By Muhammad Saiful Alam
Cybersecurity governance depends on understanding and applying complex regulatory frameworks including ISO/IEC 27001, NIST CSF 2.0, GDPR, and HIPAA and many others. Often these frameworks are sector specific, difficult to read, and complicated to apply. To simplify the implementation and comprehension of these models within firms this post proposes to leverage Large Language Models (LLMs) trained with Hybrid Retrieval-Augmented Generation (HRAG). By combining the power of LLMs with the tailored knowledge from a Hybrid RAG this post proposes the creation of a useful tool to enable policy compliance assistance. The LLM-Hybrid RAG combination is adaptable and extensible and can facilitate a dialogue based relationship between individuals responsible for cybersecurity governance and the policies and regulations they must follow. We know of no current existing LLM-Hybrid RAG systems that currently bridge regulatory structure, scope, and cross-standard relationships to facilitate cyber governance compliance. LLMs alone are likely to provide non-contextually relevant results and are likely to produce incomplete or inaccurate compliance interpretations. Moreover, these results are likely to lack auditability, a core feature of cybersecurity governance. The creation of a Policy-Aware Hybrid Retrieval-Augmented Generation (HRAG-PA) framework designed to incorporate policy knowledge directly into the AI process for cybersecurity governance tasks will facilitate compliance and auditability. Our proposed framework integrates structured, machine-readable representations of regulations within a multi-layer retrieval pipeline and constraint-guided generation.
Introduction
Cybersecurity governance today is not built around a single rulebook. It depends on navigating multiple regulatory frameworks such as ISO/IEC 27001, NIST CSF 2.0, GDPR, HIPAA, which were never designed to work together as one system.[1] Instead, each reflects a different set of priorities, assumptions and institutional goals.[2] What organizations face is not just complexity, but something more difficult, interpretation.[3]
In practice, governance becomes a process of figuring things out. Teams must decide how requirements connect, which rules matter more in specific situations, and how to justify those decisions if they are questioned later.[4] That means cybersecurity governance is less about implementing controls and more about making defensible decisions under uncertainty.[5]
Artificial intelligence has entered this space with the promise of making that process easier. Large language models can read large volumes of policy text and generate explanations quickly.[6] But speed is not the same as reliability. These systems often produce answers that sound convincing but are not grounded in the specific regulatory context.[7] In a governance setting, where every decision may need to be explained or audited, that gap becomes a serious problem.[8]This paper starts from a simple argument: the issue is not that we lack tools to read policy, but that we lack tools that can reason about policy.[9]
Literature Review
A consistent theme across cybersecurity governance research is that governance is not a technical problem alone. It is about how decisions are made, justified, and aligned with institutional goals.[10] This is reflected clearly in frameworks like NIST CSF 2.0, which explicitly position governance as a central function rather than a supporting one.[11]At the same time, regulations like GDPR and HIPAA extend cybersecurity into legal and ethical territory.[12] They require organizations not only to secure systems, but also to document decisions, justify practices, and demonstrate accountability.[13] The difficulty is not access to these rules. It is making sense of them in real operational settings.
This governance challenge becomes very concrete in software environments. Franke, Liang, Brantly, Davis, and Brown show that even experienced developers struggle to interpret GDPR requirements in open-source projects.[14] They face uncertainty around data handling, compliance expectations, and how legal obligations translate into code and workflows.[15] Their findings highlight an important point: policy is available, but it is not easily usable.[16] AI research offers partial solutions. Large language models are powerful at processing language, but they are not designed to ensure correctness or consistency.[17] As Bender et al. argue, these systems can produce outputs that are fluent yet unreliable.[18] That limitation becomes especially risky in domains where decisions must be justified.
Retrieval-augmented generation improves this by grounding responses in external sources.[19] Hybrid retrieval methods further improve relevance by combining semantic understanding with keyword matching.[20] But even these approaches treat policy as text to retrieve, not as a system of relationships to reason through.[21] This is where knowledge graph research becomes especially important. By structuring information as relationships between rules, conditions, and dependencies, knowledge graphs more closely reflect how policy actually works.[22] Emerging approaches like GraphRAG show that combining structured knowledge with language models can improve both reasoning and transparency.[23] Taken together, the literature points to a clear gap. Cybersecurity governance is relational and structured, but most AI systems approach it as unstructured text.[24]
Research Question and Hypothesis
This leads to a central question:
Can a policy-aware hybrid retrieval-augmented generation framework improve interpretability, traceability, and cross-framework alignment in cybersecurity governance?
