{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,17]],"date-time":"2026-07-17T20:27:37Z","timestamp":1784320057171,"version":"3.55.0"},"publisher-location":"New York, NY, USA","reference-count":30,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,10,22]],"date-time":"2024-10-22T00:00:00Z","timestamp":1729555200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Research Council of Finland","award":["345633"],"award-info":[{"award-number":["345633"]}]},{"name":"the European Union - NextGenerationEU instrument funded by the Research Council of Finland","award":["352726"],"award-info":[{"award-number":["352726"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,10,22]]},"DOI":"10.1145\/3685651.3686700","type":"proceedings-article","created":{"date-parts":[[2024,10,11]],"date-time":"2024-10-11T22:25:17Z","timestamp":1728685517000},"page":"93-102","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":7,"title":["Automating Cybersecurity Compliance in DevSecOps with Open Information Model for Security as Code"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3791-882X","authenticated-orcid":false,"given":"Henry","family":"Haverinen","sequence":"first","affiliation":[{"name":"Cyberismo, Finland"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2029-7708","authenticated-orcid":false,"given":"Tomi","family":"Janhunen","sequence":"additional","affiliation":[{"name":"Tampere University, Finland"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7477-0783","authenticated-orcid":false,"given":"Tero","family":"P\u00e4iv\u00e4rinta","sequence":"additional","affiliation":[{"name":"University of Oulu, Finland"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-0980-9980","authenticated-orcid":false,"given":"Sami","family":"Lempinen","sequence":"additional","affiliation":[{"name":"Cyberismo, Finland"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-6297-376X","authenticated-orcid":false,"given":"Suvi","family":"Kaartinen","sequence":"additional","affiliation":[{"name":"Cyberismo, Finland"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0002-0648-2947","authenticated-orcid":false,"given":"Sami","family":"Meril\u00e4","sequence":"additional","affiliation":[{"name":"Cyberismo, Finland"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2024,10,22]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.infsof.2022.106894"},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/2043174.2043195"},{"key":"e_1_3_2_1_3_1","unstructured":"Cloud Native Computing Foundation. 2024. Open Policy Agent. https:\/\/www.openpolicyagent.org. Accessed: 2024-05-04."},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1609\/aimag.v37i3.2678"},{"key":"#cr-split#-e_1_3_2_1_5_1.1","unstructured":"European Parliament. 2024. Cyber Resilience Act. https:\/\/www.europarl.europa.eu\/doceo\/document\/TA-9-2024-0130_EN.html Regulation"},{"key":"#cr-split#-e_1_3_2_1_5_1.2","unstructured":"(EU) 2019\/1020 (COM(2022)0454 - C9-0308\/2022 - 2022\/0272(COD))."},{"key":"e_1_3_2_1_6_1","unstructured":"European Parliament and Council. 2022-12-27. Directive (EU) 2022\/2555 on measures for a high common level of cybersecurity across the Union amending Regulation (EU) No 910\/2014 and Directive (EU) 2018\/1972 and repealing Directive (EU) 2016\/1148 (NIS 2 Directive). 80\u00a0pages."},{"key":"e_1_3_2_1_7_1","unstructured":"[7] Resource\u00a0Description Framework. 2014. https:\/\/www.w3.org\/RDF\/."},{"key":"e_1_3_2_1_8_1","volume-title":"Potassco User Guide","author":"Gebser Martin","unstructured":"Martin Gebser, Roland Kaminski, Benjamin Kaufmann, Marius Lindauer, Max Ostrowski, Javier Romero, Torsten Schaub, Sven Thiele, and Philipp Wanko. 2019. Potassco User Guide, 2nd edition, version 2.2.0. Technical Report. University of Potsdam. https:\/\/github.com\/potassco\/guide\/releases\/tag\/v2.2.0","edition":"2"},{"key":"e_1_3_2_1_9_1","volume-title":"aspcud: A Linux Package Configuration Tool Based on Answer Set Programming","author":"Gebser Martin","year":"2011","unstructured":"Martin Gebser, Roland Kaminski, and Torsten Schaub. 2011. aspcud: A Linux Package Configuration Tool Based on Answer Set Programming. In Logics for Component Configuration (LoCoCo 2011)(EPTCS, Vol.\u00a065). Open Publishing Association, https:\/\/www.eptcs.org\/, 12\u201325."},{"key":"e_1_3_2_1_10_1","unstructured":"Dennis Gurock. 2024. Common JUnit XML Format & Examples. https:\/\/github.com\/testmoapp\/junitxml. Accessed: 2024-05-04."},{"key":"e_1_3_2_1_11_1","volume-title":"Clingraph: ASP-Based Visualization. In Logic Programming and Nonmonotonic Reasoning (LPNMR","author":"Hahn Susana","year":"2022","unstructured":"Susana Hahn, Orkunt Sabuncu, Torsten Schaub, and Tobias Stolzmann. 2022. Clingraph: ASP-Based Visualization. In Logic Programming and Nonmonotonic Reasoning (LPNMR 2022). Springer, Cham, 401\u2013414."},{"key":"e_1_3_2_1_12_1","volume-title":"Software Business (ICSOB 2023)(Lecture Notes in Business Information Processing, Vol.\u00a0500)","author":"Haverinen Henry","unstructured":"Henry Haverinen, Tero P\u00e4iv\u00e4rinta, Jussi V\u00e4nsk\u00e4, and Henry Joutsijoki. 2023. Information-Centric Adoption and Use of Standard Compliant DevSecOps for Operational Technology: From Experience to Design Principles. In Software Business (ICSOB 2023)(Lecture Notes in Business Information Processing, Vol.\u00a0500). Springer, Cham, 400\u2013415."