsibility fills both these needs. Responsibilities embody requirements in that the responsibility holder needs to do things, needs to know things and needs to record things for subsequent audit. These needs form the basis of a ‘need-to-know’ security policy. Furthermore a model of responsibilities describes the context within the organisational structure in which the requirements, including those related to security, arise.