Source-linked AI summary
AspisAI: A Canonical, Machine-Interpretable Governance Framework for Automated Multi-Standard Compliance Monitoring
Tsafac Nkombong Regine Cyrille, Hasan Dag, Reiner Creutzburg, Knut Haufe
TL;DR
AspisAI addresses the difficulty of managing heterogeneous cybersecurity and privacy frameworks with manual mappings and weak traceability. It introduces a canonical, machine-interpretable governance model and rule engine, demonstrating accurate, traceable determinations and gap detection within a bounded simulated case study.
Problem
Organisations in regulated sectors manage overlapping cybersecurity and privacy frameworks whose differing structures, vocabularies, and evidentiary expectations make manual mappings costly and weakly traceable.
Method
AspisAI translates selected requirements into a provenance-preserving canonical control model and evaluates merged evidence with condition-based rules that treat missing fields as unsatisfied.
Results
All 11 case-study determinations matched the predefined ground truth, and all three intentionally introduced gaps were correctly identified.
Takeaways & Limitations
Within its bounded scope, AspisAI shows that heterogeneous requirements can be represented in an automatable, executable, and traceable governance model.
Takeaways & Limitations
The evaluation uses only 11 determinations, which is insufficient for statistical inference, so reported counts and proportions describe the sample only.
Abstract
from arXiv · showhide
Organisations operating in regulated and critical-infrastructure sectors must satisfy multiple, heterogeneous cybersecurity and privacy instruments simultaneously, including but not limited to ISO/IEC~27001, the NIST Cybersecurity Framework~2.0, Cyber Essentials, and the GDPR. In practice, these obligations are managed through manual mappings, spreadsheet-based tracking, and periodic audits that are costly to maintain, inconsistent across standards, and weak in traceability. This paper presents \emph{AspisAI}, a bounded, standard-agnostic governance framework that translates selected requirements from several frameworks into a canonical, machine-interpretable control model, and evaluates submitted evidence against condition-based decision rules to produce explainable, traceable compliance determinations. Within a bounded scope of 26 representative requirements, the framework is evaluated in a controlled simulation against five governance-oriented criteria and, critically, against two external reference points that mitigate the circularity of single-author evaluation: its cross-standard mappings are validated against NIST's own published informative references, with 57\,\% exact agreement and divergences confined to same-family controls, and the framework is applied to real third-party evidence from the OpenSSF Scorecard, surfacing genuine governance gaps in a live open-source project. The controlled results, comprising full requirement encoding, 88.5\,\% mapping coverage, complete traceability, and correct detection of all introduced gaps, establish functional correctness, while the external validation provides evidence of applicability beyond the simulation. The contribution is therefore a demonstration that a canonical, provenance-preserving governance model can render multi-standard compliance both automatable and auditable.
I. INTRODUCTION
AspisAI addresses the difficulty of governing overlapping cybersecurity and privacy requirements by combining a canonical, traceable model with executable compliance logic. It targets a gap in prior work, which rarely combines multi-standard scope, machine interpretability, and end-to-end traceability in one artefact.
- I. INTRODUCTION: Manual cross-framework mappings create duplicated evidence collection, alignment drift, and weak traceability from compliance outcomes to supporting evidence.
- I. INTRODUCTION: AspisAI translates selected heterogeneous requirements into a standard-agnostic canonical model with provenance-preserving schemas and explainable compliance determinations.The framework also evaluates the model through a lightweight rule engine and a simulated critical-infrastructure case study.
- II. RELATED WORK: Prior work often addresses only one or two of multi-standard scope, machine interpretability, and end-to-end traceability within a single artefact.
- II. RELATED WORK: Existing automation commonly targets specific environments, while cross-framework studies usually stop short of producing an executable, traceable governance artefact.
- II. RELATED WORK: AspisAI positions its canonical model as the missing governance layer connecting cross-standard mapping, provenance preservation, and interpretable evaluation.
III. METHODOLOGY
The methodology uses design science to construct a bounded canonical governance artefact from requirements across four standards. Its layered architecture connects normalisation, governance logic, and traceable evaluation outputs.
- III. METHODOLOGY: Design science organises the study around an artefact comprising selected requirements, canonical controls, cross-standard mappings, executable rules, and traceable outputs.
- A. Canonical Schema and Requirement Selection: 26 representative requirements from ISO/IEC 27001, NIST CSF 2.0, Cyber Essentials, and GDPR are encoded in a provenance-preserving canonical JSON schema.Mandatory fields include identifiers, source standards, clause references, control objectives, governance domains, and expected evidence.
- A. Canonical Schema and Requirement Selection: The three-layer architecture normalises requirements, applies mappings and rules to evidence, and produces traceable compliance decisions and gap reports.
B. Governance Logic and Rule Engine
AspisAI evaluates merged evidence against Boolean conditions bound to canonical requirements, returning deterministic compliance statuses and actionable gap sets. Missing fields count as unsatisfied rather than being silently ignored.
- B. Governance Logic and Rule Engine: The governance layer combines cross-standard relationships with evidence evaluation so each determination remains bound to its source requirement.
- B. Governance Logic and Rule Engine: The rule engine merges evidence properties and checks whether each condition’s field, operator, and expected value are supplied and satisfied.
- B. Governance Logic and Rule Engine: A PARTIAL determination applies when 0 < k < n, with compliance score s = k/n and a gap set listing unsatisfied evidence fields.
- B. Governance Logic and Rule Engine: Missing evidence is treated as an unsatisfied condition, making absent fields detectable as actionable gaps.
- B. Governance Logic and Rule Engine: Boolean evaluation preserves interpretability and makes identical inputs produce byte-identical decisions, while non-determinism is confined to optional AI-assisted mapping.
