Data model - company specific policy data shall be separated from the general model

[OliverFendt]

Data types which are most probably company specific shall be separated from the model and be modeled in a way that companies can easily implement their own policies.
Examples of comapny policy data types are:
Risk level := Enumeration { 1,2,3,4,5 }
criticality := Enumeration {0,1,2,3,4,5}

[OliverFendt]

A first step to realize this can be introducing a new class named ProductPolicy with associations to ProductInformation, Deliverable, License and probably to DigitalArtifact. The class shall have the members criticality, riskExposure, riskLevel