Paméla Baillette

Yves Barlette

Examining CEOs' behavior related to BYOD implementation through the CMUA

Keywords: BYOD, CMUA, CEO, Security paradox, Coping, Behavior

Despite prior research on the 'Bring Your Own Device' (BYOD) phenomenon, little attention has been paid to perceptions of opportunities/threats associated with the implementation of BYOD by CEOs. This quantitative study is based on the coping model of user adaptation (CMUA). We enriched this model with quantitative constructs for assessing the CEOs' beneficial and threatening perceptions of BYOD implementation. We also added CEOs' information security (ISS) concern, in order to identify potential security paradoxes, i.e., discrepancies between their concerns and the adopted coping strategies. Results indicate that perceived opportunities/threats and perceived behavioral control have an impact on the type of coping strategy adopted. This study clarifies the operationalization of an enriched CMUA and offers managerial contributions regarding improved protection of corporate information when implementing BYOD. These are the first results concerning 61 CEOs. The full results will be released during the AIM conference with 200+ responses in May 2018.

Introduction

The BYOD phenomenon, i.e. 'Bring Your Own Device', is growing in businesses and increasingly affecting CEOs. It refers to the provision and use of personal mobile devices (smartphones, tablets or laptops) by employees for both private and business purposes. Even if this way of working takes on many opportunities, such as organizational cost savings [START_REF] Steelman | Charting Your Organization's Bring-Your-Own-Device Voyage[END_REF], increased process performance [START_REF] Zhou | Integrating TTF and UTAUT to explain mobile banking user adoption[END_REF] and productivity gains [START_REF] Leclercq-Vandelannoitte | Leaving employees to their own devices: new practices in the workplace[END_REF][START_REF] Steelman | Charting Your Organization's Bring-Your-Own-Device Voyage[END_REF], it creates additional security breaches resulting in higher risks for companies.

The perception of opportunities and threats and the resulting coping behaviors can be assessed through the CMUA, that is, the coping model of user adaptation [START_REF] Beaudry | Understanding user responses to information technology: A coping model of user adaptation[END_REF], 2010). The CMUA has been successfully used to identify coping behaviors related to the adaptation and use of technologies, and states that after a primary appraisal corresponding to the perception of an event as threatening of beneficial, a second appraisal -based on perceived behavioral control -leads to the adoption of a coping behavior that can be problem-focused (high control over the situation, mainly leading to actions) or emotion-focused (low control, leading to passivity or denial, for example). However, while this model has been quantitatively tested and validated for the second appraisal [START_REF] Elie-Dit-Cosaque | Opening the black box of system usage: User adaptation to disruptive IT[END_REF], to date, there has been no assessment of the primary appraisal using quantitative constructs1 .

Previous research has mainly focused on individuals and highlighted several factors determining the adoption of mobile tools by employees [START_REF] Weeger | It consumerization: BYOD-program acceptance and its impact on employer attractiveness[END_REF]. In a BYOD context, research has chiefly focused on threats to employees' privacy [START_REF] Pentina | Exploring privacy paradox in information-sensitive mobile app adoption: A cross-cultural comparison[END_REF] or employee compliance with information security (ISS) policies (Hovav & Putri, 2016). Less attention has been paid to the perception by CEOs of opportunities and/or threats related to BYOD implementation, and the resulting behaviors.

We aim at contributing to current research by (1) complementing the CMUA with constructs permitting (2) to assess CEOs' perceived threats and opportunities (3) in the specific context of BYOD. In addition, while problem-focused strategies (i.e., 'active' behaviors), are often examined, emotion-focused strategies (i.e., 'passive' behaviors) remain under-researched. Using the CMUA framework will offer insights on CEOs problem-focused and emotionfocused strategies and will permit to compare the influence of their determinants.

The CMUA offers a last advantage: as it allows us in a same model to assess the benefits and threats of BYOD for CEOs, it provides a good basis to examine security paradoxes. In our context, a security paradox can occur when the perception of BYOD advantages outweighs the risks involved, organizations endanger their data by authorizing or encouraging users to work in BYOD mode without implementing sufficient security measures, despite a strong assertion of their concerns about data security (Baillette & Barlette, forthcoming). Therefore, complementing the CMUA model with the construct "information security concern" will permit to identify potential security paradoxes related to the implementation of BYOD in companies.

The next section reviews the relevant literature, the third section explains how we complement the CMUA framework and our hypotheses. Following the methodological section, the fifth section presents our current results. After a short discussion, the conclusion reviews the current state of our research. [START_REF] Beaudry | Understanding user responses to information technology: A coping model of user adaptation[END_REF] built the coping model of user adaptation (CMUA), on the Lazarus' (1966) coping theory. Coping is defined as "the cognitive and behavioral efforts exerted to manage specific external and/or internal demands that are appraised as taxing or exceeding the resources of the person" (Lazarus & Folkman, 1984, p.141). Coping theory states that certain events can trigger adaptive behaviors based on two key sub-processes. The primary appraisal consists in evaluating the potential consequences of the event (threats, opportunities or both) and its personal significance [START_REF] Folkman | Making the case for coping[END_REF]. The secondary appraisal is the evaluation of the coping options available and corresponds to coping efforts, either problem or emotion-focused, depending on the degree of individual's perceived control over the situation. [START_REF] Beaudry | Understanding user responses to information technology: A coping model of user adaptation[END_REF] have adapted the coping theory to IT events, as most IT events can be appraised as both opportunities and threats. Further studies have since confirmed the insights offered by the CMUA [START_REF] Beaudry | The other side of acceptance: Studying the direct and indirect effects of emotions on information technology use[END_REF][START_REF] Elie-Dit-Cosaque | Opening the black box of system usage: User adaptation to disruptive IT[END_REF]. The next subsections deal with the primary and secondary appraisals characterizing coping behaviors. The third subsection introduces the "information security concern" that may allow identification of security paradoxes.

Literature review

Primary Appraisal

The CMUA is based on coping theory, which is "mute regarding what elements of a disruption are used in primary appraisal" (Beaudry & Pinsonneault, 2005, p. 498). Therefore, to enable an assessment of this primary appraisal, i.e., threatening and beneficial events, we complemented the CMUA by adding constructs borrowed from previous research.

Threat Appraisal

Threat related to BYOD implementation and usage is assessed through two constructs, adapted from another coping-based theory, i.e., the Protection Motivation Theory (PMT) [START_REF] Rogers | Cognitive and physiological processes in fear appeals and attitude change: A revised theory of protection motivation[END_REF]. The constructs permitting to assess the first appraisal (threat appraisal) are the individual's perceived vulnerability (e.g., the probability) of the potential event and the individual's perceived severity (e.g., the impact) when the event materializes (see Figure 2).

Benefits maximizing

Disturbance handling

Benefits satisficing

Self-preservation

Opportunity

Threat

Perceived control IT Event

Primary Appraisal

Secondary Appraisal Perceived vulnerability is the probability of occurrence of a threatening event, provided that no adaptive behavior is performed or there is no adaptation of an existing behavior [START_REF] Lee | Threat or coping appraisal: Determinants of SMB executives' decision to adopt anti-malware software[END_REF]. Perceived severity is the perceived impact of an ISS problem, due to insufficient or ineffective ISS measures [START_REF] Liang | Avoidance of information technology threats: A theoretical perspective[END_REF]. In our model, these two construct will represent the underlying formative dimensions of the threat appraisal (See Figure 3).

