You Know, Uhm… What Happens When Data Science Meets Cybersecurity GRC?
Exploring how machine learning could make security compliance easier, one experiment at a time.
You know, uhm… when Data Science meets Cybersecurity GRC, things get interesting!
And that is exactly what my new research project is about.
My research topic has officially been approved!
The topic is:
“Mapping Security Control Text to NIST CSF 2.0 Functions: A Simple Text Classification Approach for Compliance Support.”
Sounds technical, right? Let me break it down.
The Problem: Too Much Reading, Too Much Manual Work
Cybersecurity is not just about hackers, firewalls, and detecting threats. It is also about policies, risk management, documentation, and compliance.
Organizations need to understand how their security controls align with recognized frameworks. Reviewing and classifying hundreds of statements manually can be time-consuming.
So, I started thinking: What if machine learning could help make this process easier?
That question inspired my research.
The Idea: Teaching a Machine to Classify Security Controls
I will explore whether a simple machine learning model can classify security control statements into the six functions of the NIST Cybersecurity Framework (CSF) 2.0:
- Govern: Establish and oversee cybersecurity risk management.
- Identify: Understand assets, systems, and risks.
- Protect: Put safeguards in place.
- Detect: Identify potential cybersecurity incidents.
- Respond: Take action when incidents occur.
- Recover: Restore affected systems and operations.
My plan is to compare two approaches.
First, a keyword-based method. This uses predefined words to help assign statements to categories.
Second, TF-IDF with Logistic Regression. TF-IDF converts text into numerical features, while Logistic Regression learns patterns from labelled examples to predict the appropriate category.
I will compare their performance using accuracy and macro F1-score.
Will machine learning outperform the keyword approach? Or will the simpler method surprise me?
I do not have the results yet, and that is what makes the experiment exciting!
Why This Research Matters to Me
I am particularly interested in the intersection of cybersecurity, data science, and Governance, Risk, and Compliance (GRC).
I want to explore how simple, practical tools can support compliance work and reduce repetitive tasks without replacing human judgment.
Of course, real-world security policies can be complicated, and a model that performs well on structured framework statements may not perform equally well on every organization’s documentation. Understanding these limitations will be part of the journey too.
The Journey Starts Here
This project reminds me that research does not have to begin with a complicated system or a groundbreaking discovery.
Sometimes, it starts with one question, a simple approach, and the willingness to test an idea.
My next steps are to prepare the dataset, implement both approaches, evaluate the results, and learn from the mistakes along the way.
I am excited to discover what works, what does not, and what I can learn from the process.
If you are interested in cybersecurity, GRC, or data science, I would love to hear from you.
Here is a question for you: If you could automate one repetitive task in cybersecurity GRC, what would it be?
Let’s talk in the comments!
Thanks for reading.
Get Jennifer Udeh’s stories in your inbox
Join Medium for free to get updates from this writer.
#Cybersecurity #DataScience #GRC #MachineLearning #NISTCSFYou Know, Uhm… What Happens When Data Science Meets Cybersecurity GRC?
Exploring how machine learning could make security compliance easier, one experiment at a time.
You know, uhm… when Data Science meets Cybersecurity GRC, things get interesting!
And that is exactly what my new research project is about.
My research topic has officially been approved!
The topic is:
“Mapping Security Control Text to NIST CSF 2.0 Functions: A Simple Text Classification Approach for Compliance Support.”
Sounds technical, right? Let me break it down.
The Problem: Too Much Reading, Too Much Manual Work
Cybersecurity is not just about hackers, firewalls, and detecting threats. It is also about policies, risk management, documentation, and compliance.
Organizations need to understand how their security controls align with recognized frameworks. Reviewing and classifying hundreds of statements manually can be time-consuming.
So, I started thinking: What if machine learning could help make this process easier?
That question inspired my research.
The Idea: Teaching a Machine to Classify Security Controls
I will explore whether a simple machine learning model can classify security control statements into the six functions of the NIST Cybersecurity Framework (CSF) 2.0:
- Govern: Establish and oversee cybersecurity risk management.
- Identify: Understand assets, systems, and risks.
- Protect: Put safeguards in place.
- Detect: Identify potential cybersecurity incidents.
- Respond: Take action when incidents occur.
- Recover: Restore affected systems and operations.
My plan is to compare two approaches.
First, a keyword-based method. This uses predefined words to help assign statements to categories.
Second, TF-IDF with Logistic Regression. TF-IDF converts text into numerical features, while Logistic Regression learns patterns from labelled examples to predict the appropriate category.
I will compare their performance using accuracy and macro F1-score.
Will machine learning outperform the keyword approach? Or will the simpler method surprise me?
I do not have the results yet, and that is what makes the experiment exciting!
Why This Research Matters to Me
I am particularly interested in the intersection of cybersecurity, data science, and Governance, Risk, and Compliance (GRC).
I want to explore how simple, practical tools can support compliance work and reduce repetitive tasks without replacing human judgment.
Of course, real-world security policies can be complicated, and a model that performs well on structured framework statements may not perform equally well on every organization’s documentation. Understanding these limitations will be part of the journey too.
The Journey Starts Here
This project reminds me that research does not have to begin with a complicated system or a groundbreaking discovery.
Sometimes, it starts with one question, a simple approach, and the willingness to test an idea.
My next steps are to prepare the dataset, implement both approaches, evaluate the results, and learn from the mistakes along the way.
I am excited to discover what works, what does not, and what I can learn from the process.
If you are interested in cybersecurity, GRC, or data science, I would love to hear from you.
Here is a question for you: If you could automate one repetitive task in cybersecurity GRC, what would it be?
Let’s talk in the comments!
Thanks for reading.
#Cybersecurity #DataScience #GRC #MachineLearning #NISTCSF