},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"crossref","unstructured":"International Electrotechnical Commission. 2015. Medical device software - Software life cycle processes. Standard IEC 62304:2006+AMD1:2015 CSV. IEC.","DOI":"10.1049\/ic:20060141"},{"key":"e_1_3_2_1_14_1","unstructured":"International Electrotechnical Commission. 2018. Security for industrial automation and control systems - Part 4-1: Secure product development lifecycle requirements. Standard IEC 62443-4-1:2018. IEC."},{"key":"e_1_3_2_1_15_1","first-page":"2021","article-title":"Road vehicles - Cybersecurity engineering","volume":"21434","author":"International Organization for Standardization.","year":"2021","unstructured":"International Organization for Standardization. 2021. Road vehicles - Cybersecurity engineering. Standard ISO\/SAE 21434:2021. ISO, Geneva, Switzerland.","journal-title":"Standard ISO\/SAE"},{"key":"e_1_3_2_1_16_1","first-page":"2022","article-title":"Information security, cybersecurity and privacy protection - Information security management systems - Requirements","volume":"27001","author":"International Organization for Standardization.","year":"2022","unstructured":"International Organization for Standardization. 2022. Information security, cybersecurity and privacy protection - Information security management systems - Requirements. Standard ISO\/IEC 27001:2022. ISO, Geneva, Switzerland.","journal-title":"Standard ISO\/IEC"},{"key":"e_1_3_2_1_17_1","volume-title":"the 3rd International Workshop on Logic and Search (LaSh","author":"Janhunen Tomi","year":"2010","unstructured":"Tomi Janhunen. 2010. Modular Construction of Ground Logic Programs using lpcat. In the 3rd International Workshop on Logic and Search (LaSh 2010)."},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1609\/aimag.v37i3.2671"},{"key":"e_1_3_2_1_19_1","volume-title":"Semantic Web Rules (RuleML 2010)(Lecture Notes in Computer Science, Vol.\u00a06403)","author":"Luukkala Vesa","unstructured":"Vesa Luukkala and Ilkka Niemel\u00e4. 2010. Enhancing a Smart Space with Answer Set Programming. In Semantic Web Rules (RuleML 2010)(Lecture Notes in Computer Science, Vol.\u00a06403). Springer, Cham, 89\u2013103."},{"key":"e_1_3_2_1_20_1","unstructured":"Mike Milinkovich. 2024. The Open Source Community is Building Cybersecurity Processes for CRA Compliance. https:\/\/blogs.eclipse.org\/post\/mike-milinkovich\/open-source-community-building-cybersecurity-processes-cra-compliance. Accessed: 2024-05-04."},{"key":"e_1_3_2_1_21_1","volume-title":"Software Process Improvement and Capability Determination (SPICE 2017)(Communications in Computer and Information Science, Vol.\u00a0770)","author":"Myrbakken H\u00e5vard","unstructured":"H\u00e5vard Myrbakken and Ricardo\u00a0Colomo Palacios. 2017. DevSecOps: A Multivocal Literature Review. In Software Process Improvement and Capability Determination (SPICE 2017)(Communications in Computer and Information Science, Vol.\u00a0770). Springer, Cham, 17\u201329."},{"key":"e_1_3_2_1_22_1","unstructured":"National Institute of Standards and Technology. 2024. OSCAL: the Open Security Controls Assessment Language. https:\/\/pages.nist.gov\/OSCAL\/. Accessed: 2024-05-04."},{"key":"e_1_3_2_1_23_1","unstructured":"OSCAL Club. 2024. Awesome OSCAL. https:\/\/github.com\/oscal-club\/awesome-oscal. Accessed: 2024-05-04."},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/3512341"},{"key":"e_1_3_2_1_25_1","volume-title":"Designing Data Spaces. The Ecosystem Approach to Competitive Advantage","author":"Pettenpohl Heinrich","unstructured":"Heinrich Pettenpohl, Markus Spiekermann, and Jan\u00a0Ruben Both. 2022. International Data Spaces in a Nutshell. In Designing Data Spaces. The Ecosystem Approach to Competitive Advantage. Springer, Cham, 29\u201340."},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.infsof.2021.106700"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/MS.2022.3167481"},{"key":"e_1_3_2_1_28_1","unstructured":"The FEDERATE Consortium. 2024. European Software-Defined Vehicle of the Future (SDVoF) Initiative - Vision and Roadmap. https:\/\/federate-sdv.eu\/2024\/04\/12\/european-software-defined-vehicle-of-the-future-sdvof-initiative-vision-and-roadmap\/. Accessed: 2024-05-04."},{"key":"e_1_3_2_1_29_1","unstructured":"The OWASP Foundation. 2024. OWASP Threat Dragon. https:\/\/owasp.org\/www-project-threat-dragon\/. Accessed: 2024-05-04."}],"event":{"name":"eSAAM 2024: 4th Eclipse Security, AI, Architecture and Modelling Conference on Data Space","location":"Mainz Germany","acronym":"eSAAM 2024"},"container-title":["Proceedings of the 4th Eclipse Security, AI, Architecture and Modelling Conference on Data Space"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3685651.3686700","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3685651.3686700","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T01:17:26Z","timestamp":1750295846000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3685651.3686700"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,10,22]]},"references-count":30,"alternative-id":["10.1145\/3685651.3686700","10.1145\/3685651"],"URL":"https:\/\/doi.org\/10.1145\/3685651.3686700","relation":{},"subject":[],"published":{"date-parts":[[2024,10,22]]},"assertion":[{"value":"2024-10-22","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}