Adaptation Strategies Appraisal

Opportunity Appraisal

Benefits of BYOD include increased productivity and innovation for the company (Tu & Yuan, 2015). For organizations, benefits are ranging from organizational cost savings [START_REF] Steelman | Charting Your Organization's Bring-Your-Own-Device Voyage[END_REF] to individual task efficiencies and productivity gains [START_REF] Leclercq-Vandelannoitte | Leaving employees to their own devices: new practices in the workplace[END_REF][START_REF] Steelman | Charting Your Organization's Bring-Your-Own-Device Voyage[END_REF]. Therefore, we define the perceived benefits for a CEO to implement BYOD in his/her company as the combination of Business process improvement [START_REF] Law | ERP Systems Adoption: An Exploratory Study of the Organizational Factors and Impacts of ERP Success[END_REF], Cost advantages [START_REF] Benlian | Opportunities and Risks of Software-as-a-Service: Findings from a Survey of IT Executives[END_REF] and Performance expectancy, [START_REF] Moore | Development of an Instrument to Measure the Perceptions of Adopting an Information Technology Innovation[END_REF]Venkatesh et al., 2003, p. 449).

Business process improvement involves the simplification and improvement of work practices and processes through re-engineering (Law & Ngai, 2007, p. 422). BYOD can deliver tangible benefits such as business process improvement [START_REF] Leclercq-Vandelannoitte | Leaving employees to their own devices: new practices in the workplace[END_REF]. [START_REF] Kim | Analysis of the Determinants of Software-as-a-Service Adoption in Small Businesses: Risks, Benefits, and Organizational and Environmental Factors[END_REF] showed that business process improvement was significantly related to perceived opportunity. Cost advantages: Many executives seek to leverage the potential benefits of BYOD, such as cost savings [START_REF] Steelman | Charting Your Organization's Bring-Your-Own-Device Voyage[END_REF]. Allowing employees to use their personal device for corporate purposes contributes to a reduction of investment costs via the private procurement of devices. Further cost savings can be achieved via an external storage of corporate data (Weiss & Lemeister, 2012). Free or low-cost mobile applications "apps" are increasingly integrated into corporate infrastructure (Weiss & Lemeister, 2012). In their research, [START_REF] Benlian | Opportunities and Risks of Software-as-a-Service: Findings from a Survey of IT Executives[END_REF] considered cost advantage as the strongest and most consistent factor affecting perceived opportunities. Performance expectancy is defined as "the degree to which using an innovation is perceived as being better than using its precursor." (Moore & Benbasat, 1991, p. 196). These three constructs are the underlying formative dimensions of the opportunity appraisal (See Figure 3). This primary appraisal (e.g., opportunity or threat) entails a secondary appraisal, consisting of emotion-focused and problem-focused strategies [START_REF] Beaudry | Understanding user responses to information technology: A coping model of user adaptation[END_REF][START_REF] Lazarus | Stress, appraisal, and coping[END_REF].

Secondary appraisal and the four adaptation strategies

The CMUA postulates (See Figure 1) that four coping strategies can be adopted, depending on the perception of the situation and the perceived behavioral control by the individual [START_REF] Beaudry | Understanding user responses to information technology: A coping model of user adaptation[END_REF], 2010). A high level of perceived behavioral control over coping behavior will lead to problem-focused coping strategies (benefits maximizing and disturbance handling), while a low level of perceived behavioral control will lead to more passive (emotionfocused) coping strategies (benefits satisficing and self-preservation). The benefits satisficing strategy corresponds to the use of minimal problem-focused efforts: first, as the situation is perceived as beneficial, there is no actual need to act, and second, as the perceived control is low, the reaction will be mainly emotion-focused. Moreover, as no tensions emanate from the IT event, there is no need to reduce them. Therefore, CEOs will rather passively enjoy the beneficial situation, as they are satisfied with a status quo.

The benefits maximizing strategy occurs when CEOs perceive the IT event as an opportunity and when their perceived control over the situation is high. In such a case, their problemfocused coping strategy aims at maximizing the benefits offered by the IT event. For example, CEOs can focus on increasing their productivity, reducing costs, increase their revenues, benefits from new processes, etc.

The self-preservation strategy corresponds to situations wherein CEOs perceive potential threats but have limited control. The coping strategy they use to reduce the tensions emanating from the IT event is emotion-focused. Six types of adaptation efforts can be adopted: minimization of consequences, passive acceptance, denial, selective attention, positive comparison and distancing.

The disturbance handling strategy corresponds to CEOs appraising a threatening situation and having control over this situation. CEOs' coping efforts will mainly be problem-focused, and they will act to prevent the occurrence of the negative event (e.g., implementing protective measures).

From Information Security Concern to Security Paradoxes

The main danger of BYOD for CEOs is related to their company's information security, which corresponds to the preservation of the information confidentiality, integrity and availability.

Information confidentiality reflects CEOs' desire to avoid disclosure of their corporate information to undesired third parties [START_REF] Hong | Internet privacy concerns: An integrated conceptualization and four empirical studies[END_REF]. Integrity problems include cases when certain types of information are damaged or even erased. Availability issues correspond to situations in which information access is impossible. Previous research has shown that CEOs perform a balance between the perceived disadvantages and benefits of enjoying mobile technologies [START_REF] Keith | Information disclosure on mobile devices: Re-examining privacy calculus with actual user behavior[END_REF]. Hence, CEOs face a dilemma to protect their information or to enjoy the benefits provided by mobile tools and apps. However, they allow their employees to bring their own devices by favoring benefits over security concerns [START_REF] Dinev | An extended privacy calculus model for e-commerce transactions[END_REF]. Therefore, if the perceived benefits are sufficient, CEOs can overlook the dangers arising from the risks they agree to take [START_REF] Keith | Information disclosure on mobile devices: Re-examining privacy calculus with actual user behavior[END_REF][START_REF] Sutanto | Addressing the personalization-privacy paradox: An empirical assessment from a field experiment on smartphone users[END_REF], leading to security paradoxes. Security paradox situations were defined in the introduction of this paper as an imbalance between the protective action implemented and the increased risks stemming from the implementation of a technology involving benefits (i.e., BYOD in our case), despite the expression of high security concerns.

Hypothesis development and Conceptual Model

3.1. Primary appraisal: opportunity and threat

Influence of perceived opportunity on Benefits Maximizing and Benefits Satisficing

Previous research in I.S. showed that the perceived benefits are positively associated with the use of information technologies and applications [START_REF] Benlian | Opportunities and Risks of Software-as-a-Service: Findings from a Survey of IT Executives[END_REF][START_REF] Elie-Dit-Cosaque | Opening the black box of system usage: User adaptation to disruptive IT[END_REF][START_REF] Kim | Analysis of the Determinants of Software-as-a-Service Adoption in Small Businesses: Risks, Benefits, and Organizational and Environmental Factors[END_REF]Moore & Benbasat, 2011). In the context of smartphones, previous studies confirmed that a high perception of BYOD-related benefits favored smartphone adoption and usage (Kim et al., 2013). Consequently, we propose:

• H1a-b: The perception of a BYOD-related opportunity will positively influence the adoption of (a) Benefits Maximizing and (b) Benefits Satisficing strategies.

