A systematic review of Cybersecurity Compliance Management

By Marc-André Léger, Ph.D. MBA. MScA. C. Adm.

Keywords

Compliance, Compliance management, information security, cybersecurity

Abstract

This article presents the results of a systematic review of recent academic literature on the cybersecurity compliance management. It proposes a working definition of cybersecurity compliance management as a process for the governance, oversight and tracking of how organizations comply with their cybersecurity, information security and data privacy obligations.

Introduction

It could seem obvious to readers that the timely availability of accurate information is critical to organizations. Because of an insatiable need for information, organizations also need appropriate safeguards to ensure that it is available to authorized stakeholders, according to business requirements, organizations policies, and strategic imperatives. Organizations also select best practices and standards that it wants, or needs, to follow. As well, information used in an organizational context is subject to legal, regulatory, and contractual constraints. Since this will incur the allocation of resources, both financial and human, it needs to be managed appropriately.

To do this as effectively as possible, organizations implement an integrated process of Governance, Risk Management and Compliance, referred to as GRC. This article investigates one of the components on GRC, which is compliance. More specifically, it is interested in cybersecurity compliance. Compliance is not more important than governance or risk management, as they are all important parts, required to successfully support organizations. However, the focus this systematic review is part of a larger project that concerns automated compliance management systems, which justifies the choice of the enquiry.

Methodology

The principal goal of this review is to determine the current state of knowledge in cybersecurity compliance management. The strategy proposed for conducting this systematic review use available academic databases and resources in a structured manner to generate reliable information about a topic. It applies a twelve-step process, developed by our research team to accelerate systematic reviews using data analytics. It is proposed that following the systematic process enhances reliability and scientific value of the results. The steps are described in more details online: https://www.researchgate.net/publication/361760661_Accelerating_your_initial_literature_review_a_process_for_students_starting_in_academic_research. All the supporting material for this article can be found on a GitHub repository: https://github.com/ITriskMgr/systematic-review_CybersecurityComplianceManagement

Determine the topic

Scientific research often starts with a subject to be explored. In this case the subject is determined by a willingness to explore the current state of the art in cybersecurity compliance management. This is part of an interest in developing automated information security compliance assessment, monitoring, and reporting of cybersecurity compliance for Canadian Small and Medium Businesses (SMB). Initial research indicated that there is not much literature on compliance issues specifically related to Canada or to SMBs. As well, the compliance literature does not seem to have a large corpus of material specific to cybersecurity compliance. However, many more general aspects of compliance could bring insights that will be useful. Thus, it is determined that the initial search topic is: “Information system compliance management”.

Choosing keywords

Computer security and cybersecurity are also used as synonyms for information security and is added to the initial search term of Information security. As well, to broaden the initial search, both compliance and compliance management will be used. The first element will help to identify the articles in the general topic. The second and third elements will help to narrow down the results to be more relevant. In this case the last query that is used could be appropriate for the intended purpose at this point while adding limits, as described in the next step. However, because the team intents to use analytical tools and perform bibliometric analysis of the results, it is determined that the next step will proceed with the last query:

(“Information security” OR “computer security” OR cybersecurity) AND «compliance management»

Identify limits

Starting from what is done in the previous steps, restrictions to limit the results to scientific articles published in peer-reviewed journals during the last ten years in English is considered. However, to help determine the optimal period, a bibliometric analysis of Google Scholar citations on compliance from 1960 to 2022 was performed using R-Studio. It was observed that compliance has emerged in scientific literature starting in 1994, when the number of yearly publications reached ten per year. There are very few publications recorded in Google Scholar before that date. It has only passed the 100 publications per year in 2002. Based on this information, no additional limits will be added at this time. However, considering the size of the corpus of documents resulting from the search (200), it would seem reasonable to add date limits (2002 to 2022) and select only Journal articles.

It should be expected to have a large amount of overlap between the different sources. This, once imported into Zotero and 44 duplicates removed. At the end of this step, there are 156 articles remaining following the process described.

