OT Cybersecurity Requirements Management: How Energy and Utility Teams Stay Compliant and Audit-Ready
Learn how energy and utility teams manage OT cybersecurity requirements...
Eliciting requirements is the visible part of business analysis. Interviewing stakeholders, running workshops, building prototypes: these are the activities most people think of when they picture a business analyst at work. But elicitation produces raw material, not finished requirements. The work of turning that raw material into a specification that designers and developers can build against is the subject of this blog.
Requirements analysis and design definition is the fifth BABOK knowledge area. It covers everything that happens after requirements are gathered and before they are handed to the development team: organizing, modeling, verifying, validating, prioritizing, and defining design options. Done well, it produces requirements that are complete, coherent, testable, and unambiguous. Done poorly, it produces a list of wishes that nobody can build against.
Requirements gathered through interviews, workshops, and observation arrive in a disorganized state. Different stakeholders use different terminology. Some requirements overlap. Some conflict. Some are at a business level while others jump straight to system-level detail. Before any modeling or analysis can be productive, this material needs structure.
A medium-sized project typically demands hundreds of requirements. Readers can only understand these fully when the requirements document is organized logically. The best structure for user requirements follows the natural patterns of use, structured like a scenario or use case.
There are several ways to classify and organize requirements. The right approach depends on the project and the stakeholders.
Stakeholder-Based Classification
Organizing requirements by stakeholder type makes it easy to see whether all voices have been heard and to assign responsibility for sign-off. It also helps with prioritization, because different stakeholders have different weights of authority depending on the project’s goals.
The two broad categories of stakeholders are external (government, customers, vendors) and internal (management, users, other departments). Within each category, the BA should identify the specific groups whose requirements are relevant to the project, and document who their representatives are as early as possible.
Sequence-Oriented Classification
Sequence-based classification organizes requirements from high level to detailed, following the hierarchy of the organization. This hierarchy typically runs:
This structure is powerful because it creates natural traceability. Every system requirement should trace to a user requirement, which should trace to a business requirement, which should trace to an organizational goal or regulatory obligation. If a system requirement cannot be traced upward, it is either scope creep or evidence of a missed requirement at a higher level.
Transition requirements deserve special mention. They deal with the capabilities the solution must have to successfully migrate from the old state to the new one. How much downtime can the business afford during cutover? Is there a need to run old and new systems in parallel? Does historical data need to be converted? These requirements are temporary by nature. They become irrelevant once the transition is complete. But they are often missed until they create expensive implementation problems.
Purpose-Based Classification
Purpose-based classification organizes requirements by the type of functionality they represent. What does the order clerk need? What does the finance department require? What are the reporting requirements? What are the security requirements? This approach maps well to how stakeholders think about their work and makes it easy to structure interviews by functional area.
Models are visual or structured representations of requirements that communicate things text alone cannot. A requirement that takes a paragraph to describe in words can often be communicated more precisely and more reviewably in a diagram. Models also catch different categories of errors. A well-drawn activity diagram will reveal process gaps and exceptions that a text list of requirements would never surface.
The key is selecting the right model for the right purpose. No single model type is sufficient for a complex system. Combining model types gives a more complete picture than any one model alone.
Use cases show how the system will be used by entities external to it. Those entities may be people, organizations, or other systems. A use case should be a standalone action that has business value on its own. Place Order, Pay Invoice, and Check Drug Interaction are examples. Use cases should not be decomposed into sub-use cases; they represent a complete, externally-initiated action.
A use case has two components: the diagram and the template. The diagram shows the big picture: which actors interact with which use cases and what the system boundary is. The template is where the real value lies. A complete use case template includes:
Use cases are developed iteratively. A high-level pass defines scope and gets executive commitment. A broad pass identifies all use cases and actors. A deep pass explores each scenario in detail and captures non-functional requirements. The final iteration serves as the translation point between business analysis and systems design.
Strengths of use cases include their intuitiveness for customers and their natural connection to test case development. Weaknesses include potential duplication of data and non-functional requirements across use cases and the risk of going into too much detail too quickly.
Activity diagrams, also called swim lane or workflow diagrams, are among the most frequently used and most effective modeling techniques. They are intuitive for customers, show process flow in a way that mirrors how people think about their work, and are excellent for capturing communication points between different organizations or systems.
A well-drawn activity diagram shows:
Of all of the models available, a well-drawn activity diagram is often the most enlightening and understandable for the customer.
Activity diagrams serve as a structured guide for requirements elicitation sessions. Walking through the diagram step by step with stakeholders generates a focused set of questions: What information is needed from the customer? What triggers this step? What happens if this decision goes the other way? Each question surfaces requirements that would be easy to miss in an unstructured interview.
