DBIS

The thesis focuses on the new regulatory requirements imposed on companies by the NIS2 directive. It aims to systematically extract these requirements and align them with established industry standards that provide detailed guidance for implementation. The goal is to enable a structured mapping between high-level regulatory obligations and more detailed implementation guidance, thereby supporting organizations in understanding and operationalizing compliance requirements. The thesis investigates how large language models (LLMs) can support this alignment. The thesis should contribute to the topic by analyzing the trade-offs between different representations and retrieval strategies under realistic constraints.

A central challenge in this context is that relevant standards documents are typically copyrighted and cannot be distributed as part of a solution. Therefore, the thesis focuses on approaches that operate on documents provided by the user, with an emphasis on transferability across different standards and document versions. In this setting, the extraction and utilization of document structure is of particular importance, as it can support explainability by indicating where relevant information originates without requiring fully curated semantic knowledge to be shared.

Additionally, the research may contribute to generating relevant playbooks for this matter. The goal is to create generic playbooks that are transferable between organizations while effectively supporting individual use. This exploration may include ideas such as modularity, textual guidelines, or code-based playbook refinement. The requirements extraction will follow an established methodology, and the resulting playbooks will be evaluated against a pre-defined set of relevant factors, may be verified through expert interviews.

This work is particularly significant due to the introduction of directives like NIS2 and legislations such as the EU Cybersecurity Act, which emphasize the need for timely incident reporting and automation in response processes. The thesis will first focus on analyzing these directives and regulations, followed by implementing necessary components to support achieving of the compliance.

Some references related to the topic:

Basic knowledge in the domains of cyber incident response, system engineering, semantic technologies and Generative-AI.