Library and additional databases

Retrieving the documents is done using databases available on the Polytechnique Montréal and Concordia University library websites. As both universities have different database subscriptions, this allows for additional sources to be identified. However, it may result in many duplicates. The duplicates can be easily resolved later. To cast a wide net and increase the likelihood of including important literature on a subject, the following databases are used, as they are the most used databases used in our field of inquiry, Scopus, Web of Science, and Engineering Village. The results from the library searches are imported into Zotero and duplicates removed. At this point 179 documents remained.

Triage articles and add keywords

The results are then submitted to a first high-level review. This review looks at the title of the articles and the abstract. This is done to ensure the articles are relevant and ready to be used for the next steps. In this case, 50 articles are removed as they did not indicate a link to the research question, did not meet the standard for academic papers or where not in English. For example, a product evaluation, an editorial or an article that is not from a peer-reviewed process is removed. Following this step 129 articles remained. This step is also an opportunity to help identify additional terms and keywords that can become useful later in the systematic review. The additional terms identified are then used for an automated analysis using R-Studio. From this initial list of keywords and expressions, it becomes possible to start to construct an ontology of the domain, which can then be further improved as the project progresses. This ontology will be used to classify articles.

Create, build, and optimize a literature map

From there, a literature mapping tool is used (https://app.litmaps.co/ ) and a bibtext file export of the articles remaining after the triage step are imported. The literature map gives a visual representation of the articles in the corpus and shows the links between them. It also shows the relative importance of articles in the size of the associated marker. The LitMap tool can then suggests new articles, which are potentially relevant based on what is there. In this case, after a few days and several trials with different combinations of dates and keywords, LitMap only suggested articles about compliance and not about compliance management. Therefore, it is decided not to add articles from the map, this eliminating the need to perform two steps in the review methodology that concern adding articles to the LitMap and re-exporting the results to Zotero. Although it did not generate new articles to add to the systematic review, the LitMap tool allows the team to get a visual outlook of the literature. This graphical presentation is helpful to get a better understanding of what is there and helping to identify the evolution of knowledge in this fields, the connections in the literature and significant articles that are more connected to the corpus of knowledge. This will become helpful in the analysis.

Download all the articles

As mentioned, some of the articles are linked directly to Zotero, as they are already included in previous steps. However, for the up-coming steps in the systematic review, it is necessary to have local copies of all the articles available in PDF. Performing a literature review involves reading and analyzing the articles at some point, so having a copy of them is an obvious necessity. Even if an effort is made to automate as much as possible and have a systematic approach that makes it possible to reduce the number of articles, reading the articles is still required. After a thorough search, a few articles still could not be located, as it is a very small number, they are removed, as keeping references to unavailable articles may be problematic for the next steps and for the analysis. However, this may introduce a small bias in the results. At this step, 127 documents remained in the collection.

Once all the articles have been downloaded a more in-depth review is made to assess their relevance. This step could be done by a team of researchers with the assistance of students. It requires that inclusion and exclusion criterions be identified. At this point there should be enough domain knowledge to make this feasible. If the number of articles is not too large, it might be acceptable to omit this step. Another strategy that might be considered is to perform a review by looking at the abstracts only to assess relevance for inclusion or exclusion. Then a review can be performed by reading more comprehensive machine-generated summaries. This would be followed by the lecture of the full articles that make it through the process. An initial automated analysis is performed using R-Studio.

Analyze the documents

The final step in the systematic review is to use the final selection of articles to perform a more in-depth analysis of the corpus of documents. This step is done using two strategies: by reading the articles and with the help automation.  Reading involves, as it would imply, that the articles be read, that key information be highlighted and that notes be taken, using Zotero or other annotation tools. Automation would involve using natural language processing tools. In this case, R-Studio applications and bibliometric analysis are used using Bibliometrix and Quanteda (Benoit et al., 2018). Based on the bibliometric and automated analysis, a final sample of what appears to the research team to be the most relevant sources based on the results of the analysis is presented in a later section of this article.

