Compliance

From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure

AI-agent pipeline converts legacy OT security documentation into machine-readable OSCAL compliance artifacts without active scanning—directly relevant for NIS2 continuous-compliance mandates in critical infrastructure.

Summary written by editorial AI · Source link below

Filed by arXiv Crypto & Security10 July 20261 min readRead at source ↗

arXiv:2607.08288v1 Announce Type: new Abstract: In critical infrastructure, operational technology environments often cannot be actively scanned, and yet active system feedback is needed for risk assessment and compliance. This paper presents a non-invasive, MCP-grounded multi-agent pipeline that converts natural-language system descriptions into source-verified knowledge graph and audit-ready artifacts in the NIST OSCAL format for continuous automated compliance management. The architecture de

Editorial Analysis

Why it matters

NIS2 demands continuous, auditable compliance evidence from critical infrastructure operators, many of whom still rely on static documents; automated conversion to OSCAL closes that gap.

What to do

Pilot an MCP-based agent pipeline on a representative sample of legacy OT security documentation to assess feasibility of OSCAL-format compliance evidence generation.

Board brief

Automated conversion of legacy security documents to machine-readable compliance format can accelerate NIS2 readiness for critical-infrastructure operators.

Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.

Continue at the source

Read the full report at arXiv Crypto & Security

External link — opens at arXiv Crypto & Security in a new tab.

Continue with

Editorial Analysis

More from the Compliance Desk