[Paper Review] An Ontological Approach to Compliance Verification of the NIS 2 Directive

Gianpietro Castiglione, Daniele Francesco Santamaria+1 more|arXiv (Cornell University)|Jun 30, 2023

Information and Cyber Security4 citations

TL;DR

This paper proposes an ontological approach to automate compliance verification with the NIS 2 Directive by formalizing its security measures into a machine-processable knowledge base. Using semantic modeling and description logic reasoning, the authors demonstrate that an ontology can accurately represent entities and relations from Articles 7 and 10, enabling automated inference and SPARQL-based queries to verify compliance and detect missing requirements.

ABSTRACT

Cybersecurity, which notoriously concerns both human and technological aspects, is becoming more and more regulated by a number of textual documents spanning several pages, such as the European GDPR Regulation and the NIS Directive. This paper introduces an approach that leverages techniques of semantic representation and reasoning, hence an ontological approach, towards the compliance check with the security measures that textual documents prescribe. We choose the ontology instrument to achieve two fundamental objectives: domain modelling and resource interrogation. The formalisation of entities and relations from the directive, and the consequent improved structuring with respect to sheer prose is dramatically helpful for any organisation through the hard task of compliance verification. The semantic approach is demonstrated with two articles of the new European NIS 2 directive.

Motivation & Objective

• Address the challenge of interpreting complex, ambiguous, and linguistically dense security directives like the NIS 2 Directive.
• Enable mechanical interpretation of entities and relations from natural language directives to support structured compliance analysis.
• Develop a formal, mathematically grounded method to verify compliance with specific security measures using logical inference.
• Create a reusable, open-source ontology that models key aspects of the NIS 2 Directive for automated compliance checking.
• Demonstrate the feasibility of using ontologies to reduce auditing complexity and improve consistency in compliance verification.

Proposed method

• Formalize entities and relations from Articles 7 and 10 of the NIS 2 Directive using ontology design principles based on Gangemi et al.
• Model security measures as classes and constraints using OWL 2 DL, including data-type restrictions (e.g., max 3 months for submission deadlines).
• Implement a prototype knowledge base using a standard ontology language (OWL) and a description logic reasoner for inference.
• Use SPARQL queries to perform differential checks and identify missing compliance requirements for specific actors.
• Integrate the ontology with existing standards like OASIS and ENISA’s incident management ontology for future extensibility.
• Apply logical derivation to verify whether specific individuals (e.g., Member States) satisfy the compliance conditions defined in the directive.

Experimental results

Research questions

• RQ1 Can we mechanically interpret the relevant entities and relations from security directives given as large documents?
• RQ2 Can we mathematically prove that the relations interpreted from security directives hold for specific actors?
• RQ3 How can ontological modeling improve the accuracy and efficiency of compliance verification with complex regulatory texts?
• RQ4 To what extent can automated reasoning and querying detect non-compliance and missing requirements in real-world scenarios?
• RQ5 How can the NIS 2 Directive’s compliance requirements be formally represented and validated using semantic technologies?

Key findings

• The NIS Ontology successfully models core entities and relations from Articles 7 and 10 of the NIS 2 Directive using formal ontological techniques.
• The reasoner correctly inferred that an individual fulfilling all security measures is an instance of MemberState, validating the compliance model.
• The system detected that an individual missing two rules from Article 10 was only compliant with Article 7, confirming partial compliance detection.
• SPARQL queries accurately identified the two missing measures (designate CSIRT and ensure reporting to CSIRT) for a partially compliant individual.
• The prototype demonstrated that automated compliance verification is feasible and significantly reduces manual auditing effort and inconsistency.
• The open-source release of the NIS Ontology enables reuse and extension for broader regulatory compliance applications.