Automated analysis of the corpus

The first automated analysis is done in R-Studio. It was found that 26 words that appear more 2000 times. In fact, the R Studio code that was used creates an Excel file with all the keywords that appear at least 100 times in the corpus, of which there are 1573 different keywords. Further analysis is performed using a combination of keywords that are relevant to the subject. However, when examining the complete list of keywords, it became obvious that there could be errors due to the different form of the keywords that appear in the corpus. With the keywords systems and used, there would be more accuracy in the intent of the documents to combine variations of a word, thus using stems. Hence, it was decided to use stemmed keywords, rather that the regular for of the words. Here as well, the R Studio code creates an Excel file with all the stemmed keywords that appear at least 100 times in the corpus, of which there are 1289 different keywords.

From this information, further refinement was done to determine the relevance of the documents in the corpus to the research question. This is done to eliminate from the corpus documents that are not sufficiently important, thus optimizing the use of resources. This was done with a combination of keywords that are closely correlated to the theme of compliance management, identified as group K1. The top ten documents, including the top six documents that had a K1 group value of above 1000. This is a simple calculation based on the total number of occurrences of the words in the PDF files. This is subject to many biases, of course. For example, it is impacted by less relevant data, such occurrences in the bibliography. Longer documents would naturally have more potential to have more occurrences. As well, an article is not necessary more relevant if a particular word occurs more often. However, in conjunction with other data, this does contribute to our analysis.

An example of the potential biases of this initial analysis is shown in the highest ranked document (Stroup, 2014). This is not a peer-reviewed journal article but rather it is a Ph.D. dissertation, from a candidate Capella. While it is relevant, it is more about governance than compliance management. The second document (Yang, 2018), is much more relevant, even if it presents a literature review done as part of a Master’s degree and has the added element of being supervised by Siponen Mikko, which is identified in a Scopus and a Web Of Science review as being an influential author of scientific publications on compliance, as the bibliometric analysis has identified.

Another strategy adopted to try to mitigate the biases created by larger documents is to consider the number of pages in the document to calculate a factored value of K1, which is named Fac K1. This is simply calculated by dividing the K1 value by the number of pages in the document. The top 10 results of the 127 documents are presented in table 1.

Doc No	Reference	Nb Pages	K1 Rank	K1	Fac K1 Rank	Fac K1
75	(Mayer & De Smet, 2017)	9	15	601	1	66,78
62	(Joshi, 2008)	9	18	560	2	62,22
35	(Delavari, Elahi, et al., 2019)	6	46	371	3	61,83
116	(von Solms, 2005)	5	61	301	4	60,20
98	(Pla et al., 2020)	6	53	351	5	58,50
10	(AlKalbani et al., 2017)	11	14	618	6	56,18
88	(Nissen & Marekfia, 2013)	6	57	336	7	56,00
11	(Almutairi & Riddle, 2018)	7	43	380	8	54,29
104	(Sabillon et al., 2017)	7	48	364	9	52,00
45	(Fenz et al., 2015)	4	89	206	10	51,50
33	(Dang et al., 2019)	6	67	285	11	47,50

A manual analysis shows that the Fac K1 value does appear to correlate to the relevance of the article. For example, (Mayer & De Smet, 2017) presents a systematic review on the subject of governance, risk management and compliance (GRC) that looks into ISO standards on this topic. Examining a sample of the articles it seems that the higher the Fac K1, the more the document is relevant and that lower ranked Fac K1 values are less relevant. The lower ranked documents are then targeted to be considered for exclusion from the corpus, potentially allowing the team to optimize the use of resources to review the documents and complete the systematic review. In appendix D, documents displayed in red were removed from the corpus for the analysis once the fac K1 test was performed, and a final review of these documents was done to confirm that removal was justified.

Following a review of the results, the decision is made to remove from further steps of the systematic review all articles that have a Factored K1 value of less than one standard deviation below the average. In this case applying the value of 5,34, would result in 15 documents to be removed, leaving 113 documents in the corpus. However, before removing any documents, they were further scrutinized. One document with a score of zero was found to be relevant but is not processed accurately in the previous steps as the PDF file was saved as an image, making it impossible to be assessed automatically. The article was converted using OCR and kept for the next steps. Two documents were also found to be relevant. In the end, 11 documents were removed from the corpus. Following this, 116 documents remained in the corpus. The histogram in figure x, shows the distribution of the documents per publication year. These 116 documents, published from 2004 to 2022 form the corpus for the rest of this article and used for the next step of analysis, as illustrated in figure 3.

