From COBIT to ISO 42001: Evaluating cybersecurity frameworks for opportunities, risks, and regulatory compliance in commercializing large language models

Simple item page
dc.citation.volume144
dc.contributor.authorMcIntosh TR
dc.contributor.authorSusnjak T
dc.contributor.authorLiu T
dc.contributor.authorWatters P
dc.contributor.authorXu D
dc.contributor.authorLiu D
dc.contributor.authorNowrozy R
dc.contributor.authorHalgamuge MN
dc.date.accessioned2024-10-09T02:03:48Z
dc.date.available2024-10-09T02:03:48Z
dc.date.issued2024-09-01
dc.description.abstractThis study investigated the integration readiness of four predominant cybersecurity Governance, Risk and Compliance (GRC) frameworks – NIST CSF 2.0, COBIT 2019, ISO 27001:2022, and the latest ISO 42001:2023 – for the opportunities, risks, and regulatory compliance when adopting Large Language Models (LLMs), using qualitative content analysis and expert validation. Our analysis, with both LLMs and human experts in the loop, uncovered potential for LLM integration together with inadequacies in LLM risk oversight of those frameworks. Comparative gap analysis has highlighted that the new ISO 42001:2023, specifically designed for Artificial Intelligence (AI) management systems, provided most comprehensive facilitation for LLM opportunities, whereas COBIT 2019 aligned most closely with the European Union AI Act. Nonetheless, our findings suggested that all evaluated frameworks would benefit from enhancements to more effectively and more comprehensively address the multifaceted risks associated with LLMs, indicating a critical and time-sensitive need for their continuous evolution. We propose integrating human-expert-in-the-loop validation processes as crucial for enhancing cybersecurity frameworks to support secure and compliant LLM integration, and discuss implications for the continuous evolution of cybersecurity GRC frameworks to support the secure integration of LLMs.
dc.description.confidentialfalse
dc.edition.editionSeptember 2024
dc.identifier.citationMcIntosh TR, Susnjak T, Liu T, Watters P, Xu D, Liu D, Nowrozy R, Halgamuge MN. (2024). From COBIT to ISO 42001: Evaluating cybersecurity frameworks for opportunities, risks, and regulatory compliance in commercializing large language models. Computers and Security. 144.
dc.identifier.doi10.1016/j.cose.2024.103964
dc.identifier.eissn1872-6208
dc.identifier.elements-typejournal-article
dc.identifier.issn0167-4048
dc.identifier.number103964
dc.identifier.urihttps://mro.massey.ac.nz/handle/10179/71652
dc.languageEnglish
dc.publisherElsevier B.V.
dc.publisher.urihttps://www.sciencedirect.com/science/article/pii/S0167404824002694
dc.relation.isPartOfComputers and Security
dc.rights(c) 2024 The Author/s
dc.rightsCC BY-NC-ND 4.0
dc.rights.urihttps://creativecommons.org/licenses/by-nc-nd/4.0/
dc.subjectCybersecurity frameworks
dc.subjectLarge language models
dc.subjectRisk management
dc.subjectAI governance
dc.subjectCyber resilience
dc.subjectInformation security
dc.titleFrom COBIT to ISO 42001: Evaluating cybersecurity frameworks for opportunities, risks, and regulatory compliance in commercializing large language models
dc.typeJournal article
pubs.elements-id490849
pubs.organisational-groupOther
Files
Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
Published version.pdf
Size:
2.27 MB
Format:
Adobe Portable Document Format
Description:
490849 PDF.pdf
Download
License bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
license.txt
Size:
9.22 KB
Format:
Plain Text
Description:
Download
Collections
Journal Articles