An Automated Framework for Cybersecurity Policy Compliance Assessment Against Security Control Standards

• URL: http://arxiv.org/abs/2605.07515v1
• Date: Fri, 08 May 2026 09:45:25 GMT
• Title: An Automated Framework for Cybersecurity Policy Compliance Assessment Against Security Control Standards
• Abstract summary: PROPARAG is an audit support approach for evaluating organizational cybersecurity policies against security controls autonomously.<n>For each control, the approach retrieves relevant policy evidence, assesses coverage, identifies missing elements, and generates supporting explanations and recommendations.
• Score: 0.25489046505746704
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Organizational cybersecurity policies are often examined to determine whether they adequately comply standard security controls. This task is difficult because control statements are abstract, whereas policy documents describe governance practices in varied natural language. As a result, policy-based control assessment is time-consuming, difficult to standardize, and often difficult to document in a traceable manner. To address this gap, we present PROPARAG, an audit support approach for evaluating organizational cybersecurity policies against security controls autonomously. For each control, the approach retrieves relevant policy evidence, assesses coverage, identifies missing elements, and generates supporting explanations and recommendations. We evaluate PROPARAG on two real-world organizational policy corpora using 1,007 NIST SP 800-53 controls across both closed-source and open-source large language models (LLMs). The framework achieves F1 scores of 88.54 on OrgA and 82.31 on OrgB. The evaluation also shows that PROPARAG identifies relevant gaps in documented organizational policies and generates grounded recommendations for each identified gap. This research provides foundation for LLM-powered autonomous control-level assessment of organizational cybersecurity policies.

