Security Requirements Elicitation from Engineering Governance, Risk Management and Compliance

[Context and motivation:] There is a variety of sources from which security requirements may be derived, typically pertaining to fields such as software engineering, information systems risk assessment, security auditing, compliance management, IT governance etc. Several approaches, especially in the software engineering domain, have already investigated security requirements within a broader scope, including results from risk management. [Question/problem:] Identifying security requirements according to just one of these fields might not suffice – opportunities of integration and enrichment must be investigated. [Principal ideas/results:] Our proposal advocates a convergence of different security requirements sources towards their richer specification, based on semantic technology. [Contribution:] Through this vision paper, we sketch the outline for a new perspective on eliciting security requirements, based on knowledge-driven integration of approaches from software engineering, risk assessment, governance and compliance.