| Abstract: |
Industrial control systems (ICS) and other operational technology (OT) assets are increasingly targeted by sophisticated cyberattacks. Guidelines for protecting these environments are codified by stringent regulatory requirements (e.\,g., IEC~62443, NERC~CIP, NIST~800~82, or ISO~27019) and internal safety policies. Compliance with these regulations is mandatory for reliable operation, yet in practice, compliance is achieved through labor‑intensive audits in which engineers must read extensive regulatory documents, interpret ambiguous clauses and manually translate the resulting requirements into technical controls and audit artifacts. This manual workflow suffers from inconsistent interpretation, limited scalability, and slow and expensive adaptation to evolving standards, leading to inefficiencies and heightened risk of regulatory penalties and security gaps.
Existing approaches to the problem either rely on brittle rule‑based extraction or treat the problem as a monolithic task with limited generalization and oversight.
To fill this gap, we propose a modular, agent‑based architecture that automates the end‑to‑end transformation of unstructured regulatory texts into machine‑interpretable specifications and executable compliance artifacts. A coordinated suite of specialized agents performs document digitization, requirement extraction, semantic structuring, and generation of actionable compliance code, while an orchestrator enables human‑in‑the‑loop integration, enabling scalability and preventing error propagation. An interactive web interface supports configurable extraction strategies and review of extracted requirements, preserving expert oversight while reducing manual effort.
The envisioned system enables the transition of compliance assurance from a manual activity to a semi‑automated, auditable process, aiming for fast, consistent and scalable compliance with cybersecurity regulations in industrial environments. |