My hypothesis is straightforward: if AI systems are designed to understand relationships between policies rather than simply retrieve them, they will be more likely produce outputs that are more accurate, more transparent, and easier to justify.[25]
Methodology
The HRAG-PA framework is built around three layers. The first layer focuses on retrieval. Instead of relying on a single method, it combines semantic and lexical search to capture both meaning and precision.[26] The second layer introduces structure by encoding regulatory relationships, such as dependencies, conditions, and cross-references, in a machine-readable form.[27] This transforms policy from static text into something the system can reason about. The third layer controls generation. Outputs are constrained so that they remain tied to retrieved and structured information, ensuring that responses can be traced and verified.[28] To evaluate the framework, it is compared against baseline systems on tasks such as compliance interpretation and cross-framework mapping. The goal is not just better answers, but answers that can be explained and defended.[29]
Contribution
This post contributes to cybersecurity governance research by reframing compliance as a problem of structured reasoning rather than simple information access. Cybersecurity governance increasingly requires organizations to work across multiple frameworks rather than rely on one unified rulebook. ISO/IEC 27001 provides an information security management structure.[30] NIST CSF 2.0 organizes cybersecurity around governance, risk management, and operational functions.[31] GDPR adds legal obligations around data protection and accountability.[32] HIPAA adds sector-specific requirements for protecting health information.[33] Because these frameworks differ in purpose, language, and scope, governance teams must interpret how requirements apply in specific organizational settings.
The first contribution of this paper is therefore conceptual. It argues that the main challenge in cybersecurity governance is not only finding relevant policy language, but also understanding how different requirements relate to one another. Governance teams must decide which controls matter in a particular context, how overlapping obligations should be aligned, and how compliance decisions can be justified if they are later reviewed or audited.[34] This shifts the focus from policy access to policy reasoning. The post uses this shift to explain why ordinary retrieval systems and general-purpose language models are not sufficient for cybersecurity governance tasks.
The second contribution is the proposed Policy-Aware Hybrid Retrieval-Augmented Generation framework, or HRAG-PA. Large language models can process and summarize large amounts of policy text, but they can also produce fluent answers that are incomplete, unsupported, or disconnected from the specific regulatory context.[35] Retrieval-augmented generation improves this problem by grounding responses in external documents.[36] Hybrid retrieval further improves relevance by combining semantic search with keyword-based retrieval.[37] However, retrieval alone still treats policy mainly as text to be located rather than as a structure of relationships to be reasoned through.
HRAG-PA addresses this limitation by combining hybrid retrieval with structured, machine-readable representations of policy relationships. This allows regulatory materials to be represented not only as documents, but also as connected obligations, dependencies, controls, exceptions, and cross-framework mappings. Knowledge graph research is useful for this purpose because it models information through relationships between entities rather than isolated text passages.[38]Graph-based retrieval approaches also show how structured knowledge can improve reasoning and transparency in language model systems.[39] In this paper, HRAG-PA applies that logic to cybersecurity governance by making policy structure part of the retrieval and generation process.
The final contribution of this paper is its emphasis on auditability. In cybersecurity governance, an AI-generated answer is not useful unless it can be traced back to the sources and reasoning that support it. NIST’s AI Risk Management Framework emphasizes the importance of trustworthy and accountable AI systems.[40] HRAG-PA responds to this requirement by constraining generated outputs to retrieved and structured policy information. As a result, the framework is designed to produce answers that are interpretable, traceable, and defensible in real governance settings.