C. Simulated Case Study
The framework is demonstrated on a simulated regional energy utility with hybrid IT/OT infrastructure and intentionally introduced evidence gaps. Synthetic evidence spans four governance domains while avoiding sensitive organisational data.
- C. Simulated Case Study: The case study models NorthGrid Energy Distribution Ltd as a simulated regional energy utility with hybrid IT/OT infrastructure.
- C. Simulated Case Study: Synthetic evidence covers access control, incident response, data protection, and risk assessment, with intentional gaps introduced to test detection.
D. Evaluation Criteria
AspisAI evaluates its bounded governance artefact against coverage, mapping quality, rule accuracy, traceability, and gap detection, while optionally validating machine-proposed mappings against canonical constraints and NIST references.
- The evaluation measures coverage, mapping quality, rule decision accuracy, traceability completeness, and gap detection.
- Optional language-model mapping proposals are accepted only after identifier, relationship-type, and NIST-reference checks.
- All 26 selected requirements were encoded and validated against the canonical schema.
- 88.5% of requirements appeared in at least one cross-standard mapping group, while three source-specific controls remained unmapped.
B. Decision Accuracy and Gap Detection
The rule engine evaluates submitted evidence against explicit conditions, produces compliant or partial determinations, and retains traceable explanations of satisfied and failed properties.
- All 11 case-study evaluations matched the predefined ground truth, and all three introduced gaps were detected.The outputs identified the specific missing evidence property for each gap.
- Traceability: Every determination preserved a chain from source clause through canonical requirement and bound rule to the evaluated evidence property and any named gap.The chain can be reconstructed after execution by someone who was not present when the determination ran.
- Worked Determination: A worked access-control case satisfied policy approval, MFA enablement, and 95% MFA coverage, producing a compliant determination with s = 1.0.One evidence submission supported requirements from ISO/IEC 27001, NIST CSF 2.0, and Cyber Essentials.
- Worked Determination: One evidence submission was evaluated once and recorded as separate determinations for three bound standards, reducing duplicated evidence assessment.
- Worked Determination: A GDPR encryption case with 85% coverage against a 95% threshold produced PARTIAL status with s = 0.667 and named encryption_coverage_percent as the gap.The output included the observed value and the missed threshold, making the finding actionable.
E. External Validation
AspisAI was checked against external references to reduce reliance on its own simulated ground truth, using NIST mappings and third-party OpenSSF evidence.
- 57.1% of asserted mappings matched NIST’s official informative references exactly, while the divergences remained within the same ISO family.The comparison covered 4 of 7 asserted mappings.
- Applied to OpenSSF Scorecard evidence for Prometheus, the framework identified 8 of 10 controls as compliant and surfaced two genuine governance gaps.The gaps concerned unresolved dependency vulnerabilities and unsigned releases.
F. Baseline Comparison
The baseline comparison attributes AspisAI’s cross-standard traceability and mapping capabilities to its canonical model, while adversarial testing exposes evidence-handling limitations and the evaluation combines simulation results with external checks.
- The canonical model achieved complete traceability and eight mapping groups, whereas the rule-only baseline achieved zero for both capabilities.These comparisons isolate the canonical mapping layer from the rule engine alone.
- F1 ≈0.30 for keyword matching shows that lexical overlap alone poorly recovered the curated cross-standard mappings.Table IV summarizes the comparison against simpler baselines.
- Adversarial probes found that numeric comparisons do not distinguish absent from failing evidence and that declared but unsubstantiated evidence is accepted.These findings bound the claims to declared compliance and motivate evidence authentication.
- The results support a bounded claim that translating heterogeneous requirements into a traceable, machine-interpretable model can be both automatable and externally checkable.The discussion distinguishes this governance-design contribution from building a compliance scanner.
- Because the case study is single-author, its controlled results support functional correctness and internal consistency rather than generalisation.External checks carry the main validity argument beyond the simulation.
A. Threats to Validity
The validity threats concern construct and internal validity, limited external scope, deliberately introduced gaps, and insufficient sample size for statistical inference; mitigations include external references, adversarial probes, bounded claims, and deterministic reproduction.
- Construct validity: External checks using NIST references and OpenSSF Scorecard mitigate the risk that author-defined criteria create a benchmark unable to fail.Neither external source was authored here or adjusted after results were seen.
- Internal validity: Shared authorship of rules, evidence, and ground truth means agreement partly reflects common assumptions, but adversarial probes found two defects missed by the main criteria.The successful probes show that the primary evaluation was not sufficiently adversarial on its own.
- External validity: The study covers 26 requirements from four standards, one simulated organisation, and one sector, so it does not support claims about full coverage or production-scale evidence.The synthetic case also contains deliberately placed gaps, limiting what gap detection demonstrates.
- Conclusion validity: Eleven determinations are insufficient for statistical inference, so the paper reports descriptive counts and proportions without significance claims or confidence intervals.The deterministic rule engine nevertheless reproduces identical results on identical inputs, while AI-assisted mapping is reported separately because it is nondeterministic.
B. Future Work
Future work extends AspisAI beyond its simulated, bounded evaluation toward real organisational evidence, broader standards coverage, authenticated evidence, and scalable mapping assessment.
- Future evaluations should use real multi-organisation data and independent annotators to establish ecological validity and inter-rater agreement.
- The requirement set and standards coverage can expand to include AI-specific obligations such as the EU AI Act.
- Evidence authentication is proposed to close the declared-versus-substantiated gap identified by adversarial probes.
- The AI-assisted mapping component can be benchmarked at scale by measuring accepted-mapping stability across repeated runs once provider access is stable.
- Further development includes real organisational evidence, additional frameworks, richer rule formalisms, and CI/CD toolchain integration.