N-gram identification

The next automated analysis that is performed is the identification of N-grams in the corpus. The goal is to identify groupings of keywords, in this case of two, three or four words. For this purpose, R-Studio is used. The strategy was to use an automated process to identify bigrams, made of two words that appear in sequence in the corpus, trigrams, made of three words and quad-grams, made of four words. Following this automated process, the most frequent bigrams are identified. Two bigrams were removed as they are less relevant as they more related to the context or the methodology components of the document. The bigrams that were removed are literature review, intern confer, and case studi. However, all the others are directly related to the research question, further supporting that this is useful. When looking at the top twenty (20) trigrams, it was observed that many trigrams that are useful and relevant (12/20). However, there are several (8/20) that are not relevant and were removed, such as: author licens use, and licens use limit. When observing the eleven (11) quad-grams, it can be observed there are few trigrams that are useful and relevant (1/12). But one particularly stands out, inform secur polici complianc, as confirming an intuition that much of the corpus concerns information security policy compliance, a popular topic in the cybersecurity compliance literature. Similarly, nation institut standard technolog, would indicate that National Institute of Science and Technology or NIST, a very popular source of guidance, standards, and frameworks in this area. At this point, there is ample data acquired in a systematic review process to help understand the concept of compliance management. However, it was also decided to proceed with a bibliometric analysis to inform further insights. As this is done using existing analytical tools, it would not add excessive work. This is described in the next section.

Bibliometric analysis

To perform in-depth bibliometric analysis of the corpus of documents using Bibliometrix (https://www.bibliometrix.org/home/ ) the keywords «compliance management» are used to produce information from Web of Science. This resulted in 346 refences exported from Web Of Science (WoS) in Bibtext format that are analyzed using r-studio and an existing library called Bibliometrix, as shown in table 2. The column Results WoS presents this data. The analysis showing the results was supplemented by the data already collected on the corpus of 116 documents, shown as Systematic Review (SR) Corpus in table 2. The data was analyzed using R-Studio and statistical functions in Excel. In some cases, the data was also calculated from the Zotero database or manually counted.  

Description	Results WoS	SR Corpus
Timespan of articles	1979 to 2022	2004 to 2022
Sources (Journals, Books, etc)	299	108
Documents	346	116
Annual Growth Rate %	5.73	5.3
Document Average Age	9.53	5.5
Average citations per doc	9.965	51.60
References	8782	5986

The data presented in table 2 compares the results of the Web of Science query on compliance management, comprising 346 documents published from 1979 to 2022, with the results collected in the corpus of 116 documents used in the systematic review, published from 2004 to 2022. As previously mentioned, the documents collected concern cybersecurity compliance management. As such the two are comparable and this information can help develop further insights, as well as validate the corpus.

Literature review

Following the bibliometric analysis of the corpus, which is presented in the previous sections, this section presents an overview of current knowledge around cybersecurity compliance management. The review is based on the corpus of 116 documents that is identified at the end of the process. Reminding readers that the search query used. From the query, documents were identified and scored to facilitate the process. Most of the documents scored a high Factored K1 value, indicating their high correlation to the keywords that describe the research question. This is important to the team as this literature review a necessary step in empirical research. Observing the literature for compliance and compliance management, not limited to cybersecurity, the number of academic and peer-reviewed sources seems to be relatively small. Particularly, when compared to previous articles in cybersecurity, where the number of articles is much larger. However, by following the systematic review process described, and looking at the metrics, the documents that remain in the corpus appear to be the most relevant.

The literature review starts with the concept of compliance and how it differs in cybersecurity compared to other areas of compliance. It then discusses compliance management and compliance management tools, such as frameworks, standards, and others, that are identified in the literature. To find expressions in the corpus the grep -irl «search text» . command was used in a MacOS Terminal window. This was followed by a manual review of the documents to count the occurrences of the different expressions. As well, R-Studio was used to categorize the articles based on keywords that have been identified in the systematic review. This automated process was chosen to eliminate biases often introduced in this process by reviewers.