Influence of perceived threat on Disturbance Handling and Self-preservation

Theories addressing coping behaviors, such as protection motivation theory (PMT) [START_REF] Rogers | Cognitive and physiological processes in fear appeals and attitude change: A revised theory of protection motivation[END_REF], have been adapted to the ISS context [START_REF] Lee | Threat or coping appraisal: Determinants of SMB executives' decision to adopt anti-malware software[END_REF][START_REF] Siponen | Employees' adherence to information security policies: An exploratory field study[END_REF][START_REF] Vance | Motivating IS security compliance: Insights from habit and protection motivation theory[END_REF]. Several studies adapted these theories to smartphone security (Tu et al., 2015) and smartphone-related threats [START_REF] Weeger | It consumerization: BYOD-program acceptance and its impact on employer attractiveness[END_REF][START_REF] Whitten | Mobile device adaptation efforts: The impact of hedonic and utilitarian value[END_REF]. Previous research showed that the perception of an event as a threat [START_REF] Siponen | Employees' adherence to information security policies: An exploratory field study[END_REF][START_REF] Vance | Motivating IS security compliance: Insights from habit and protection motivation theory[END_REF] leads CEOs to behave in a more cautious manner [START_REF] Bulgurcu | Information security policy compliance: An empirical study of rationality-based beliefs and information security awareness[END_REF]. [START_REF] Weeger | It consumerization: BYOD-program acceptance and its impact on employer attractiveness[END_REF] showed that individuals fear that a BYOD program may harm their data. In the context of mobile devices, the perception of this threat is positively associated with the intention to implement countermeasures (Tu et al., 2015). Therefore, we propose:

• H2a-b: The perception of a BYOD-related threat will positively influence the adoption of (a) Disturbance Handling and (b) Self-preservation strategies.

Secondary appraisal: influence of Perceived Behavioral Control

The research model in Figure 3 provides an overview of the hypotheses. We hypothesized that the perceived behavioral control can exert two kinds of effects on the coping behavior, i.e., direct, according to PMT-based studies and moderating, according to the CMUA. Consequently, hypotheses 3-4 were added to address direct effects and hypotheses 7-8 were added to address potential moderating effects, similar in strength and direction (Figure 3).

Perceived Control over BYOD implementation

This variable refers to "how much influence users feel they have over the features and functionalities of the IT" (Beaudry & Pinsonneault, 2005, p. 500). When perceived control is high, for instance, people apply their IT competence to achieve better performance [START_REF] Beaudry | Understanding user responses to information technology: A coping model of user adaptation[END_REF][START_REF] Harris | IT consumerization: When gadgets turn into enterprise IT tools[END_REF]. CEOs with high perceived control will mainly adopt problem-focused responses [START_REF] Beaudry | Understanding user responses to information technology: A coping model of user adaptation[END_REF][START_REF] Elie-Dit-Cosaque | Opening the black box of system usage: User adaptation to disruptive IT[END_REF]. Conversely, when CEOs perceive that they have low control over the situation, they will mainly adopt an emotion-focused coping strategy (See Table 1). Hence, we propose:

• H3a-b (direct effect): When CEOs appraise the situation as an opportunity, the more perceived control they have over benefitting from BYOD, (a) the more inclined they will be to adopt a benefits maximizing strategy and (b) the less inclined they will be to adopt a benefits satisficing strategy. • H7a-b (moderating effect): When CEOs appraise the situation as an opportunity, the level of perceived control they have over benefitting from BYOD will moderate (a) positively the relationship between the BYOD-related opportunity and the benefits maximizing strategy and (b) negatively the relationship between the BYOD-related opportunity and the benefits satisficing strategy.

Perceived Control over BYOD-related security measures implementation

This variable corresponds to "the degree that the individual believes it is possible to implement the protective behavior" (Vance et al., 2012, p.190), which, in this study, refers to implementing data protection measures in the company. When a situation is perceived as threatening, the protection motivation becomes stronger and results into two alternatives [START_REF] Moser | How people perceive and will cope with risks from the diffusion of ubiquitous information and communication technologies[END_REF]: high levels of perceived control over information protection are associated with threat-reducing actions, while, when no behavior alternative is perceived as reliable, people choose emotion-focused, e.g., non-protective responses. Prior research has found that increased threat appraisal, as well as increased coping efficacy, intensified the protective responses [START_REF] Moser | How people perceive and will cope with risks from the diffusion of ubiquitous information and communication technologies[END_REF]. Consequently, the following hypotheses are proposed:

• H4a-b (direct effect): When CEOs appraise the situation as a threat, the more perceived control they have over information protection, (a) the more inclined they will be to adopt a disturbance handling strategy and (b) the less inclined they will be to adopt a selfpreservation strategy. • H8a-b (moderating effect): When CEOs appraise the situation as a threat, the level of perceived control they have over information protection will moderate (a) positively the relationship between the BYOD-related threat and the disturbance handling strategy and (b) negatively the relationship between the BYOD-related threat and the self-preservation strategy.

Influence of information security concern and security paradoxes

Information security concern was added in order to identify potential security paradoxes by juxtaposing the CEOs' expressed information security concern with their primary appraisal (beneficial or threatening) and the appropriateness of their adopted coping strategies.

Hypotheses on the effect of information security concern

Previous literature showed that concern about potential information loss of confidentiality negatively affects the extent of adopting mobile apps [START_REF] Pentina | Exploring privacy paradox in information-sensitive mobile app adoption: A cross-cultural comparison[END_REF], and the adoption intention to use e-commerce or personalization services [START_REF] Dinev | An extended privacy calculus model for e-commerce transactions[END_REF][START_REF] Guo | The privacy-personalization paradox in mHealth services acceptance of different age groups[END_REF][START_REF] Li | Willing to pay for quality personalization? Trade-off between quality and privacy[END_REF][START_REF] Sutanto | Addressing the personalization-privacy paradox: An empirical assessment from a field experiment on smartphone users[END_REF]. In other studies, information privacy concern was also found to exert a negative moderating role on the relationship between the perception of a benefit and continuance intention to use social network services (Ku et al., 2013).

Consequently, we hypothesize that information security concern can exert direct and/or moderating effects. Hypotheses 5-6 were added to address direct effects, while hypotheses 9-10 were added to address moderating effects (see Figure 3). Therefore, we propose:

• H5a-b (direct effect): When CEOs appraise the situation as beneficial, their information security concern will exert a negative effect, (a) on the adoption of a benefits maximizing strategy and (b) on the adoption of a benefits satisficing strategy. • H9a-b (moderating effect): When CEOs appraise the situation as beneficial, the level of their information security concern will exert a negative moderating effect (a) on the relationship between the BYOD-related opportunity and the benefits maximizing strategy and (b) on the relationship between the BYOD-related opportunity and the benefits satisficing strategy.

Previous literature showed that individuals with higher privacy concern were found to adopt more restrictive privacy settings [START_REF] Utz | The privacy paradox on social network sites revisited: The role of individual characteristics and group norms[END_REF] and to adopt more protective behaviors and privacy policy consumption [START_REF] Stutzman | Factors mediating disclosure in social network sites[END_REF]. Consequently, we propose:

• H6a-b (direct effect): When CEOs appraise the situation as a threat, a higher information security concern will exert (a) a positive effect on the adoption of a disturbance handling strategy and (b) a negative effect on the adoption of a self-preservation strategy. • H10a-b (moderating effect): When CEOs appraise the situation as a threat, a higher level of their information security concern will exert (a) a positive moderating effect on the relationship between the BYOD-related threat and the disturbance handling strategy and (b) a negative effect on the relationship between the BYOD-related threat and the selfpreservation strategy.

Information security concern and identification of potential security paradoxes

When CEOs perceive an event as beneficial, information security concern should not have any direct or moderating effect on the choice between benefits maximizing and benefits satisficing strategies. According to the CMUA, perceived control should be the only factor influencing this choice. Table 2 summarizes the expected effects of information security concern on coping strategies and the potential occurrence of security paradoxes.

Table 2. Information security concern and potential security paradox

Other paradoxes could be identified if there is no significant impact of behavioral control on protective strategies or if specific subgroups with abnormal behaviors can be established.

