From Regulatory Policies to Event Monitoring Rules: Towards Model-Driven Compliance Automation

The complexity and costs of conforming to regulatory objectives in large enterprises has drastically heightened the need for consistent and automated approaches to managing compliance. To uniformly describe and manage compliance policies in distributed and heterogeneous IT environments, we have proposed a compliance metamodel for formally capturing regulatory requirements and managing them in a systematic lifecycle. A key aspect in automating compliance involves the monitoring of application events to determine whether business processes and applications operate within the parameters set forth in formal compliance policies. We show how subsets of the regulations, industry guidances or best practices that are expressed in terms of the metamodel can be (semi-)automatically transformed into event monitoring rules with the help of temporal rule patterns. Using examples of regulatory requirements, we demonstrate their formalization in compliance policies and their automated transformation into event correlation rules.