The swim lane format adds organizational context to the flow. When each actor or system has its own lane, the handoffs between them become visible. Interface requirements, communication requirements, and coordination requirements often emerge from analyzing these handoffs.
State diagrams illustrate the lifecycle of a business entity. They are particularly useful for entities that change state as they move through a business process. A prescription, for example, might have the following states: written, entered, approved, rejected, filled. Each state transition is triggered by a specific event and may have conditions that must be met.
State diagrams force stakeholders to think explicitly about:
These questions surface requirements that would never emerge from a simple list of features. The requirement that ‘an approved prescription cannot be directly moved back to the written state without going through the rejected state’ is the kind of constraint that a state diagram makes obvious but that an interview might never produce.
Verification and validation are both quality activities applied to requirements, but they are fundamentally different activities that answer different questions.
Verification asks: does this requirement conform to quality standards? Is it clear, complete, consistent, unambiguous, and testable? Verification can be done by the BA team without stakeholder involvement. It is about the quality of the artifact, not the accuracy of the content.
Validation asks: does this requirement actually reflect what the stakeholder needs? A requirement can be perfectly written and completely wrong. Validation requires getting requirements in front of stakeholders in a form they can review and respond to.
Both are essential, and the distinction matters because they require different activities at different times. Verification can be done as requirements are written, using checklists and peer reviews. Validation requires structured stakeholder review, often supported by prototypes, walkthroughs, or model reviews.
Every project faces resource constraints. Not everything in the requirements list can be delivered in the first release. Prioritization determines what gets built first, what gets deferred, and what gets dropped. Without explicit prioritization, the development team makes these decisions implicitly through implementation choices, which is not where business priority decisions should be made.
Prioritization is a facilitated process. The BA organizes the activity and keeps it structured. The business makes the decisions. This is not a role distinction the BA can afford to blur. If the BA sets the priorities, the business loses ownership of the requirements.
Whichever technique is used, the results must be documented and communicated. Changes to priority should go through change control. Changing a Must Have requirement to a Should Have is effectively a scope reduction, and it has implications for the project plan, the budget, and the stakeholder expectations that need to be managed explicitly.
One of the most important things that requirements analysis produces is clarity about the range of acceptable solutions. Once requirements are fully analyzed and documented, the question shifts from ‘What does the business need?’ to ‘How should those needs be met?’
There are more options available than most teams initially consider:
Defining design options is part of the BA’s role precisely because requirements analysis gives the BA the information needed to evaluate these options intelligently. The BA who has done thorough requirements analysis can assess whether a commercial package will meet the requirements, whether a process change alone will address the business need, or whether a full development project is truly necessary.
By spending a little more time up front brainstorming, benchmarking, and exploring different options, a lot of grief can be avoided later. Options that have been reviewed and consciously rejected give the team confidence that the chosen approach was selected on its merits, not simply because it was the first idea that surfaced.
Requirements analysis and design definition produces the artifacts that bridge business analysis and system design. The use case templates, activity diagrams, data models, and prioritized requirement lists that come out of this knowledge area are the handoff package for the development team.
The quality of that handoff determines how much of the subsequent development effort goes into building the right thing versus clarifying what the right thing is. A thorough requirements analysis that produces clear, verified, validated, and prioritized requirements dramatically reduces the disambiguation work that designers and developers otherwise have to do themselves, often making decisions that should have been made during business analysis.
Modern Requirements supports the full requirements analysis workflow inside Azure DevOps. Use case editors and diagramming tools allow BAs to create and share models with stakeholders for review. Smart Docs link requirements to the work items that implement them and the test cases that verify them. Trace Analysis provides a live view of requirement coverage, showing which requirements are fully implemented and tested, which are partially addressed, and which have no corresponding design or test elements. This visibility is what makes requirements analysis a continuous activity rather than a one-time document.
✅ Defina, gestione y realice un seguimiento de los requisitos en Azure DevOps
✅ Colabore sin problemas entre equipos regulados
✅ Empiece GRATIS, sin necesidad de tarjeta de crédito
Learn how energy and utility teams manage OT cybersecurity requirements...
Join Modern Requirements at Info-Tech Live 2026 and witness firsthand...
Learn how to automate FedRAMP SSP and POA&M documentation to...
End-to-end requirements management in Azure DevOps.
AI-powered assistance for DevOps workflows.
Autonomous AI agents for DevOps execution.
Real-time data sync across tools and systems.
Designed to work natively within Azure DevOps, Modern Requirements extends the platform with powerful capabilities that help teams capture, manage, and validate requirements more effectively.