Stop tracing by hand which standard each control satisfies — automating cloud compliance mapping with sentence encoders

Hello. I am Miura from Affectosphere Group.

If you work in compliance, you may know that particular, never-quite-finished cross-checking task.

“Which ENISA requirement does this access-control map to?” “The new item NIS2 asks for — is it already covered by our existing metrics?” “If the SOC2 audit asks, which piece of evidence do I show?” You line up the wording of a standard against the technical metrics your systems actually measure, and build a correspondence table row by row. For any company on the cloud, this quiet work silently drains weeks of an expert’s time.

A study published on arXiv (Bianchi, Petrillo, Martinelli & Petrocchi, arXiv:2607.06364) goes straight at automating this “compliance mapping.” The tool is a sentence encoder (a Sentence Transformer) — a model good at measuring how close two pieces of text are in meaning — adapted to the domain of security standards.

Today I want to look at this from a business-application angle and think concretely about how a real team could try it.

---

Three takeaways

1. From five European security standards (including ENISA) and technical metrics, the team collected 3,499 semantic pairs and expanded them to about 14,000 samples with back-translation and LLM paraphrasing, then fine-tuned five sentence-encoder architectures on that corpus.
2. The best model reached up to +23 nDCG@10 points over baseline on cloud-security-control-to-metric mapping, and 0.870 nDCG@10 on associating controls across standards.
3. It is an initial large-scale demonstration that the regulatory-compliance mapping long done by hand can be automated with NLP — a real seed for a “compliance-mapping assist engine” in GRC, IT audit, and regulatory work.

---

① Why compliance mapping is so draining

First, let me lay out why this work is so stubborn.

The core problem is that “the meaning is the same, but the phrasing is completely different.” One standard writes abstractly, “data at rest shall be encrypted.” Another writes the same intent in far more concrete words. Your own metric holds it as a number: “unencrypted volumes = 0.” A human sees at once that these are all saying the same thing, but plain keyword matching never connects them.

And there is never just one standard. ENISA, NIS2, SOC2 — companies are pushed to comply with several at once. The more standards there are, the more the cross-checking combinations balloon by multiplication. That is where expert time gets swallowed whole.

So what you need is a mechanism that links controls and requirements by closeness of meaning, not by keyword. A sentence encoder is exactly the model whose day job is turning that “closeness of meaning” into a number. This study set out to fit one to the specialized domain of security.

---

② Getting a general model “used to” the language of security

The heart of this work, as I read it, is that it does not use a general-purpose sentence encoder as-is but adapts it to the domain.

A general model measures the meaning of everyday sentences well. But it is not necessarily optimized for the peculiar phrasing of security standards — the correspondences among controls, metrics, and requirements. So the team collected 3,499 semantic pairs from the five standards’ text and technical metrics, then inflated the training data to about 14,000 samples with back-translation (translate into another language and back) and LLM paraphrasing. Padding out scarce specialist data while preserving its meaning — as an implementer, I find that genuinely clever.

Fine-tuning five sentence-encoder architectures on this corpus shows clearly in the numbers. On control-to-metric mapping, up to +23 nDCG@10 points over baseline. nDCG@10, put crudely, measures “are the correct answers you want up top actually placed up top?” A big jump here means the ranked list of candidates a reviewer has to check has become a practically trustworthy order.

Beyond that, associating controls across standards reached 0.870 nDCG@10. That means even cross-standard mapping — “this ENISA control is essentially the same as that SOC2 control” — can be handled with decent accuracy. For companies running several standards at once, this is where it pays off most.

---

③ How to try it on the floor: departments and KPIs

So how would you try this in your own organization? As a business application, here is my own rollout scenario.

The aim is to embed this model into a GRC (governance, risk, and compliance) platform and run it as a “compliance-mapping assist engine.” Feed it a standard’s requirements and your own controls and metrics, and it returns the semantically closest candidates ranked from the top. Instead of building a correspondence table from scratch, the reviewer checks the machine’s candidates and decides accept or reject — a form that could sharply compress the compliance verification consultants now spend weeks on.

Here are the departments and uses I have in mind. First, the security and compliance team under the CISO — the group that continuously maps controls to evidence when obtaining and maintaining ISO27001 or SOC2 certification. Next, IT audit — when periodically auditing third-party cloud services, it can mechanically do a first-pass sort of where each service’s controls land against your own standards. And the compliance engineers at FinTech and MedTech firms facing European regulation, who should be able to lighten the re-mapping that arises every time a new standard like NIS2 lands.

For measurement KPIs, so you can tell the story in numbers, I propose the following. First, time per mapping (by how much the hours experts spent hand-building the table can shrink to just a review step). Second, lead time to a new standard (the days from a new regulation like NIS2 being published to the in-house table being complete). Third, audit findings and rework count (by how much the machine’s first-pass sort reduces gaps and omissions). Compared against a pre-adoption manual baseline, the effect can be shown clearly.

As a realistic path, do not swing fully to automation from day one. This technique is an “assist” that ranks candidates high; the final judgment stays with the expert. Start in areas where a correspondence table already exists, cross-check the machine’s output, and gauge where it hits and misses. From where trust builds up, extend to first-pass mapping of new standards. This small start is the safe way in a domain like audit, where failure is not permitted.

---

Where a technique for measuring “closeness of meaning” pays off

What I found interesting reading this work is how a single technique — turning closeness of meaning into a number — lands squarely on such a quiet, heavy piece of real work.

Compliance mapping is not flashy. But it is one of the tasks every company on the cloud carries, and the one that most silently erodes expert time. Just by inserting a domain-adapted sentence encoder as a first-pass sort, the reviewer is freed from the drain of writing a correspondence table from scratch and can focus on the real work of checking and judging.

Incidentally, this idea of adapting a meaning encoder to a specialized domain is continuous with the affective AI we work on. Emotion in medicine, emotion at work — change the context and the closeness of meaning between the same words shifts. How to build a domain-adapted encoder is, I feel, an unavoidable question in constructing emotion corpora too.

Put a technique for measuring meaning to work not where there is no right answer, but where the drudgery of cross-checking is heaviest. It is not flashy — but this kind of use genuinely helps people.

That is it for today!

---

References

1. Bianchi, John, Petrillo, Luca, Martinelli, Fabio, & Petrocchi, Marinella (2026). Automated Compliance Mapping in Cloud Security with Domain-Adapted Sentence Transformers. arXiv preprint. https://arxiv.org/abs/2607.06364

* This article was written in part with AI assistance and may contain inaccuracies.