Related papers

• PolicyMem: Geometric Policy Memory for LLM Governance [72.04962480384322]
  We introduce PolicyMem, a geometric policy memory that externalizes natural-language policies as reusable geometric memory objects.<n>A memory writer compiles natural-language policies into policy memory slots, and query-response pairs read the policy memory through projection energy.<n>The resulting policy-evidence profile directly mediates the safety verdict and is reused for policy attribution and post-intervention verification.
  arXiv  Detail & Related papers  (2026-09-12T06:07:43Z)
• AspisAI: A Canonical, Machine-Interpretable Governance Framework for Automated Multi-Standard Compliance Monitoring [0.0]
  This paper presents emphAspisAI, a bounded, standard-agnostic governance framework that translates selected requirements into a canonical, machine-interpretable control model.<n>Within a bounded scope of 26 representative requirements, the framework is evaluated in a controlled simulation against five governance-oriented criteria.<n>Results include full requirement encoding, 88.5,% mapping coverage, complete traceability, and correct detection of all introduced gaps.
  arXiv  Detail & Related papers  (2026-09-09T22:37:12Z)
• ReCon: A Resource-Constrained Benchmark for LLM-Based Cybersecurity Compliance Across Ingestion and Retrieval Pipelines [0.6773121102591491]
  Governance failure is one of the major reasons for a weakened cybersecurity posture.<n>The policy document must be in compliance with international or national standards.<n>It is often observed that policy documents are often incomplete with respect to industry standards or regulations.
  arXiv  Detail & Related papers  (2026-07-24T19:53:00Z)
• PolicyGuard: From Organizational Policies to Neuro-SymbolicCompliance Review Engines [5.18270310844006]
  PolicyGuard is a neuro-symbolic framework for policy-grounded document compliance review.<n>It converts organizational policy guidance into an executable review engine consisting of typed logic rules and atom-level extraction questions.
  arXiv  Detail & Related papers  (2026-06-30T17:37:57Z)
• Operationalising Information Security Management: A Procedural Framework Analysis of ISO/IEC 27001:2022 Implementation in a Financial-Technology Organisation [0.0]
  This article analyses the procedural architecture deployed in a financial-technology organisation's Information Security Management System.<n>It examines eight core operational procedures: IT Risk Assessment and Treatment, User Code of Conduct, Password Policy, Access Control, Internet Access, Physical Security, Backup and Restore Management, and Nonconformity Analysis and Corrective Action.<n>The findings suggest that a tightly integrated, multi-layered procedural hierarchy, supported by clear accountability structures and measurable risk metrics, constitutes the foundation of an effective ISMS implementation.
  arXiv  Detail & Related papers  (2026-04-25T09:46:04Z)
• PolicyBank: Evolving Policy Understanding for LLM Agents [51.86716874651299]
  PolicyBank maintains structured, tool-level policy insights and iteratively refines them.<n>PolicyBank closes up to 82% of the gap toward a human oracle.
  arXiv  Detail & Related papers  (2026-04-16T20:29:30Z)
• Verification of Robust Properties for Access Control Policies [51.736723807086385]
  Existing methods for verifying access control policies require the policy to be complete and fully determined before verification can proceed.<n>We introduce robust property verification: the problem of determining what a policy's structure commits it to regardless of how pending decisions are resolved and regardless of subsequent extension.<n>We show that despite quantifying universally over all possible policy extensions the judgment reduces to proof search in a second-order logic programming language.
  arXiv  Detail & Related papers  (2026-03-13T17:14:38Z)
• Beyond Static Alignment: Hierarchical Policy Control for LLM Safety via Risk-Aware Chain-of-Thought [5.251527748612469]
  Large Language Models (LLMs) face a fundamental safety-helpfulness trade-off due to static, one-size-fits-all safety policies.<n>We present textbfPACT (Prompt-Thought Action via Chain-of-Thought), a framework for dynamic safety control through explicit, risk-aware reasoning.
  arXiv  Detail & Related papers  (2026-02-06T12:20:01Z)
• COMPASS: A Framework for Evaluating Organization-Specific Policy Alignment in LLMs [19.742967013586927]
  We present the first systematic framework for evaluating whether large language models comply with organizational allowlist and denylist policies.<n>We show that models reliably handle legitimate requests but catastrophically fail at enforcing prohibitions, refusing only 13-40% of adversarial denylist violations.
  arXiv  Detail & Related papers  (2026-01-05T06:57:45Z)
• Automated Post-Incident Policy Gap Analysis via Threat-Informed Evidence Mapping using Large Language Models [0.0]
  This paper investigates whether Large Language Models (LLMs) can augment post-incident review by autonomously analysing system evidence and identifying security policy gaps.<n>We present a threat-informed, agentic framework that ingests log data, maps observed behaviours to the MITRE ATT&CK framework, and evaluates organisational security policies for adequacy and compliance.
  arXiv  Detail & Related papers  (2026-01-04T01:39:20Z)
• Policy-as-Prompt: Turning AI Governance Rules into Guardrails for AI Agents [0.19336815376402716]
  We introduce a regulatory machine learning framework that converts unstructured design artifacts (like PRDs, TDDs, and code) into verifiable runtime guardrails.<n>Our Policy as Prompt method reads these documents and risk controls to build a source-linked policy tree.<n>System is built to enforce least privilege and data minimization.
  arXiv  Detail & Related papers  (2025-09-28T17:36:52Z)
• Learning Deterministic Policies with Policy Gradients in Constrained Markov Decision Processes [59.27926064817273]
  We introduce an exploration-agnostic algorithm, called C-PG, which enjoys global last-iterate convergence guarantees under domination assumptions.<n>We empirically validate both the action-based (C-PGAE) and parameter-based (C-PGPE) variants of C-PG on constrained control tasks.
  arXiv  Detail & Related papers  (2025-06-06T10:29:05Z)
• Last-Iterate Global Convergence of Policy Gradients for Constrained Reinforcement Learning [62.81324245896717]
  We introduce an exploration-agnostic algorithm, called C-PG, which exhibits global last-ite convergence guarantees under (weak) gradient domination assumptions. We numerically validate our algorithms on constrained control problems, and compare them with state-of-the-art baselines.
  arXiv  Detail & Related papers  (2024-07-15T14:54:57Z)
• Value Functions are Control Barrier Functions: Verification of Safe Policies using Control Theory [46.85103495283037]
  We propose a new approach to apply verification methods from control theory to learned value functions. We formalize original theorems that establish links between value functions and control barrier functions. Our work marks a significant step towards a formal framework for the general, scalable, and verifiable design of RL-based control systems.
  arXiv  Detail & Related papers  (2023-06-06T21:41:31Z)
• Enforcing robust control guarantees within neural network policies [76.00287474159973]
  We propose a generic nonlinear control policy class, parameterized by neural networks, that enforces the same provable robustness criteria as robust control. We demonstrate the power of this approach on several domains, improving in average-case performance over existing robust control methods and in worst-case stability over (non-robust) deep RL methods.
  arXiv  Detail & Related papers  (2020-11-16T17:14:59Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.