Coping

Research Method

Research Design

In order to determine the coping behaviors stemming from the CEOs' perception of BYOD implementation and the possible occurrence of security paradoxes, we conducted a questionnaire-based survey. The details of the variables and items used in the questionnaire can be found in Appendix. Those items were first discussed during three professional workshops conducted by the authors on BYOD and then pre-tested through face-to-face interviews with CEOs (N=12). Based on the interviewees' feedback, the questions' readability and understandability were improved through several rounds. The web-based questionnaire was created using the Qualtrics tool. An introductory section of the questionnaire presented the purpose of the study and defined the major terms (BYOD, personal device, information security, etc.). Participation in the study was voluntary, and respondents were assured that individual responses would be treated with anonymity and confidentiality.

We included a link to this questionnaire in an email presenting our survey. This survey involved CEOs willing to implement or having implemented BYOD in their company. The questionnaire was administrated through business school alumni and companies from various incubators, during November 2017. A total of 74 responses were collected. After removing incomplete and invalid responses, 61 usable responses were obtained. The collected data were analyzed using SmartPLS 3.2.7.

Construct operationalization and measures

In order to reduce the number of relationships in our structural model and make it more parsimonious and easier to apprehend (Hair et al., 2018, p.40), we modelled the first appraisal though two second-order reflective-formative constructs [START_REF] Hair | A primer on partial least squares structural equation modeling (PLS-SEM)[END_REF]. Higher-order constructs are better predictors of broadly defined behaviors, and they overcome the jangle fallacy [START_REF] Hair | Advanced issues in partial least squares structural equation modeling[END_REF]. Hence, BYOD-related opportunity was operationalized as a second order construct composed of three constructs: business process improvement, cost advantages and performance expectancy. BYOD-related threat was operationalized as a second order construct composed of perceived severity and perceived vulnerability (Figure 3).

The questionnaire and the scales used in this study (see Appendix 1) were adapted from previously validated research:

• The Business process improvement (BPI) scale was adapted from [START_REF] Law | ERP Systems Adoption: An Exploratory Study of the Organizational Factors and Impacts of ERP Success[END_REF],

Cost advantages (CA) scale comes from [START_REF] Benlian | Opportunities and Risks of Software-as-a-Service: Findings from a Survey of IT Executives[END_REF] and Performance expectancy (PERF) was borrowed from [START_REF] Moore | Development of an Instrument to Measure the Perceptions of Adopting an Information Technology Innovation[END_REF].

• The perceived severity (SEV) and perceived vulnerability (VULN) scales used measures adapted from [START_REF] Vance | Motivating IS security compliance: Insights from habit and protection motivation theory[END_REF] and [START_REF] Siponen | Employees' adherence to information security policies: An exploratory field study[END_REF];

• The information security concern (ISC) scale was adapted from [START_REF] Malhotra | Internet users' information privacy concerns (IUIPC): The construct, the scale, and a causal model[END_REF];

• The scales corresponding to the four coping strategies were mainly borrowed from [START_REF] Beaudry | Understanding user responses to information technology: A coping model of user adaptation[END_REF], Elie-Dit-Cosaque and Straub (2011) and [START_REF] Workman | Security Lapses and the Omission of Information Security Measures: A Threat Control Model and Empirical Test[END_REF].

All items were measured using 7-point Likert scales anchored at 1="Strongly disagree" and 7="Strongly agree".

Three control variables (CVs) were included in the model: Owner (OWNER) was included in the form of a dummy variable (Non-owner=0; Owner=1). Size (SIZE) represents the company's size; Education (EDUC) is detailed in appendix A.

Data Analysis and first Results 2

To validate the measurements and test hypotheses, we used Partial Least Squares Structural Equation Modeling (PLS-SEM) analyses. This approach has a broad scope and is flexible with regard to theory and practice [START_REF] Richter | European management research using partial least squares structural equation modeling (PLS-SEM)[END_REF]; it can also be used to address small sample sizes [START_REF] Hair | A primer on partial least squares structural equation modeling (PLS-SEM)[END_REF] and second order constructs (Hair et al., 2017a). Moreover, in large and complex models, PLS-SEM is "virtually without competition" [START_REF] Richter | European management research using partial least squares structural equation modeling (PLS-SEM)[END_REF].

Descriptive statistics

The average CEOs' age is 41 years old. The proportion of male vs. female CEOs is 75/25 percent. The sample mainly contained SMEs (27 very small, 11 small, 4 medium enterprises) and only 2 large enterprises. We expect larger companies in our extension of the study.

Model Assessment

Overall Fit A bootstrapping test was performed on 5,000 iterations [START_REF] Hair | A primer on partial least squares structural equation modeling (PLS-SEM)[END_REF][START_REF] Henseler | Using PLS path modeling in new technology research: Updated guidelines[END_REF]. The model fit was tested through standardized root mean square residual (SRMR): value of 0.117 slightly exceeds the threshold of 0.100 for the estimated model [START_REF] Hair | A primer on partial least squares structural equation modeling (PLS-SEM)[END_REF]. Measurement Model Analysis Indicator Reliability and Constructs' Internal Consistency Reliability (See table B1 in Appendix B): All composite reliability values are within the interval [0.7-0.95], meeting the "satisfactory to good" condition [START_REF] Hair | A primer on partial least squares structural equation modeling (PLS-SEM)[END_REF]. All AVE (average variance extracted) values but one are over 0.5, indicating good convergent validity of the constructs [START_REF] Henseler | Using PLS path modeling in new technology research: Updated guidelines[END_REF]. Discriminant Validity See tables B1-B2 in Appendix B. For each construct, the squared root of the AVE exceeds the highest correlation with other constructs. Hence the Fornell-Larcker criterion is met [START_REF] Fornell | Evaluating structural equation models with unobservable variables and measurement error[END_REF]. All heterotrait-monotrait ratios of correlations (HTMT) are smaller than 0.90 (Henseler, Ringle & Sarstedt, 2015, 2016), exhibiting acceptable discriminant validity. Reflective-formative second order constructs assessment: All tests exhibit satisfying results (see Tables B3 in Appendix B).

Structural Model Analysis

Figure 4 shows the current R² (N=61). The bootstrapping test provided the estimates of standard errors for testing the statistical significance of the path coefficients using t-tests and p values. Our first results still lack significance for now as they solely represent 61 responses. However, some results are already salient while other are promising. When BYOD is perceived as beneficial, it influences positively (β=0.56***) the benefits maximizing strategy (R²= 0.61). Information security concern could also moderate positively and reinforce this influence (β=0.47°). There is a hint for a smaller positive influence (β=0.29°) on the benefits satisficing strategy (R²= 0.43). The perception of a threatening event will strongly influence (β=0.52**) the disturbance handling behavior (R²= 0.44) while strongly negatively (β=-0.54**) influencing the self-preservation coping strategy (R²= 0.50). Information security concern exerts a positive and significant direct influence (β=0.29*) on the disturbance handling coping strategy. For now, the perceived behavioral control does not exert any significant influence, neither direct nor moderating.

