Checking Regulatory Compliance of Business Processes and Information Systems

Abstract

In these years, many laws and regulations are being enacted to prevent business processes (BPs) and information systems (ISs) from their malicious users. As a result, it is significant for organizations to ensure that their BPs and ISs comply with these regulations. This paper proposes a technique to apply a formal technique to ensure the regulatory compliance of BP or IS descriptions written in use case models. We translate the use case models of the behavior of BPs and ISs into finite state transition machines. Regulations are represented with computational tree logic (CTL) and their satisfiability are automatically verified using a model checker SMV. The modality of regulations can be specified with temporal operators based on branching time semantics of the CTL in our technique.