SEMI-AUTOMATED MULTI-STANDARD CYBER MATURITY ASSESSMENT TOOL BASED ON NIST CSF 2.0, ISO/IEC 27001:2022, COBIT 2019 AND CIS CONTROLS V8

Abstract

In today's cyber threat landscape, no software or hardware tool can fully compensate for the lack of a comprehensive approach to security management, which includes both technological and organizational aspects. Modern organizations are often forced to comply with the requirements of several international standards at the same time (NIST CSF 2.0, ISO/IEC 27001:2022, COBIT 2019, CIS Controls v8) due to regulatory obligations, customer requirements and internal policies, which leads to fragmentation of efforts, duplication of work and inefficient use of limited resources. This article is devoted to the development of a semi-automated multi-standard cyber maturity assessment tool that allows organizations to assess compliance with all four frameworks through a single point of entry — a structured survey using the NIST CSF 2.0 framework as a basic measurement tool, COBIT 2019 as a mechanism for determining the target state through prioritization of business processes, ISO/IEC 27001:2022 as a reference for documented controls, and CIS Controls v8 as additional practical detail for small and medium-sized organizations (SMEs). Based on a systematic analysis of scientific literature and practical cases, the necessity of using a mapping matrix between standards for automatic display of assessment results in terms of all four frameworks simultaneously is substantiated. The architecture of the tool is described and the logic of its operation is detailed: from the formation of an expert group and collection of organizational context to the automated assessment of the current state and generation of recommendations for the target.

The scientific novelty of the work is the development of a practical tool that combines methodological approaches, namely: multi-standard assessment of the organization's cyber maturity through a correspondence matrix between NIST CSF 2.0, ISO/IEC 27001:2022, COBIT 2019 and CIS Controls v8, which allows you to avoid duplication of efforts when complying with multiple standards; semi-automation of the assessment using objective structured questionnaires, which increases the reliability and repeatability of the results; validation of the results by an interdisciplinary expert group according to the "Human-in-the-Loop" principle, which ensures that the organizational context is taken into account. The role of the expert group as a validator of automatically generated data and a determiner of organizational priorities is characterized, which allows you to combine the advantages of automation with the flexibility of expert analysis. Particular attention is paid to the cost-effectiveness of the proposed solution through the use of publicly available tools (Microsoft Excel) and the possibility of phased implementation for MSOs through the CIS Controls implementation group system (IG1→IG2→IG3).

The results of the study can be used as a practical tool for organizations of any size: small organizations can start at the basic level (CIS IG1) and gradually build maturity, while large enterprises get a comprehensive overview of compliance with multiple standards through a single assessment model without duplication of effort.