Common Method Bias Assessment

The survey data were self-reported and behavior was self-assessed by respondents and was not actually measured (Straub et al., 1995). Consequently, our results can potentially be confounded by common method bias (Podsakoff et al., 2003). Hence, we used several means of assessing and minimizing the potential common method bias. First, we used the recommended a priori procedural remedies [START_REF] Podsakoff | Sources of method bias in social science research and recommendations on how to control it[END_REF], such as improvements to scale items through pretests to reduce potential ambiguities, as well as breaking the routine of Likert scales with 'yes/no' or multiple choice questions. Second, we applied the correlational technique [START_REF] Lindell | Accounting for common method variance in cross-sectional research designs[END_REF]: Its assessment of the extent to which CMV may be biasing the results of PLS-SEM studies has been validated by Malhotra et al. (2015). For that purpose, we included in our model [START_REF] Simmering | Marker variable choice, reporting, and interpretation in the detection of common method variance: A review and demonstration[END_REF] an a priori 'ideal' marker variable (MV), the "blue attitude", (the three items can be found in Appendix A) theoretically uncorrelated with other variables included in the model. Our results demonstrate that the average correlation between the marker variable and the latent factors included in the model does not exceed 3.47%, well below the threshold of 9% (Tehseen et al., 2017). Third, the results of the structural model showed different levels of significance for the path coefficients. For these reasons, CMV bias is unlikely to be a serious concern in our study.

Discussion

Interpretation of Results (N=61)

Table 3 below highlights the main effects observed and the validation of hypotheses. 6.1.1 Effects of Perceived behavioral Control For perceived control over BYOD implementation, some important beta values begin to appear, while still not significant. For a beneficial event, a moderating effect could appear, but counterintuitive: being negative (β=-0.42) for the benefits maximizing strategy and positive (β=0.38) for the benefits satisficing strategy. No direct effects were identified. When addressing perceived control over information security measures implementation, the most important beta is a direct effect on the disturbance handling strategy (β=0.23). No moderating effects were identified. Perceived opportunity (H1a, β=0.56***) influences the adoption of benefits maximizing strategies, and possibly influences (H1b, β=0.29°) the benefits satisficing strategy. Perceived threat has the same but opposite strength of effect on the adoption of disturbance handling strategies (H2a, β=0.52**) and (H2b, β=-0.54**).

Effects of Information Security Concern

InfoSec Concern exerts only one direct effect on the disturbance handling strategy (H6a, β=0.29*). For the probable effects, a positive moderating effect could exist, thus reinforcing the relationship between the perception of a BYOD-related opportunity and the benefits maximizing strategy. This could lead to a security paradox. InfoSec Concern could also have a negative direct effect on the benefits satisficing strategy (H5b, β=-0.18).

As hypothesized for H5a and H9b, in these cases InfoSec concern had no influence on coping strategies related to positive appraisals.

Effects of Control Variables

The only effect identified was related to the ownership of the company, negatively influencing the benefits satisficing strategy (β=-0.28). Owners are more likely to be just satisfied with the implementation of BYOD. This counterintuitive and interesting result has already been identified by [START_REF] Barlette | CEOs' Information Security Behavior in SMEs: Does Ownership Matter? Systèmes d[END_REF]. Multigroup analyses will be performed when we reach our goal of 200+ responses.

Theoretical Contributions

This research offers several theoretical contributions. Very little work has been published in the field of information systems about the benefits and risks associated with CEOs' BYODrelated practices. This paper is the first to aim at identifying CEO's information security paradox related to BYOD implementation.

Second, this paper models and operationalizes the CMUA through structural equations and extends it via several exogenous latent variables. The CMUA was extended to beneficial appraisals with constructs adapted from [START_REF] Moore | Development of an Instrument to Measure the Perceptions of Adopting an Information Technology Innovation[END_REF] and [START_REF] Kim | Analysis of the Determinants of Software-as-a-Service Adoption in Small Businesses: Risks, Benefits, and Organizational and Environmental Factors[END_REF] and to threatening appraisals by constructs borrowed from the PMT [START_REF] Rogers | Cognitive and physiological processes in fear appeals and attitude change: A revised theory of protection motivation[END_REF][START_REF] Siponen | Employees' adherence to information security policies: An exploratory field study[END_REF][START_REF] Vance | Motivating IS security compliance: Insights from habit and protection motivation theory[END_REF]. The 'perceived control over behavior' construct was operationalized with moderated and direct effects: some results are promising in obtaining insights regarding how to operationalize this construct in future research.

Third, this study shows that information security concern can exert effects on the adopted coping behaviors. In the field of information security, this concern deserves more inclusion in models addressing coping behaviors.

Managerial Contributions

This study intended to identify how BYOD can be perceived by CEOs through their appraisal of BYOD, as an opportunity or a threat. Identifying security paradoxes, i.e., an overlook of threats to benefit from the BYOD-related perceived opportunities, would allow to build countermeasures. Increasing the perception of potential threats by showing the most common security issues and their potential impacts through real-life examples could decrease selfpreservation behaviors corresponding to denial -"Risks will not affect me"-and distancing -"I cannot do anything" (see Appendix). This would also enhance disturbance handling behaviors, resulting in higher information security for CEOs and their companies. Even if CEOs are not specialists, they could provide more funding for security measures, or support the implementation of charters, training sessions or awareness raising campaigns.

Conclusion

This study applied the CMUA to the context of information protection related to BYOD practices. The CMUA was enriched with constructs allowing the assessment of beneficial and threatening situations. Perceived behavioral control was modeled as having potential direct and moderating effects. Information security concern was also added to the model to identify security paradoxes.

Our first results are based on 61 responses. We will provide more reliable results for the AIM conference, as our goal is to obtain 200+ responses by May 2018. No security paradoxes could be identified for the moment, but we remain confident, as we could identify paradoxes in another study addressing employees' BYOD-related behaviors through the CMUA. Potential risks resulting from BYOD will not affect my company's information security. I cannot do anything against the risks related to BYOD use.

Appendixes

Figure 1 .

 1 Figure 1. The CMUA model. Adapted from Beaudry & Pinsonneault (2005).

Figure 2 .

 2 Figure 2. The PMT -Threat appraisal. Adapted from Rogers (1983).

Figure 3 .

 3 Figure 3. Research model(dotted arrows: moderating effects)

Figure 4 .

 4 Figure 4. Results and significance of path coefficients 3 *** p<0.001, ** p<0.01, * p<0.05, ° p < 0.16 4

  the minimum I need to in order to implement BYOD in my company. Benefits Satisficing (Beaudry & Pinsonneault, 2005; Elie-Dit-Cosaque & Straub, 2011)

Coping Appraisal Threat Appraisal

	Perceived Severity
	Perceived Vulnerability
		Protection
	Response efficacy	Motivation
	Self-efficacy
	Response Cost

Table 1 . Effect of perceived control on the coping strategies of user adaptation

 1 Table 1 below summarizes these four coping strategies.

	Secondary appraisal	Low control	High control
	Primary appraisal	Emotion-focused	Problem-focused
	Opportunity	Benefits Satisficing	Benefits Maximizing
	Threat	Self-Preservation	Disturbance Handling

(adapted from

[START_REF] Beaudry | Understanding user responses to information technology: A coping model of user adaptation[END_REF]

Table 3 . Effects and Hypotheses validation

 3

		# Hyp.	Variable Influence	Beta T Statistics P Values Hyp Validation
		1a Opport -> Benef Max	0.560	5.201	0.000	Yes
		1b Opport -> Benef Sat	0.286	1.418	0.157	Possible (*)
		2a Threat -> Disturb Handl	0.519	3.101	0.002	Yes
		2b Threat -> Self Preserv	-0.539	3.255	0.001	Yes
		3a Control Implement -> Benef Max	0.052	0.445	0.656	No
	Direct Effects	3b Control Implement -> Benef Sat 4a Control Protect -> Disturb Handl	-0.024 0.230	0.113 1.271	0.910 0.204	No Possible (*)
		4b Control Protect	-> Self Preserv	-0.087	0.638	0.524	No
		5a InfoSec Concern -> Benef Max	-0.159	1.108	0.268	No
		5b InfoSec Concern -> Benef Sat	-0.181	1.206	0.228	No
		6a InfoSec Concern -> Disturb Handl	0.287	1.961	0.049	Yes
		6b InfoSec Concern -> Self Preserv	-0.146	0.756	0.450	No
		7a Control Impl Opport -> Benef Max	-0.423	1.151	0.250	Possible (*)
		7b Control Impl Opport -> Benef Sat	0.381	1.137	0.256	Possible (*)
		8a Control Prot Threat -> Disturb Handl	0.057	0.203	0.839	No
	Moderating Effects	8b Control Prot Threat -> Self Preserv 9a InfoSec Concern Opport -> Benef Max	0.218 0.465	0.996 1.564	0.319 0.118 No/Paradox (*) No
		9b InfoSec Concern Opport -> Benef Sat	0.206	0.708	0.479	No
		10a InfoSec Concern Threat -> Disturb Handl -0.114	0.680	0.497	No
		10b InfoSec Concern Threat -> Self Preserv	0.217	1.079	0.281	No

(*) These effects could become significant when more data is collected

[START_REF] Elie-Dit-Cosaque | Opening the black box of system usage: User adaptation to disruptive IT[END_REF] used scenarios to assess the primary appraisal.

