A Readiness Model for Security Requirements Engineering

Yusuf Mufti, Mahmood Niazi, Mohammad Alshayeb, Sajjad Mahmood*

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review

26 Scopus citations


The focus on secure software development has been growing steadily in all phases of the software development life cycle. Security awareness in the requirements engineering stage of software development is important in building secure software. One of the major issues faced by the software industry is that many organizations undertake secure software development initiatives without knowing whether they are ready to undertake them. Currently, there is no model to measure the readiness of security requirements engineering in an organization. The objective of this paper is to develop a security requirements engineering readiness model (SRERM) to enable organizations to assess their security requirements engineering (SRE) readiness levels. In order to achieve this goal, a systematic mapping study was conducted to identify the relevant studies in the SRE domain. A total of 104 primary studies were identified, and available evidence was synthesized into 12 security requirements categories and 76 best practices to build a SRERM. Initially, two case studies were conducted in order to evaluate the SRERM in a real-world environment. Based on the outcomes of the two case studies, some modifications were proposed to further improve the SRERM. After modifying the SRERM, two more case studies were conducted in order to evaluate the modifications made to the SRERM. The case study results indicate that the SRERM has the ability to identify the readiness levels of SRE in the software industry.

Original languageEnglish
Pages (from-to)28611-28631
Number of pages21
JournalIEEE Access
StatePublished - 23 May 2018

Bibliographical note

Funding Information:
This work was supported by the Deanship of Scientific Research at the King Fahd University of Petroleum and Minerals, Saudi Arabia, under Project IN161024.

Publisher Copyright:
© 2013 IEEE.


  • Readiness model
  • secure requirements engineering

ASJC Scopus subject areas

  • Computer Science (all)
  • Materials Science (all)
  • Engineering (all)


Dive into the research topics of 'A Readiness Model for Security Requirements Engineering'. Together they form a unique fingerprint.

Cite this