Information security

As the research question is investigated a particular aspect of compliance, namely information security compliance, it was decided to also include similar terms in the queries, as described earlier. Of course, a central aspect is information security, or the aspects of security related to information used by organizations in the execution of its mission and by the various business processes required to operate. But since the literature may use different terms, such as cybersecurity to describe information security in a connected world such as organizations involved in e-business or using the Internet as an important component of their strategy. Since it was noticed that cybersecurity may be written in different manners in the articles retrieved. Similar keyword choices were also made in other articles, such as (Anu, 2021).

Organizations need to safeguard the information they need to operate (Fenz et al., 2013). As well, they need to protect their employees access to this information (Chaudhry et al., 2012). The goal of information security as the protection of information systems so they can operate as expected (Yang, 2018). Information security is used to determine the choices organizations need to make and the mitigation measures that they implement to stop the threats against their valued information (Ali et al., 2021). Internal stakeholders, such as employees, are key components of information security management (Chen et al., 2018). Metrics are used to monitor the effectiveness of information security choices (Anu, 2021). In particular, information security governance metrics are an important decision making enabler for organizations to optimize information security programs and strategy (Anu, 2021).

Compliance

Based on the search query used to perform the systematic review, it should be expected that the term compliance appears in all the documents in the corpus. In fact, the term compliance and its variations appear 5627 times in all the 116 documents in the corpus. However, looking at the documents with the highest Factored K1 Scores for a definition, a working definition can be determined. Starting from these sources, and further supported by other documents in the corpus, the literature review, definitions have emerged and presented in this section. A similar strategy is used to develop all the other definitions.

Risk management and compliance are steering tools that organizations integrate in a governance layer (Fenz et al., 2013; Mayer & De Smet, 2017). Referred to as GRC, covering the three complementary disciplines of governance, risk management and compliance. (Mayer & De Smet, 2017) further cite Racz et al., who define GRC as

“an integrated, holistic approach to organization-wide governance, risk and compliance ensuring that an organization acts ethically correct and in accordance with its risk appetite, internal policies and external regulations through the alignment of strategy, processes, technology and people, thereby improving efficiency and effectiveness”[1].

The ISO/IEC 38500:2015 standard, titled “Information Technology — Governance of IT — for the organization” provides normalized guidance and principles for the effective, efficient, and acceptable use of IT within organizations.

At the highest levels of an organization, the board of directors and the executives, Corporate Governance provides strategic and performance guidance as to how objectives are achieved, creating value, while risks are managed appropriately (Al-hashimi et al., 2018; Chaudhry et al., 2012; von Solms, 2005; Yip et al., 2006). This high-level guidance leads, among many other more tactical guidance, which include IT governance and, more specifically, information security governance (Yip et al., 2006). The information security component of corporate governance informs all stakeholders of the organization on how information security is addressed at an executive level and a part of an organization’s overall corporate governance responsibilities (Al-hashimi et al., 2018). It also provide guidance in navigating the complex web of data protection, privacy regulations, and security standards that can help organization to meet its compliance requirements (Fenz et al., 2013; Yip et al., 2006). Information security governance will also guide the organization in the creation of Information Security Policies, a key component of information security(Yang, 2018), which informs internal stakeholders of acceptable use of information systems (Chen et al., 2018). Information security governance is an integral part of good IT and Corporate Governance (von Solms, 2005).

‘Information Security Governance consists of the management commitment and leadership, organizational structures, user awareness and commitment, policies, procedures, processes, technologies and compliance enforcement mechanisms, all working together to ensure that the confidentiality, integrity and availability (CIA) of the company’s electronic assets (data, information, software, hardware, people, etc.) are maintained at all times’. (von Solms, 2005).

