Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces a RAG-based methodology leveraging LLMs to automate the creation of security profiles that comply with Ukrainian cybersecurity regulations, specifically aligning with ISO/IEC 27001 and NIST Cybersecurity Framework. The RAG system integrates a vector database of Ukrainian regulations and organizational policies to generate tailored security profiles. The results demonstrate a reduction in manual effort and improved alignment between technical controls and legal requirements in high-threat environments.
Automating security profile generation with LLMs could slash compliance costs and reduce human error in cybersecurity management, especially in regions with complex regulatory landscapes.
In recent years, the pace of development of information technology in various areas has increased drastically, forcing cybersecurity specialists to constantly review existing processes in order to prevent unauthorized access to confidential information. Using Ukraine as a primary case study, this paper explores the integration of international best practices, specifically ISO/IEC 27001 and the NIST Cybersecurity Framework, into national regulatory systems. A focus is placed on the transition from traditional compliance models to risk-based approaches, exemplified by the recent adoption of the Ukrainian normative documents. Furthermore, we propose a methodology for automating the development of target security profiles using Large Language Models (LLMs) enhanced by RetrievalAugmented Generation (RAG). By integrating a vector database of national regulations and organizational policies, the proposed RAG-based advisor reduces manual complexity, minimizes human error, and ensures alignment between technical controls and legal requirements. This study contributes to the field by providing a structured workflow for AI-assisted cybersecurity management in environments characterized by high-intensity hybrid threats.