Due to page count restrictions and as additional responses are expected, only some results are reported in appendixes. Our full results will be provided for the AIM conference.

I have minimal expectations about being satisfied with the implementation of BYOD in my company.

I regularly take measures to protect my company from information security issues resulting from BYOD.

I intend to take measures to prevent unauthorized access to my company's data through BYOD tools.

I intend to take data protection measures to prevent others from getting my company's confidential data from BYOD tools. I do not take precautions in my company against information security violations resulting from BYOD implementation. Disturbance handling (Beaudry & Pinsonneault, 2005; Workman et al., 2008; Tu et al., 2015) Self-preservation (Beaudry & Pinsonneault, 2005; Workman et al., 2008; Moser et al., 2011) Implementing a BYOD program enables my company to operate more quickly. Implementing a BYOD program enhances my company's effectiveness. To implement a BYOD program effectively, I believe I have what I need. When implementing BYOD in my company, I believe I have a good control over the implementation process. I can implement data protection measures in my company by myself when working in BYOD mode.

An information security problem can occur if I implement or allow BYOD in my company. My company's data can be subject to a threat if I implement or allow BYOD in my company. My company's data can be threatened if I implement or allow BYOD in my company.

If I lost my company's data through the use of BYOD, there would be serious problems for my company.

If my company's data were temporarily not available through the use of BYOD, serious problems would result for my company. An information security breach resulting from BYOD would have a serious negative impact for my company.

Overall, I believe that adopting BYOD is an appropriate measure to lower costs of application provision.

BYOD permits to access resources (mobile tools and applications) at lower costs than our company can. Adopting applications via BYOD lowers the costs that arise from delivering applications.

New work processes that are introduced through BYOD are easier to work with than earlier ones. Implementing a BYOD program increases my company's productivity. Work processes are improved or established through BYOD to facilitate coordination of activities within my company. Work processes are improved or established through BYOD to facilitate coordination of activities outside my company. Implementing a BYOD program improves the quality of the work done in my company.

Funding: This research received financial support from the French National Research Agency through the program 'Investments for the future' under reference number ANR-10-LabX-11-01.

Four Coping Strategies

In general, I am very concerned about threats to my company's information.

I am concerned that my company's information stored into my employees' mobile tools for professional reasons, could be used for other reasons. I am concerned that my company's information stored into my employees' mobile tools for professional reasons are not protected from unauthorized access. 1: Self-taught; 2: NVQ1-2; 3: A level; 4: Higher education; 5 BA/BS; 6: MS/MA and higher Y/N Protecting my company's data is easy for me when working in BYOD mode. I have the capability to solve problems when I implement in my company data security measures when working in BYOD mode.

My efforts are focused on maximizing the benefits I can reasonably expect from BYOD implementation in my company. My aim is to exploit as much as I can in my company the advantages and capabilities provided by BYOD. I consider implementing BYOD in my company will help to achieve greater performance. I am barely satisfied, but still satisfied with the benefits resulting from BYOD implementation in my company.

Appendix B: Measurement model Table B1: Construct's internal consistency

Squared root of the AVE in bold, along the diagonal.

Table B2: Discriminant Validity (HTMT)

Tables B3: Validity of the second order constructs

First order constructs' internal consistency

Composite reliability is > 0.7 and AVE are > 0.5.

Variance Inflation factors VIF

All VIF are < 5: potential collinearity between the constructs forming the second order constructs is not a critical issue in this model (Hair et al., 2018, p.62).

Path coefficient and significance of First order constructs on second order constructs.

Path coefficient are relatively balanced and exhibit strongly significant P-values.


Andrey Sadovykh
email: andrey.sadovykh@softeam.fr

Adnan Ashraf
email: adnan.ashraf@abo.fi

Alessandra Bagnato
email: alessandra.bagnato@softeam.fr

Dragos Truscan
email: dragos.truscan@abo.fi

Pierluigi Pierini
email: pierluigi.pierini@intecs.it

Hugo Bruneliere
email: hugo.bruneliere@imt-atlantique.fr

Orlando Avila-Carcia
email: orlando.avila@atos.net

Wasif Afzal
email: wasif.afzal@mdh.se

Model-Based System Engineering in Practice: Document Generation -MegaM@Rt2 Project Experience

Keywords: engineering → Software systems models; Model-driven software engineering document generation, requirements, model-based system engineering, model-driven software engineering, UML, SysML, traceability

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

INTRODUCTION

MegaM@Rt2 is a three-years project, funded by European Components and Systems for European Leadership Joint Undertaking (ECSEL JU) under the H2020 European program, that started in April 2017 [START_REF] Afzal | The MegaM@Rt2 ECSEL Project: MegaModelling at Runtime-Scalable Model-Based Framework for Continuous Development and Runtime Validation of Complex Systems[END_REF][START_REF] Bruneliere | The MegaM@Rt2 Approach and Tool Set[END_REF][START_REF]MegaM@Rt2 project web-site[END_REF][START_REF] Afzal | The MegaM@Rt2 ECSEL project: MegaModelling at Runtime -Scalable model-based framework for continuous development and runtime validation of complex systems[END_REF]. The main goal is to create an integrated framework incorporating methods and tools for continuous system engineering and runtime validation and verification (V&V). The underlying objective is to develop and apply scalable model-based methods and tools, in order to provide improved productivity, quality, and predictability of large and complex industrial systems.

One of the main challenges is to cover the needs coming from diverse and heterogeneous industrial domains, going from transportation and telecommunications to logistics. Among the partners providing case studies in the project, we can cite Thales, Volvo Construction Equipment, Bombardier Transportation and Nokia. These organizations have different product management and engineering practices, as well as regulations, commercial and legal constraints. This results in a large and complex catalogue of requirements to be realized by the architecture building blocks at different levels of abstraction. Thus, the development of the MegaM@Rt2 framework is based on a feature-intensive architecture and on a related implementation roadmap.

The MegaM@Rt2 framework plans to integrate more than 29 tools implementing the above-mentioned methods and satisfying requirements of the case studies. The tool features are grouped into three complementary conceptual tool sets:

MegaM@Rt2 Systems Engineering Tool Set regroups a variety of current engineering tools featuring standard and domain specific languages and methodologies, e.g.: AADL, EAST-ADL, Matlab/Simulink, AUTOSAR, Method B or Modelica, SysML and UML, in order to precisely specify both functional and non-functional properties. Moreover, system level V&V and testing practices are also supported by this tool set, in order to assess the correctness of the model. MegaM@Rt2 Runtime Analysis Tool Set seeks to extensively exploit system data obtained at runtime. Different methods for model-based V&V and modelbased testing (MBT) are rethought and/or extended for runtime analysis. Model-based monitoring allows to observe executions of a system (in its environment) and to compare it against the executions of corresponding model(s). Monitoring also allows a particular system to be observed under controlled conditions, in order to better understand its performance.