Categories of compliance

Multiple categories of compliance have been identified in the context of this study. However, not all of them are relevant in the context of this study. For example, compliances domains related to the environment, public works, or financial services where not considered as relevant, unless it considered specific IT-related or cybersecurity aspects. Other categories that where included are:

• Information security compliance
• Information Security Policy Compliance
• Security policy compliance
• Security Standard Compliance
• Cybersecurity compliance
• Business process compliance
• Legal and regulatory compliance
• Legal compliance
• Regulatory compliance
• Privacy compliance

The expression “cybersecurity compliance” does not appear in any of the documents in the corpus. However, other forms that have a similar meaning in the context of this study are found in the corpus, as expected. The similar forms that have been identified are security compliance, information security compliance, security policy compliance and information security policy compliance. Standard compliance and security standard compliance were also included.

There are other categories of compliance that are mentioned in the corpus. The compliance categories identified include business process compliance, legal and regulatory compliance, legal compliance, regulatory compliance, privacy compliance and environmental compliance. They are included in this study as they could provide valuable insights as to various compliance approaches that can be used for cybersecurity compliance.

Compliance framework

As previously mentioned, a complex web of laws, regulations, standards, policies and contractual obligations contribute to providing compliance requirements (Abdullah et al., 2016). To help organizations fulfil these requirements, various stakeholder groups has created IT governance and compliance frameworks, such as consensus-based standards. The literature in the corpus mentions many of these. COBIT, created by ISACA, ISO 27001 and ISO 27002, created by ISO/EIC subcommittee 27, and NIST cybersecurity framework, created by the National Institute of Science and Technology (NIST) are among the standards most frequently identified with compliance (Al-hashimi et al., 2018; Ali et al., 2021; Delavari et al., 2019; Shamsaei et al., 2011; Sillaber et al., 2019). The ISO/IEC 38500:2015 standard “Information Technology — Governance of IT — for the organization” provides guiding principles on the effective, efficient, and acceptable use of IT within their organizations. It also provides guidance to those advising, informing, or assisting governing bodies. (Mayer & De Smet, 2017)

While many of the articles in the corpus mention specific frameworks that are used for compliance, only two mention the expression “compliance frameworks” directly, (Cabanillas et al., 2022; Shamsaei et al., 2011), while none mention “compliance requirements”.

Compliance management

The expression “compliance management” appears in many articles in the corpus. (Fenz et al., 2015) presented an automated information security risk and compliance assessment tool for hardware, software and data assets based on ISO27002 controls. The strategy (Fenz et al., 2015) developed is based on automatic keyword-based identification of policy documents and assigning them automatically to the most fitting ISO 27002 control. Activities for which compliance must be managed (von Solms, 2005) :

• Previously identified IT risks
• Information Security awareness
• Information Security policies, procedures, and standards
• Regulatory, legal and statutory requirements
• Software Licensing issues and others.

(Abdullah et al., 2016) developed an ontology intended to provide a shared conceptualization of compliance management, the compliance management ontology (CoMOn). This ontology should be integrated in the construction of the cybersecurity compliance ontology that is being created.

Compliance checking

Compliance checking is a process used to enforce compliance to policies and procedures, as well as adequate management of IT risks (von Solms, 2005). In compliance checking, a source of compliance requirements, such as regulations and policies, help to define a set of controls that must be observed by the organization to achieve compliance (Cabanillas et al., 2022). There are many strategies that can be used to perform compliance checking. In the past, manual processes have been used. In regulatory compliance checking, manual compliance checking has been found to be a costly and error-prone process Cunha et al., 2021). There are many other strategies that can be used to improve compliance checking. For example, (Janpitak N. & Sathitwiriyawong C., 2015) proposes an ontology-based automated compliance checking approach for non-log operations. (Cunha et al., 2021) proposes an automated approach for regulatory compliance checking based on the use of empirical fuzzy multi-criterion logic. (Massey et al., 2015) mentions logic-based and requirement modelling approaches to compliance checking that have also been used in software engineering.

