Towards Traceable Derivation of Zero Trust--Oriented Security Quality Attribute Scenarios from Architectural Requirements

This package contains the replication and supplementary materials for the paper: Towards Traceable Derivation of Zero Trust--Oriented Security Quality Attribute Scenarios from Architectural Requirements The package supports the reproducibility of the proposed method for deriving Zero Trust (ZT)–oriented Security Quality Attribute Scenarios (QAS) from security Architecturally Significant Requirements (ASRs). It includes methodological guidelines, catalogs, templates, instruments, and fully worked examples aligned with the case study presented in the paper. Contents Methodological and reference material NIST.SP.800-207.pdf – NIST Zero Trust Architecture specification. ZT principles for print.pdf – Printable summary of Zero Trust principles. zero-trust-principles-en.html – HTML catalog of Zero Trust principles. zta-vs-security-attributes-en.html – Mapping between ZT principles and security quality attributes. security-mechanisms-catalog-en.html – Catalog of security mechanisms associated with ZT principles. Templates and datasets SQA_templates_and_datasets.pdf – Templates for Security Quality Attribute Scenarios and example datasets. Case study and method application artifacts manual_uso_caso_estudio_sfps.pdf – User manual describing how to apply the method step by step. 1_elicitation_to_asr_case_study_updated_en.pdf – From stakeholder security concerns to ASRs (academic case study). 2_case_study_updated_en.pdf – Case study guide for applying the ZT-oriented method. 3_zt_scenarios_tables_updated_en.pdf – ZT-oriented QAS scenarios and tables. 4_survey_updated_en.pdf – Expert evaluation questionnaire and aggregated results (n=2). 5_observations_updated_en.pdf – Expert-based assessment notes and qualitative observations. Purpose These artifacts enable researchers and practitioners to: Understand and replicate the proposed method. Inspect the derivation of ZT-oriented scenarios from ASRs. Reuse templates and catalogs in other case studies or domains. Compare and extend the method in future empirical evaluations. The materials are intended as a replication package and supplementary material for the paper.