Preserving Compliance with Security Requirements in Socio-Technical Systems