From COBIT to ISO 42001: Evaluating Cybersecurity Frameworks for Opportunities, Risks, and Regulatory Compliance in Commercializing Large Language Models
This work addresses the problem of inadequate cybersecurity framework support for LLM integration for organizations and regulators, but it is incremental as it analyzes existing frameworks rather than proposing new ones.
This study evaluated four cybersecurity frameworks (NIST CSF 2.0, COBIT 2019, ISO 27001:2022, ISO 42001:2023) for their readiness to address opportunities, risks, and regulatory compliance in commercializing Large Language Models (LLMs), finding that ISO 42001:2023 best facilitates LLM opportunities while COBIT 2019 aligns most with the EU AI Act, but all frameworks need enhancements for comprehensive LLM risk oversight.
This study investigated the integration readiness of four predominant cybersecurity Governance, Risk and Compliance (GRC) frameworks - NIST CSF 2.0, COBIT 2019, ISO 27001:2022, and the latest ISO 42001:2023 - for the opportunities, risks, and regulatory compliance when adopting Large Language Models (LLMs), using qualitative content analysis and expert validation. Our analysis, with both LLMs and human experts in the loop, uncovered potential for LLM integration together with inadequacies in LLM risk oversight of those frameworks. Comparative gap analysis has highlighted that the new ISO 42001:2023, specifically designed for Artificial Intelligence (AI) management systems, provided most comprehensive facilitation for LLM opportunities, whereas COBIT 2019 aligned most closely with the impending European Union AI Act. Nonetheless, our findings suggested that all evaluated frameworks would benefit from enhancements to more effectively and more comprehensively address the multifaceted risks associated with LLMs, indicating a critical and time-sensitive need for their continuous evolution. We propose integrating human-expert-in-the-loop validation processes as crucial for enhancing cybersecurity frameworks to support secure and compliant LLM integration, and discuss implications for the continuous evolution of cybersecurity GRC frameworks to support the secure integration of LLMs.