MegaM@Rt2 Model & Traceability Management

Tool Set is a key part of the framework as it is dedicated to support traceability between models across all layers of the system design and execution (runtime). This can go from highly specialized engineering practices to low-level monitoring. Relying on the unification power of models, it should provide efficient means for describing, handling and keeping traceability/mapping between large-scale and/or heterogeneous software and system artefacts. In the context of the Model-driven Architecture (MDA) and Model-based approaches, developed and deployed in the last two decades, automated document generation was foreseen as one of the primary benefits [START_REF]OMG: Model Driven Architecture (MDA) Guide rev. 2.0[END_REF][START_REF] Ruscio | Guest editorial to the special issue on success stories in model driven engineering[END_REF]. Indeed, models as the first-class entities of the engineering process should contain all the necessary information for the design documentation. Automated document generation was one of the first benefits offered by the Modeldriven Architecture (MDA) [START_REF]OMG: Model Driven Architecture (MDA) Guide rev. 2.0[END_REF][START_REF] Ruscio | Guest editorial to the special issue on success stories in model driven engineering[END_REF]. Indeed, models as the firstclass entities of the engineering process should contain all the necessary information for the design documentation. However, several related challenges arise. First, the software architecture team should decide the right organization for the global architecture model. Second, it should be carefully planned what level of details is appropriate for the design of the individual contributions. Third, it should be considered that the architecture model will be used during the project's timeframe for numerous purposes, thus it needs to accommodate unforeseen changes in methodology. Fourth, several documents need to be generated by extracting the relevant information from all over the architecture model.

In this paper, we present our experience on providing and using model-based tool support for on providing model-based tool support for generating documentation necessary for documenting the project (e.g, via deliverables) with respect to the definition of MegaM@Rt2 framework architecture, of the solution to be implemented in the context of the project and of the corresponding roadmap for the development of architecture components throughout the project. In particular, we focus on the document generation challenges and practical solutions to these.

DOCUMENT GENERATION CHALLENGES

Documentation is an inherent part of any engineering process that contributes to quality, maintainability and reusability of produced systems. Arguably, there is no clean engineering process without a proper documentation. As an example, ISO supports the software engineering process with a set of standards dedicated to different audience such as designers, developers, testers, managers, suppliers and agile team members [START_REF]Systems and software engineering -Life cycle processes -Requirements engineering[END_REF][START_REF]Systems and software engineering -Systems and software Quality Requirements and Evaluation (SquaRE) -System and software quality models[END_REF]. The famous ISO 9001 defines a set of mandatory documents including e.g. the requirements specifications. Another popular set of standards is European Space Agency system engineering standards ECSS-E-40 / ECSS-Q-80, also strongly requiring a set of documents and reports to accompany the engineering process on various levels. This includes software-requirement analysis, top-level architectural design, design of software and hardware items, test reports, and user documentation. These documents include mandatory parts that are particularly important on various stages of the process. Many times, the documentation is also a contractual obligation or a part of a certification.

In the meantime, the documentation is an extremely tedious task. The documentation should be readable, useful, consistent and always up-to-date. These characteristics are very difficult to achieve. Documentation is a mechanical production of specifications that often cannot follow the pace of engineering work. Thus, many developers consider this as a useless task that can sometimes contribute to confusing situations. Consequently, agile approaches encourage developers to limit the documentation effort to bare minimumnotes in code should be enough. While such approaches can be appropriate for small-to-medium size projects, they are often not relevant or even counterproductive in larger and/or critical projects.

Model-driven and model-based approaches suggest generating documents from a system model by extracting relevant information such as diagrams, textual descriptions and dependencies. The major benefit is the possibility to regenerate the documents when needed, thus having in place always updated "live" documents that can follow precisely the best standards. The main challenge is about defining the right generation templates for multiple documents:

Various parts of the model are used in different documents. Requirements in the requirement specifications. Interface definitions in analysis documents;

Level of details varies depending on the document type and the audience;

The choice of the "target platform" for document generation, e.g. MS Word or HTML would require changes in structure and style of the documents. Word documents are usually supposed to be read sequentially, while web pages should be easy for navigation in sporadic manner. Considering the above-mentioned challenges, it is essential to structure and define the model properly as well as to define how the information is shared and used in different documents depending on its goal and intended audience. In order to deal with these challenges in a practical way we suggest the following steps:

Define a structure of an architecture model based on the most important information to be shared within the team at the current stage of the project; Define a structure of reports, which are supposed to benefit of generation; Define which information should be extracted from the model, in order to contribute to the report; Develop tool support. In the following sections, we will further describe our approach based on the MegaM@Rt2 project experience.

MEGAM@RT2 ARCHITECTURE MODEL SPECIFICATION

The architecture model had to support the inception phase of the MegaM@Rt2 project and a set of contractual reports to be delivered during the project. At this phase, it was essential to lay down the user requirements coming from case study partners, list the available tools from the consortium, outline the gaps in tool features with regards to the user requirements, track the tool providers plans to deliver the required features, prepare for tool sets integration. We adopted a practical approach for the architecture specification that is particularly suited to collaborative projects such as MegaM@Rt2, which integrates tools coming from many parties. The authors are well informed about of a wealth of notations and methods for engineering process modelling such as OMG ESSENCE, SPEM, BPMN as well as The Open Group ArchiMate. We participated in standardization and implemented several solutions based on above-mentioned notations. In the project context, our goal was to avoid ambiguity, reduce the learning curve and simplify adoption for 60+ engineers who work on the project. Hence, as a modelling language, we took a Systems Modelling Language (SysML) [START_REF] Omg | OMG Systems Modeling Language (OMG SysML)[END_REF] subset for requirements specification and a Unified Modelling Language (UML) [START_REF]OMG: Unified Modeling Language (UML)[END_REF] subset for the high-level architecture specification. We have picked the requirements concept from SysML, while from UML we borrowed components, interfaces, nodes, aggregation/composition, dependencies, generalization and realization. We believe that these concepts are the most familiar to a large audience of architects.

As for the model structure, we split the architecture model in several parts and divided the responsibilities among the different Tool Set (TS) leaders, tool providers and case study providers. The following terminology and subsystems has been defined: Requirements/Purposes level, specified in SysML:

Case study requirements -specified by case study partners. These are the user requirements, which we imported for traceability purposes.

Framework requirements -specified by TS leaders. We grouped the tools by consortium in conceptual tool sets described in Section 1. The framework requirements summarized the users feature requirements related to those groups. Tool purposes -specified by tool providers. Tool purposes in our terminology are the tool requirements that correspond to available features or to features be developed. Each tool provider specified the baseline features and the features to be developed as a contribution to the MegaM@Rt2 project.

Requirements traceability -the gap analysis and roadmap specification require that the user requirements are linked to the tool features. TS leaders and tool providers established those traceability links in the model.

Architecture level, specified in UML:

Framework -TS leaders specified conceptual tool sets in a form of component diagrams. Tool settool providers described their tools individually with diagrams following a common template.

Common interfacesas a part of tool sets integration preparation we asked tool providers to list the support exchange forms and APIs. This helps to identify tools that can potentially work together.

