## 5 Evaluation  
In order to evaluate the feasibility of the MBSesec method, we asked MBSE and security practitioners to answer questions related to their experience, work principles, and the security method itself. The questions were answered by various engineering organizations representatives (in total 15) and academic representatives (in total 4). The respondents' disciplines were as follows: Systems Engineering (in total 9), Software Engineering (in total 6), Requirements Engineering (in total 3), and Mechanical Engineering (in total 1). All the respondents were aware of MBSE, and over half of the respondents were practicing MBSE for more than 5 years. The results are provided in Figure 13. \begin{table}
\begin{tabular}{c c} \hline \hline
**Question** & **Algorithm** \\ \hline \multirow{4}{*}{Are there any risks that do not have risk treatment and whose risk acceptance level is higher than an acceptable level of risk defined in Risk Assessment Configuration?} & SELECT all instances of SecurityProfile:Risk \\  & WHERE (SecurityProfile:Risk does not have property whose type is instance of SecurityProfile:RiskAcceptanceLevel \\  & AND SecurityProfile:Risk:RiskLevel is greater than \\  & SecurityProfile:RiskAssessmentConfiguration:: \\  & CriteriaForAcceptingRisks) \\ \multirow{4}{*}{Are there any risks that are not applicable to any asset?} & SELECT all instances of SecurityProfile:Risk \\  & WHERE NOT EXISTS (dependency of \\  & SecurityProfile:ApplicableTo between SecurityProfile:Risk \\  & AND SecurityProfile::Asset) \\ \multirow{4}{*}{Are there any system blocks that are not allocated to assets?} & SELECT all instances of SysML::Blocks \\  & WHERE NOT EXISTS (dependency of SysML::Allocate \\ \cline{1-1}  & between SysML::Block AND SecurityProfile::Asset) \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Questions and algorithms for quantitative model analysis. Figure 12: The change impact map for the “Power” requirement. Primarily, we wanted to find out the participants' current work principles related to system development. For this, we asked if the respondents followed agile modeling practices with fast learning and validation cycles or if they preferred a linear approach (e.g., waterfall methodology). Most (68%) of respondents use agile methods, 22% used a hybrid approach, and 10% preferred the waterfall methodology. As the suggested MBESec method is based on the PDCA model, it should suit the majority of respondents' practices. The next question in this group was related to checking if the security requirements are captured together with the functional and non-functional requirements in the MBSE model. Most (63%) respondents do this, and this leads to the conclusion that the considerations of system security are quite commonly made at the early stage of system development. Next, we asked our respondents to evaluate the importance of security mitigation phases. Most of the participants said that the identification of parts of the system that could be vulnerable is very important or important. More than half of the participants agreed that all the other mentioned security phases are important or very important, too. All the results are provided in Figure 14.  
Furthermore, we asked if the respondents see any other security phases/activities (not mentioned in the previous question) that should be conducted at the early stage of system development; here are the opinions:  
Figure 14: Chart representing the importance of each MBESec method phase. Figure 13: Chart representing how long respondents had been practicing MBSE. * It's not only important to identify parts themselves that could be vulnerable but also their interaction/communication/links with other parts. * Information exchange analysis. * Embed security controls into the processes at all levels. * Calculate vulnerability scores (e.g., CVSS), link security aspects with rest of the design.