## 5 Analysis
In this sense, the introduction of over-specification issues throughout the system development process can convert privacy into a serious problem. In this work, the authors performed a controlled experiment with students who analyzed privacy implications using goal-oriented analysis. Some points can be highlighted from this study, for example, this work mentioned RE, but from an NFR perspective only. Thus, it is not a RE methodology or proposal for IoT software systems development. Moreover, the authors did not consider the requirements engineering phases from Section 2 in their entirety. Likewise, the study presents a controlled experiment with students. One drawback of controlled experiments is that they lack external validity (which means that their results may not be generalizable to real-world settings). In [35], the authors propose a framework to evaluate software processes, methods, and other artifacts of software engineering in the design of applications (software) for data analytics driven by the Internet of Things (IoT-DA). Likewise, they carried out an SMS of 16 evaluations (from inside and outside of academia) of software engineering for IoT-DA to compare them and apply their proposal in a case study to demonstrate the development of an IoT-DA healthcare application. This proposal is not entirely focused on requirements engineering. However, in its framework, they consider a phase called software/systems requirements, in which they consider the elicitation of requirements to support practices such as methods, tools, and technologies for identifying the FRs and NFRs of the software. To accomplish this, they suggest the use of ThingsML for (i) the abstraction of hardware and software mapping, (ii) the interaction of things, and (iii) the specification of non-functional properties for IoTs. In [48], the authors propose an IoT application development framework called IADev. It is based on the RestFUL architecture and the model-driven development (MDD) approach. The article is not focused entirely on RE for IoT. IADev uses an attribute-based design to transform requirements into a solution architecture by considering the concerns of all the stakeholders involved. Then, the authors define a set of MDD metamodels for transforming design models into software artifacts. Regarding RE, they define a metamodel called ADDReq, used for obtaining, modeling, and transforming the requirements to identify the components of the system. In this framework, the requirements are prioritized according to the goals proposed by the stakeholders. The requirements in this phase are re-prioritized according to their impacts on the architecture, which can be categorized as high, low, and medium. Then, an impact analysis of the requirements is applied, and the requirements are prioritized in ascending order of relevance. A list of prioritized requirements is generated. Subsequently, with this list of requirements, the authors develop a metamodel, which refers to obtaining, modeling, and transforming the requirements in order to identify the components of the system. Some issues to highlight from this work are that it does not consider the activities of requirements engineering in its entirety, only covering elicitation. It is not a requirements engineering methodology or proposal for IoT software systems development; it is a framework for IoT software systems development. The authors in [49] present a framework called IoT-HarPSecA, which provides assistance through a roadmap in designing and developing IoT devices and applications. Although security requirements are generally considered NFRs, they represent a significant characteristic that prescribes what a system or application requires to obtain a particular security goal. In this framework, the authors consider the elicitation of requirements. They define a functional module that consists of three components: a user response analyzer, a security requirement selector, and a requirement aggregator.