Conclusion
Cybersecurity governance is no longer a simple matter of following one set of rules. Organizations must interpret and apply multiple frameworks that differ in purpose, terminology, and institutional logic. ISO/IEC 27001 provides a formal structure for information security management.[41] NIST CSF 2.0 places governance at the center of cybersecurity risk management.[42] GDPR extends cybersecurity governance into legal accountability and data protection.[43] HIPAA adds privacy and security obligations for health-related information.[44] Together, these frameworks show that cybersecurity governance is not only technical. It is also interpretive, organizational, and legal.
This creates a difficult problem for organizations. Governance teams must identify relevant requirements, understand how those requirements overlap, and explain why particular decisions were made. Prior work on digital security risk management shows that cybersecurity decisions must be connected to organizational risk and accountability.[45]Research on IT governance also shows that governance depends on decision-making structures, responsibility, and alignment with institutional goals.[46] For this reason, compliance cannot be reduced to checking whether a document contains a particular rule. It requires reasoning across policies, controls, risks, and organizational contexts.
Current AI tools help with part of this problem, but they do not fully solve it. Large language models can summarize complex documents quickly, but fluency does not guarantee reliability.[47] Retrieval-augmented generation improves grounding by connecting generated responses to external sources.[48] Hybrid retrieval improves the search process by combining semantic and lexical methods.[49] Even so, these systems remain limited when they treat cybersecurity policy as unstructured text rather than as a connected system of obligations and relationships.
The HRAG-PA framework offers a different approach. By combining hybrid retrieval, structured policy knowledge, and constraint-guided generation, it supports a more policy-aware form of AI assistance. Knowledge graphs provide a useful foundation because they represent relationships among concepts, rules, and dependencies.[50] Graph-based retrieval research further suggests that structured knowledge can improve transparency in AI-generated outputs.[51] HRAG-PA applies these ideas to cybersecurity governance by making regulatory relationships part of the AI process itself.
The main value of HRAG-PA is that it helps move AI-assisted governance from information access toward defensible policy reasoning. Instead of only helping users find relevant text, the framework is designed to help explain how policy requirements connect and why a particular answer is supported. This is especially important in compliance environments, where decisions must be documented, reviewed, and justified. By emphasizing interpretability, traceability, and auditability, HRAG-PA offers a more reliable path for using AI in cybersecurity governance.
[1] International Organization for Standardization, ISO/IEC 27001:2022, Information Security, Cybersecurity and Privacy Protection
[2] Cherilyn Pascoe, Stephen Quinn, and Karen Scarfone, The NIST Cybersecurity Framework (CSF) 2.0
[3] European Parliament and Council of the European Union, Regulation (EU) 2016/679. General Data Protection Regulation
[4] U.S. Department of Health and Human Services, Health Insurance Reform: Security Standards; Final Rule,
[5] Organisation for Economic Co-operation and Development (OECD), Recommendation of the Council on Digital Security Risk Management, OECD/LEGAL/0479
[6] OpenAI, “GPT-4 Technical Report,” arXiv:2303.08774 (2023),
[7] Emily M. Bender, Timnit Gebru, Angelina McMillan-Major, and Shmargaret Shmitchell, On the Dangers of Stochastic Parrots: Can Language Models Be Too Big?
[8] Digital Security Risk Management for Economic and Social Prosperity: OECD Recommendation and Companion Document
[9] Elham Tabassi, Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1
[10] Steven De Haes and Wim Van Grembergen, “An Exploratory Study into IT Governance Implementations and Its Impact on Business/IT Alignment,” Information Systems Management 26, no. 2 (2009)
[11] Pascoe, Quinn, and Scarfone, The NIST Cybersecurity Framework (CSF) 2.0.
[12] European Parliament and Council, General Data Protection Regulation.
[13] OECD, Recommendation of the Council on Digital Security Risk Management.
[14] Lucas Franke, Huayu Liang, Aaron F. Brantly, James C. Davis, and Chris Brown, “A First Look at the General Data Protection Regulation (GDPR) in Open-Source Software,” in 2024 IEEE/ACM 46th International Conference on Software Engineering: Companion Proceedings (ICSE-Companion ’24) (New York: ACM, 2024)
[15] Ibid.
[16] Ibid.
[17] Bender et al., “On the Dangers of Stochastic Parrots.”
