Relating Security Capabilities to Goal-Oriented Requirements Models in KAOS

Baselines such as NIST IR 8259A list what an IoT device can do. Goal-oriented requirements models state what an organisation needs to hold. The two are rarely connected, so a device can tick every capability while the goal it was bought to support still fails. We propose GoalCap, a conceptual modelling approach that relates security capabilities to goal models in KAOS, developed for IoT-enabled smart campuses. Its central idea is that a capability enables a goal rather than satisfying it: the goal holds only when a responsible agent exercises the capability under stated conditions. We compare four goal-oriented approaches and justify KAOS for this purpose. We then contribute a metamodel that extends traceability from stakeholder goals through requirements, obstacles and anti-goals to capability elements; the notion of a capability that is absent, latent or exercised; security scenarios that yield strong, weak or unsatisfied levels of goal satisfaction; a two-way gap analysis between requirements and an external baseline; and a campus-level view of heterogeneous devices. A running example of a composite smart campus, with fifteen literature-derived requirements, shows that two devices with identical capabilities can reach different levels of satisfaction, and that a capability baseline can expose goals that the requirements had missed.