Literature analysis

Reminding the reader that this systematic literature review aimed to identify the current state of knowledge on Cybersecurity Compliance Management, this section looks at gaps in the literature on this topic. A few things to consider are mentioned here:

• Compliance, as a research subject, only emerged since the last 20 years.
• Cybersecurity compliance is about 10 years old as a research domain.
• The number of cybersecurity articles that have been identified is lower than wan initially expected.
• Many different types of security-related compliance exist and are studied, cybersecurity is not the most popular area found in published research articles.
• Cybersecurity compliance comprises many specialty areas that include compliance to laws and regulations, contractual obligations, international obligations, privacy, environmental issues related to datacenters, as an example, and many other areas
• Information Security Policy compliance is a popular area of published research.
• Privacy compliance is also another area for which there is large and growing corpus of publications.
• Much of the information found related to cybersecurity compliance metrics is anecdotal or based on commercial solutions for which there is no published peer-reviewed publications that would support its inclusion in this systematic review.
• Information on cybersecurity compliance metrics can be found in product reviews, professional literature, marketing support material or non-academic publications.

Compliance is not an isolated area but as a component of the GRC cybersecurity process triad. Governance gives direction and context, risk management provides information about risk appetite, defines levels of acceptability, and select metrics, while compliance is used to monitor implementation and, without surprise, ensure compliance to legal and contractual obligations, tracks respects of governance objectives and manage risks.

While compliance is predominantly a business concern, it is intrinsically linked to technical aspects of cybersecurity. Because of the complexity of how it is connected to different problem domains, such as legal and regulatory issues, contractual issues, human behavior issues, as well as the technical aspects, a combination of business and technical skills is likely desirable. This, and other reasons, contribute to increasing the subjectivity of compliance evaluation. Also, adding to the problem that most monitoring involves manual review, it is error prone, as well begging subjective, compounding the problem. Mechanisms and tools, such as ontologies proposed by (Abdullah et al., 2016) or automation, perhaps using analytics or machine learning, can help limit the effects. There are many research opportunities in cybersecurity compliance and many researchers interested in this area but there is little peer-reviewed output showing this. This is something that need further investigation to find solutions to resolve this issue.

Based on what identified in this systematic review, a definition of compliance management is proposed:

Compliance Management is concerned with the governance, oversight and tracking of how organizations comply with their obligations.

As there are many categories and levels of obligations, domains of compliance management are needed to address them. As the focus of this systematic review is cybersecurity compliance, the definition can be further developed to address this situation. Hence, a definition of cybersecurity compliance management is proposed:

Cybersecurity Compliance Management provides processes for the governance, oversight and tracking of how organizations comply with their cybersecurity, information security and data privacy obligations.

While this working definition can be further improved, it provides a reasonable starting point that is congruent with the findings of the systematic review that was performed and described in this article. It is sufficiently vague to allow for the various categories of compliance that need to be integrated into the cybersecurity domain. It also allows for the use of this definition in the design of an automated compliance management and assessment solution that can be done.

Conclusion

This article described a systematic review of cybersecurity compliance management. It was performed with a specific goal in mind, to support the design of an information system to assist organization achieve and maintain compliance. While one of the findings is that the corpus of scientific publications is smaller than it should probably be, considering how this is such an important topic and how important it is to organizations today. It was also found that cybersecurity compliance is a multi-dimensional problem, including several problem domains, such as legal, organizational, human, and technical, and requiring but business and technical solutions.

Bibliography

Abdullah, N. S., Indulska, M., & Sadiq, S. (2016). Compliance management ontology—A shared conceptualization for research and practice in compliance management. Information Systems Frontiers : A Journal of Research and Innovation, 18(5), 995‑1020. https://doi.org/10.1007/s10796-016-9631-4

Agbaegbu, J., Arogundade, O. T., Misra, S., & Damaševičius, R. (2021). Ontologies in Cloud Computing—Review and Future Directions. Future Internet, 13(12), 302. https://doi.org/10.3390/fi13120302

Akhunzada, A., Sookhak, M., Anuar, N. B., Gani, A., Ahmed, E., Shiraz, M., Furnell, S., Hayat, A., & Khan, M. K. (2015). Man-At-The-End attacks : Analysis, taxonomy, human aspects, motivation and future directions. Journal of Network and Computer Applications, 48, 44‑57. https://doi.org/10.1016/j.jnca.2014.10.009

Al-hashimi, M., Othman, M., Sulaiman, H., & Zaidan, A. A. (2018). Information Security Governance Frameworks in Cloud Computing an Overview. Journal of Advanced Computer Science and Technology Research, 8(2), 67‑81.

