A method for generating one or more system-specific security-definitions (310, 311, 320, 321) for multiple heterogeneous subsystems (S1, S2) of a software system to enforce the security of the software system, the method comprising the following steps: a. storing, in a rule-repository, one or more natural-language security-definitions in XML syntax reflecting a global security intend for the software system which affects the multiple heterogeneous subsystems (S1, S2); b. storing, in the rule-repository, one or more machine-readable security-definitions defined in XACML and a first mapping of each natural-language security-definition onto one or more of the machine-readable security-definitions; c. automatically generating the one or more system-specific security-definitions (310, 311, 320, 321) in XML syntax from the one or more machine-readable security-definitions by one or more rule-converters (RC 1, RC 2) corresponding to the one or more heterogeneous subsystems (S1, S2), wherein the generating is based on a second mapping of each machine-readable security-definition onto one or more of the system-specific security-definitions (310, 311, 320, 321); characterized in d. selecting at least one of the natural-language security-definitions; e. retrieving the one or more affected system-specific security-definitions (310, 311, 320, 321) according to the first and second mapping; f. storing one or more new system-specific security-definitions (310, 311, 320, 321) in the rule-repository; and g. automatically generating one or more machine-readable security-definitions from the one or more new system-specific security-definitions (310, 311, 320, 321) by the one or more rule-converters (RC1, RC2) according to the second mapping. a. storing, in a rule-repository, one or more natural-language security-definitions in XML syntax reflecting a global security intend for the software system which affects the multiple heterogeneous subsystems (S1, S2); b. storing, in the rule-repository, one or more machine-readable security-definitions defined in XACML and a first mapping of each natural-language security-definition onto one or more of the machine-readable security-definitions; c. automatically generating the one or more system-specific security-definitions (310, 311, 320, 321) in XML syntax from the one or more machine-readable security-definitions by one or more rule-converters (RC 1, RC 2) corresponding to the one or more heterogeneous subsystems (S1, S2), wherein the generating is based on a second mapping of each machine-readable security-definition onto one or more of the system-specific security-definitions (310, 311, 320, 321); characterized in d. selecting at least one of the natural-language security-definitions; e. retrieving the one or more affected system-specific security-definitions (310, 311, 320, 321) according to the first and second mapping; f. storing one or more new system-specific security-definitions (310, 311, 320, 321) in the rule-repository; and g. automatically generating one or more machine-readable security-definitions from the one or more new system-specific security-definitions (310, 311, 320, 321) by the one or more rule-converters (RC1, RC2) according to the second mapping.