[18] Bender et al., “On the Dangers of Stochastic Parrots.”
[19] Patrick Lewis et al., “Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks,” Advances in Neural Information Processing Systems 33 (2020): 9459–9474,
[20] Qinglun Wang, Ji Yuan, Xinlong Huang, Jia Yan, Rixin Xiao, and Xianfeng Ding, “Hybrid Retrieval Systems Based on LLMs Embedding and Enhancement,” in KDD 2024 Workshop OAG-Challenge Cup (Barcelona, 2024)
[21] Yunfan Gao et al., “Retrieval-Augmented Generation for Large Language Models: A Survey,” arXiv:2312.10997 (2023),
[22] Aidan Hogan et al., Knowledge Graphs, Synthesis Lectures on Data, Semantics, and Knowledge.
[23] Qinggang Zhang et al., “A Survey of Graph Retrieval-Augmented Generation for Customized Large Language Models,” arXiv:2501.13958 (2025),
[24] Julio Hernandez, Delaram Golpayegani, and Dave Lewis, “An Open Knowledge Graph-Based Approach for Mapping Concepts and Requirements between the EU AI Act and International Standards,” AI and Ethics 5 (2025): 4463–4474,
[25] Kelvin Uzoma Echenim and Karuna Pande Joshi, “Deontic Knowledge Graphs for Privacy Compliance in Multimodal Disaster Data Sharing,” arXiv:2601.03587 (2026),
[26] Wang et al., “Hybrid Retrieval Systems Based on LLMs Embedding and Enhancement.”
[27] May-Myo Zin et al., “Can Legislation Be Made Machine-Readable in PROLEG?,” arXiv:2601.01477 (2026),
[28] Leon Garza, Lavanya Elluri, Aritran Piplai, Anantaa Kotal, Deepti Gupta, and Anupam Joshi, “PrivComp-KG: Leveraging KG and LLM for Compliance Verification,” in 2024 IEEE 6th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA) (Piscataway, NJ: IEEE, 2024)
[29] Wenbin Hu, Huihao Jing, Haochen Shi, Changxuan Fan, Haoran Li, and Yangqiu Song, “OmniCompliance-100K: A Multi-Domain, Rule-Grounded, Real-World Safety Compliance Dataset,” in Findings of the Association for Computational Linguistics: ACL 2026 (San Diego, CA: Association for Computational Linguistics, 2026),
[30] International Organization for Standardization, ISO/IEC 27001:2022.
[31] Pascoe, Quinn, and Scarfone, The NIST Cybersecurity Framework (CSF) 2.0.
[32] European Parliament and Council, General Data Protection Regulation.
[33] U.S. Department of Health and Human Services, “Health Insurance Reform: Security Standards; Final Rule.”
[34] OECD, Recommendation of the Council on Digital Security Risk Management.
[35] Bender et al., “On the Dangers of Stochastic Parrots.”
[36] Lewis et al., “Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks.”
[37] Wang et al., “Hybrid Retrieval Systems Based on LLMs Embedding and Enhancement.”
[38] Hogan et al., Knowledge Graphs.
[39] Zhang et al., “A Survey of Graph Retrieval-Augmented Generation.”
[40] Tabassi, Artificial Intelligence Risk Management Framework (AI RMF 1.0).
[41] International Organization for Standardization, ISO/IEC 27001:2022.
[42] Pascoe, Quinn, and Scarfone, The NIST Cybersecurity Framework (CSF) 2.0.
[43] European Parliament and Council, General Data Protection Regulation.
[44] U.S. Department of Health and Human Services, “Health Insurance Reform: Security Standards; Final Rule.”
[45] OECD, Recommendation of the Council on Digital Security Risk Management.
[46] De Haes and Van Grembergen, “An Exploratory Study into IT Governance Implementations.”
[47] Bender et al., “On the Dangers of Stochastic Parrots.”
[48] Lewis et al., “Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks.”
[49] Wang et al., “Hybrid Retrieval Systems Based on LLMs Embedding and Enhancement.”
[50] Hogan et al., Knowledge Graphs.
[51] Zhang et al., “A Survey of Graph Retrieval-Augmented Generation.”