Automated Compliance Mapping in Cloud Security with Domain-Adapted Sentence Transformers

2026-07-08 · Source: cs.CL updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Expert, extended

Summary

Automating cloud security compliance mapping, a process traditionally manual and costly, is addressed by a proposed method utilizing domain-adapted Sentence Transformer models. Researchers built a training corpus of 3,499 semantic pairs from five European security standards (BSI C5, ENS, SecNumCloud, EUCS) and technical metrics, expanding it to 13,996 samples across four scenarios using back-translation and LLM-based paraphrasing. Five Sentence Transformer architectures were fine-tuned and evaluated on control-to-metric and cross-standard control association tasks. All fine-tuned models consistently outperformed their zero-shot baselines. The best model achieved up to 23 nDCG@10 points gain on the control-to-metric task, while multi-qa-mpnet-dot-v1 with back-translation reached 0.870 nDCG@10 on cross-standard control, demonstrating that in-domain training data is a primary driver of performance.

Key takeaway

For Cloud Security Architects or Compliance Engineers facing manual mapping burdens, this research demonstrates that fine-tuning Sentence Transformers with domain-specific data can automate compliance mapping effectively. You should prioritize creating a high-quality, unaugmented semantic pair corpus for control-to-metric tasks, and consider back-translation for cross-standard control alignment to achieve significant performance gains and reduce operational costs.

Key insights

Domain adaptation of Sentence Transformers significantly automates cloud security compliance mapping by leveraging specialized training data.

Principles

• In-domain training data drives performance for compliance mapping.
• Data augmentation benefits depend on the specific task.
• Fine-tuning consistently outperforms zero-shot baselines.

Method

Construct a semantic pair corpus from standards, augment via back-translation and LLM paraphrasing, then fine-tune Sentence Transformers using Multiple Negatives Ranking Loss for control-to-metric and cross-standard control association.

In practice

• Use unaugmented data for control-to-metric tasks.
• Apply back-translation for cross-standard control mapping.
• Fine-tune MPNet variants for optimal nDCG@10 scores.

Topics

• Cloud Security Compliance
• Sentence Transformers
• Domain Adaptation
• Data Augmentation
• EUCS
• Regulatory Compliance Automation

Code references

• jsvine/pdfplumber

Best for: NLP Engineer, Research Scientist, AI Scientist, Machine Learning Engineer, AI Security Engineer

Related on AIssential

• AutoAdapt: Automated domain adaptation for large language models — AutoAdapt automates LLM domain adaptation, transforming a manual, costly process into a reproducible, constraint-aware engineering discipline.
• Intro to NLP with spaCy (3): Detecting programming languages — Manual labeling and iterative error analysis are crucial for refining rule-based NLP systems and uncovering critical domain context.
• Understanding Domain-Aware Distribution Alignment in Budgeted Entity Matching — The BEACON framework's performance in low-resource, domain-aware Entity Matching is significantly affected by data constraints and supervision levels.
• Semantic drift and semantic integrity: Stewarding meaning in the age of AI — AI exponentially accelerates semantic drift, demanding a shift to continuous semantic integrity to govern system meaning.
• Broadening Access to Transportation Safety Data with Generative AI: A Schema-Grounded Framework for Spatial Natural Language Queries — A schema-grounded natural language interface broadens access to transportation safety data while ensuring reproducible, auditable analysis.
• Deep Dive into Content Faithfulness: A new metric for ensuring text accuracy — Content faithfulness is paramount for AI agents, as even small errors compromise downstream decisions.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by cs.CL updates on arXiv.org.