Common deployment frameworksagain as a part of tool sets integration, we explored possibilities for common deployment of tools in the frame of the tool sets. The approach is further outlined in Fig. 1, where we present the steps to define the MegaM@Rt2 framework architecture. At the step 1, the Tool Set leaders summarized and extracted the essence and commonalities from the users' requirements provided by the case study partners. This resulted in a MegaM@Rt2 Framework Requirements. At the step 2, tool providers linked purposes (features) to those generalized user requirements the MegaM@Rt2 Framework Level. Therefore, by the indirect traces between framework requirements and tool purposes (features) we were able to provide the gap analysis, identifying the unsupported user requirements and the relevant mitigation measures e.g. additional tools, new purposes (features) for provided tools, etc.

For further analyses in order to prepare development and integration of coherent tool sets, we devised a conceptual architecture with the steps 3 and 4. The MegaM@Rt2 Framework is regrouped in Conceptual Tool Sets (Section 1). At the step 3 we identified the relevant interfaces to satisfy framework requirements and subordinate tool sets to further detail the implementation. Then, at the step 4, for each Conceptual Tool Set Component we specify concrete tool set components to realize the desired functionality. Those concrete tool set components expose features and satisfy purpose requirements that include the release milestone indications for the roadmap definition.

Requirements modeling

In our approach, requirements originated from different sources, i.e. from 9 case study providers and 22 tool providers. In order to have a uniform approach for requirement specification that would facilitate gap analysis and roadmap identification, we defined requirement templates that were used to define the expected properties to be collected, such as criticality for the case study requirements and release date for tool purposes.

We edited requirements in both diagram view and tabular view (see Fig. 2) in the Modelio tool [START_REF]Modelio MDE workbench by ModelioSoft[END_REF]. The requirements were manually edited or automatically imported from other documents, e.g. MS Excel.

Architecture modeling.

At the architecture level, we used Class and Deployment diagrams. We limited modelling to a subset of UML to enforce the common understanding of the architecture and simplify editing. In particular, we chose to use UML Components, Interfaces, Associations, Generalizations and Dependencies.

For tool components, we set a template for the architecture specification that included class diagram to specify functional interfaces, tool component subordinates and the relation to the conceptual tool set in the framework, and deployment diagrams to identify the execution environment of the tool component. In addition, Package diagrams have been used to define the highlevel structure of the MegaM@Rt2 framework architecture. For instance, Fig. 3 shows that the MegaM@Rt2 framework architecture is composed of three parts corresponding to the three complementary conceptual tool sets of the project. System Engineering, Runtime Analysis, and Model and Traceability Management, respectively. In Modelio, the documentation (Fig. 3) can be added in the textual notes or attached as separate documents. Both plain text and rich text notes are supported. In our work, we deliberately restricted editing to plain text notes to make sure that the generated documents are formatted correctly.

Requirements traceability.

Once the requirements had been specified, for each tool component we defined a traceability matrix to link case study requirements to framework requirements, and respectively framework requirements to tool purposes as described by the steps 1 and 2 of the modelling approach in Fig. 1. This allowed us to use instant traceability diagrams, as the one in Fig. 4, to visualize the whole set of dependencies for a given requirement. This has been beneficial not only for the requirement analysis and toolset integration planning, but also for identifying common interfaces for tool components and visualize gaps for the requirements analysis.

STRUCTURING MEGAM@RT2 REPORTS

The information extracted from the above-mentioned model is used to generate the contents of different deliverables in the project, each focusing on different perspectives corresponding to various tool sets and thematics. The following deliverables have been already published on the project website [START_REF]MegaM@Rt2 deliverables web-page[END_REF] These documents included the sections that where generated based on the information extracted from the models. In particular, the all specifications included tables for features, diagrams for interfaces, subordinates and deployment.

It was particularly helpful to extract the traceability links information in a form of matrix tables that enabled us to visualize the relations between user requirements and tools, which provide the corresponding features. On the later stages of the project we linked the tools features to the release milestones and their status in order to track the progress (Fig. 5).

TOOLING APPROACH FOR MODELING AND DOCUMENT GENERATION

Appropriate tooling support is important for the success of the model-driven engineering process as shown in Fig. 1. In order to provide tool support for our architecture specification approach, we selected the Modelio and Constellation tools [START_REF] Desfray | Model repositories at the enterprises and systems scale: the modelio constellation solution[END_REF][START_REF]Modelio MDE workbench by ModelioSoft[END_REF] provided by one of the project participants, SOFTEAM.

When collecting inputs from 50 users, it was important to provide guidelines and diagram templates. Otherwise, the integration work may have become extremely challenging. As such, we defined a set of template diagrams both for specifying requirements and for collecting tool purposes. Users were able to clone these templates inside the model to describe their concrete tools.

Modelio offers fairly flexible model query and document generation facilities that were used for editing and maintaining four specifications in the project. The template editor (Fig. 6) was particularly useful to implement custom extraction of model elements in order to create specific sections of the documents. In the example below, the template specifies that the generator will search for a Tool Components package, look at all the UML components to generate a tool section. This document section included an introductory paragraph, a "Purpose" subsection, and subsections for all class and deployment diagrams as well as a section on the owned interfaces. When editing the architecture model, it is quite useful to see the generation result. Along with developing custom document templates, we integrated the document generation to the Modelio interface. This way, regular users could call the document generation directly from the tool using a context menu (Fig. 7). The new customized document templates can be done by users without programming skills with the help of Modelio visual editors. The effort required to develop templates was insignificant comparing to the time required to devise the documents structure and collect the inputs from project partners in a model form.

CONCLUSIONS

In this paper, we presented the model-based documentation approach that we adopted at the inception stage of the MegaM@Rt2 project. Our approach enforced the coordination and collaboration among many different stakeholders, and thus the manageability of this complex project.

The main benefit of our model-driven approach is that all information was collected from different stakeholders and stored using a centralized model. In this paper we showed how we can use the principles of model-driven development where the model is the first-class citizen and different artefacts are generated from it. In our case, the generated artefact was the documentation of the project. The main benefit of having the model as a source of information, was that we could generate documentation (ie., deliverables) that focused on different perspectives of the MegaM@RT2 framework, at different levels of abstraction and using different document formats. This also, allowed to bridge the gap between the experienced modeling users and less experience ones which could at any moment generate the documentation they needed related to a given aspect of the project.

Overall, the experience with this approach was mostly positive, and the approach will be further used 1) in other architecture deliverables at later stages of the project and 2) as the reference point for the partners in the project at any moment in time. Further on the positive site, this approach has already contributed to delivery of 8 contractual reports in the MegaM@Rt2 projects. The approach has been highly praised by the expert as the project review. Finally, we received interest from H2020 DataBio and ITEA REVAMP projects to apply a similar technique. Currently, these projects have partially adopted the document generation as well.

Figure 1 :

 1 Figure 1: Overview of the Architecture and Development process in MegaM@Rt2.

Figure 2 :

 2 Figure 2: Example: Requirements editing.

Figure 3 :

 3 Figure 3: Example: Editing architecture and documentation with Modelio.

Figure 4 :

 4 Figure 4: Example: Traceability links among the tool set, framework and case study requirements.

Figure 5 :

 5 Figure 5: Example: D3.2 Traceability and release plan excerpt for framework requirements and corresponding concrete tools.

Figure 6 :

 6 Figure 6: Example: Custom document generation template for individual tools section.

Figure 7 :

 7 Figure 7: Example: Architecture document generated with Modelio Document Publisher.

ACKNOWLEDGEMENT

This project has received funding from the Electronic Component Systems for European Leadership Joint Undertaking (ECSEL JU) under grant agreement No. 737494. This Joint Undertaking receives support from the European Union's Horizon 2020 research and innovation program and from Sweden, France, Spain, Italy, Finland and Czech Republic.