[Verse 1] Back in oh-eight they released the spec SBVR promised rules we could respect But adoption stayed low, the uptake was poor Business rules only, not the compliance we're looking for Security domains just passed it by While the standard sat there wondering why [Chorus] Three big weaknesses holding it back Adoption is poor, that's the first crack Tooling is sparse, the second attack Vocabulary burden, the final lack SBVR's struggling to find its track Three weaknesses keeping it off the map [Verse 2] Where are the editors for compliance use? RuleXpress focuses on business, not security rules No SBVR to OSCAL pipeline exists Academic prototypes that barely persist The tooling landscape is thin and weak For the compliance features that we seek [Chorus] Three big weaknesses holding it back Adoption is poor, that's the first crack Tooling is sparse, the second attack Vocabulary burden, the final lack SBVR's struggling to find its track Three weaknesses keeping it off the map [Bridge] Before you write a single rule You need a vocabulary tool Access control, authentication Authorization, documentation Audit logs and incident response Risk and vulnerability of course Control owners, hundreds more Building terms before you explore [Verse 3] Temporal logic gets left behind Sequential steps are hard to find Contain the threat in four hours flat Then eradicate, then recover after that State transitions don't flow well In SBVR's static rule shell [Verse 4] Bold and italic, underline too Font conventions that looked so new But plain text breaks the typing scheme Version control kills the formatting dream Code repos can't handle the style Making collaboration hard for a while [Chorus] Three big weaknesses holding it back Adoption is poor, that's the first crack Tooling is sparse, the second attack Vocabulary burden, the final lack SBVR's struggling to find its track Three weaknesses keeping it off the map [Outro] Five hundred rules in one document Compositionality gets bent No hierarchy to organize the whole Individual rules lose overall control SBVR's weaknesses now you know Why formal languages struggle to grow
← 4 Practical Recommendations | Parse With Confidence All Along →