## 5 What Is a Good SRE Methodology?
### Step2: Refinement (\(R^{m}\)) Requirement Analysis  
The second step of our evaluation approach deals with understanding the transformation of high-level abstract characteristic goals into verifiable evaluation criteria. Respectively, the high-level abstract goals realized in step 1 are coarse-grained and should be refined into sub-goals fitting specific demands of the security experts. This refinement process is performed in collaboration with the security experts. Figure 4 provides a sample view of the criteria refinement using KAOS goal modelling notation. This goal refinement extends the study [14, 15]. The refinement uses the AND-construct and is continued until the final refined goals are realized as objectively verifiable. Thus, the leaf goal nodes become an evaluation criteria R\({}^{\text{M}}\). Tracing the goals refinement conforms the correctness of the final evaluation criteria R\({}^{\text{M}}\). Since, we used natural language to describe the criteria and goal modelling notation to express the refinement, the affirmation of evaluation criteria is self-contained in the model. The high-level goals are the quality criteria from our elicitation tool (goals in orange). The elicited interpretations are the immediate sub-goals (in green). It is to note that different colouring of goals is provided solely to facilitate the understanding of the readers and this colouring is not compliant with KAOS notation. In below, we present our arguments relative to the refinement of six quality criteria given in Table 3. It is to note that our arguments are based on our discussions and initial feedback with the security experts involved in the brainstorming process. The goal refinement is subjected to changes with varying needs of the stakeholders. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**No** & **Abstract Definitions** & **Criterion Names in Use** & **Questionnaire** \\ \hline \multirow{5}{*}{C3} & \multirow{5}{*}{Accomplishable within given financial, time, legal, technical constraints} & \multirow{5}{*}{Feasible, Affordable, Legal, Achievable} & \multirow{5}{*}{\begin{tabular}{} \end{tabular} } \\  & & & \\ \cline{1-1}  & & & \\ \hline \multirow{5}{*}{C5} & Requirement should be able to refer back to its objective. & \multirow{5}{*}{\begin{tabular}{} \end{tabular} } \\  & & Traceable, Cohesiveness, & \\ \cline{1-1}  & & Allocated, Satisfied/Qualified & \\ \cline{1-1}  & & be explicitly defined. & \\ \hline \multirow{5}{*}{C6} & Requirements should state what is needed but not how it is met & \multirow{5}{*}{\begin{tabular}{} \end{tabular} } \\  & & & \\ \cline{1-1}  & & & \\ \cline{1-1}  & & & \\ \cline{1-1}  & & & \\ \cline{1-1}  & & & \\ \cline{1-1}  & & & \\ \hline \multirow{5}{*}{C10} & \multirow{5}{*}{\
\begin{tabular}{} \end{tabular} } \\  & & & & \\ \cline{1-1}  & & & \\ \cline{1-1}  & & & \\ \cline{1-1}  & & & \\ \cline{1-1}  & & & \\ \cline{1-1}  & & & \\ \hline \multirow{5}{*}{C11} & Requirements are simple & \multirow{5}{*}{
\begin{tabular}{} \end{tabular} } \\  & & & & \\ \cline{1-1}  & & & \\ \cline{1-1}  & & & \\ \cline{1-1}  & & & \\ \cline{1-1}  & & & \\ \cline{1-1}  & & & \\ \cline{1-1}  & & & \\ \hline \multirow{5}{*}{C20} & Individual requirements should be defined with some attributes or annotations that characterizes them & Attributes, Metadata, Prioritized, Ranked for importance, Degree of stability & \\ \cline{1-1}  & & & \\ \cline{1-1}  & & & \\ \cline{1-1}  & & & \\ \cline{1-1}  & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Elicitation tool (sample). Figure 4: SRE-methodology-to-be goals refinement (Samples). Adequacy (C10) and Metadata (C20)  
The Adequacy criterion stresses that the actual needs of all the stakeholders must be captured. In our project, we refer to the security experts working in network SRE context. We refine the high-level quality goal pertaining to the adequacy quality criterion (Cf. C10 in Figure 4) into \"R\({}^{\text{M}}\)1.1: The SRE-Methodology-to-be should facilitate in capturing the actual needs of network security experts\".