Resources and related work
UNIQ²Me starts with agreed questions and evidence criteria. Existing frameworks can inform those questions, while assessment procedures and operational systems provide the evidence behind their answers.
This guide summarizes the connections discussed in the manuscript. A framework reference does not establish that a catalog completely covers that framework.
Requirements and assessment
| Resource discussed in the manuscript | Role alongside UNIQ²Me |
|---|---|
| NIST Cybersecurity Framework 2.0 and Profiles | Organize cybersecurity outcomes and comparisons between current and target conditions. |
| NIST Secure Software Development Framework | Provides shared secure-development concepts for producers and purchasers. |
| OWASP Application Security Verification Standard | Supplies application-verification requirements; preserve the version in requirement references. |
| NIST SP 800-53A | Describes examination, interview, and testing as assessment methods. |
| NIST SP 800-55 Volume 1 | Distinguishes implementation, effectiveness, efficiency, and impact measures. |
| NIST SP 800-137 | Addresses the monitoring needed to maintain visibility into assets, vulnerabilities, and controls. |
| NIST SP 800-50 Revision 1 | Informs the design and evaluation of cybersecurity and privacy learning programs. |
An SF may ask whether a measured threshold was met. Its binary result does not retain the original measurement, so the supporting record remains essential.
Full assessment records
NIST OSCAL represents assessment plans, results, and plans of action and milestones in machine-readable form. Those records carry more context than a binary profile.
A proposed integration would link each SF outcome to its corresponding assessment finding. The compact view could then lead readers back to the detailed record. That mapping is not implemented in the manuscript.
Research context
The manuscript relates the method to several lines of research:
- Assurance presentation: Lins and colleagues examine how accompanying arguments and explanations affect the presentation of certification information.
- Continuous auditing: Their cloud-auditing work concerns keeping selected certification findings current as services change.
- Requirement tracing and executable policies: Work by Ge and colleagues, and Nweke and Yeng, addresses mappings and evidence connections that a surrounding workflow may need.
- Risk assessment and aggregate scores: Van Haastrecht and colleagues study threat-based assessment, while RAMA combines findings into local and global scores. UNIQ²Me uses benchmarking to mean satisfaction of a selected requirement set.
- Technical translation: Petts and colleagues discuss language access, context, and collaboration, which matter when catalogs are translated.
- Agent and language-model research: The manuscript draws on agent evaluation, instruction tuning, retrieval-augmented generation, and continual learning to outline future assessment assistance.
These references motivate design choices and proposed studies. They do not establish that the UNIQ²Me profile is understandable, accurate, or faster than a checklist.
Regulatory mappings
The manuscript uses NIS2-related recovery conditions as a worked example. It also discusses how logging and oversight records for AI systems, and preserved electronic assessment records, could support broader organizational processes.
Mapping a provision to a question requires the source, scope, evidence requirements, and responsible assessor. Passing selected questions does not determine compliance with a complete law or establish evidential weight.
See worked examples for the bounded recovery illustration.
Explore the documentation
- Question records: definitions, evidence criteria, and reference solutions.
- Evidence and interpretation: what a resolved bit retains and omits.
- Catalog versions: immutable editions and compatible comparisons.
- AI-assisted assessment: training, retrieval, inference, and evaluation.
- About and contributions: planned resources and the review process.
For bibliographic or manuscript questions, contact the corresponding author.