A Machine-Readable Approach to Automated ISO/IEC 27001 Measure Extraction and Verification

Abstract

Organisations rely on ISO/IEC 27001 to structure information security management, yet controls and Privacy by Design guidance are typically documented in heterogeneous, unstructured forms that impede cross-framework comparability. Existing taxonomies and ontologies are predominantly manual, static, and do not support automated measure derivation or non-normative quality encoding. This paper addresses this gap through a four-Iteration, design science-based artefact developed using Control 5.34 as a proof of concept. A dynamic taxonomy operationalises controls into four abstract dimensions and comparable objects. An LLM-based pipeline extracts measures from heterogeneous public sources and exports the results as an OSCAL-compatible catalogue. A four-tier verification model encodes verification status as OSCAL properties without compliance or effectiveness claims, ranging from AI plausibility checks to IAF-accredited auditor review. GQM-based evaluation confirms that all five requirements are met or structurally addressed across 37 extracted measures. An independent ex-post expert round confirms the structural contribution and identifies applicability context as the decisive prerequisite for practical adoption.