Ali, R. F., Dominic, P. D. D., Ali, S. E. A., Rehman, M., & Sohail, A. (2021). Information security behavior and information security policy compliance : A systematic literature review for identifying the transformation process from noncompliance to compliance. Applied Sciences, 11(8), 3383. https://doi.org/10.3390/app11083383

AlKalbani, A., Deng, H., Kam, B., & Zhang, X. (2017). Information Security Compliance in Organizations : An Institutional Perspective. Data and Information Management, 1(2), 104‑114. https://doi.org/10.1515/dim-2017-0006

Al-Rashdi, Z., Dick, M., & Storey, I. (2017). Literature-based analysis of the influences of the new forces on ISMS : A conceptual framework.

Alsharif, I., & Khelifi, A. (2019). Exploring the Opportunities and Challenges of Open Source Software and Its Economic Impact on the Cybersecurity Market. Smart Technologies and Innovation for a Sustainable Future, 115‑127.

Anu, V. (2021). Information security governance metrics : A survey and taxonomy. Information Security Journal: A Global Perspective, 1‑13.

Bélanger, F., & Crossler, R. E. (2011). Privacy in the digital age : A review of information privacy research in information systems. MIS quarterly, 1017‑1041. https://doi.org/10.2307/41409971

Benoit, K., Nulty, P., Obeng, A., Müller, S., & Matsuo, A. (2018). quanteda : An R package for the quantitative analysis of textual data. Journal of Open Source Software, 774.

Bibliometrix—Home. (s. d.). Consulté 15 août 2022, à l’adresse https://www.bibliometrix.org/home/

Bicaku, A., Zsilak, M., Theiler, P., Tauber, M., & Delsing, J. (2022). Security Standard Compliance Verification in System of Systems. IEEE Systems Journal, 16(2). https://doi.org/10.1109/JSYST.2021.3064196

Cabanillas, C., Resinas, M., & Ruiz-Cortes, A. (2022). A Mashup-Based Framework for Business Process Compliance Checking. IEEE Transactions on Services Computing, 15(3). https://doi.org/10.1109/TSC.2020.3001292

Chaudhry, P. E., Chaudhry, S. S., Reese, R., & Jones, D. S. (2012). Enterprise information systems security : A conceptual framework. Re-conceptualizing Enterprise Information Systems, 118‑128.

Chen, X., Chen, L., & Wu, D. (2018). Factors That Influence Employees’ Security Policy Compliance : An Awareness-Motivation-Capability Perspective. Journal of Computer Information Systems, 58(4), 312‑324. https://doi.org/10.1080/08874417.2016.1258679

Culot, G., Nassimbeni, G., Podrecca, M., & Sartor, M. (2021). The ISO/IEC 27001 information security management standard : Literature review and theory-based research agenda. The TQM Journal.

Cunha, V. H. C., Caiado, R. G. G., Corseuil, E. T., Neves, H. F., & Bacoccoli, L. (2021). Automated compliance checking in the context of Industry 4.0 : From a systematic review to an empirical fuzzy multi-criteria approach. Soft Computing, 25(8), 6055‑6074.

Da Veiga, A., & Eloff, J. H. P. (2007). An Information Security Governance Framework. Information Systems Management, 24(4), 361‑372. https://doi.org/10.1080/10580530701586136

Dang, L. M., Piran, M. J., Han, D., Min, K., & Moon, H. (2019). A survey on internet of things and cloud computing for healthcare. Electronics, 8(7), 768.

Delavari, V., Shaban, E., Janssen, M., & Hassanzadeh, A. (2019). Thematic mapping of cloud computing based on a systematic review : A tertiary study. Journal of Enterprise Information Management.

Esayas, S., & Mahler, T. (2015). Modelling compliance risk : A structured approach. Artificial Intelligence and Law, 23(3), 271‑300. https://doi.org/10.1007/s10506-015-9174-x

Fenz, S., Heurix, J., & Neubauer, T. (2015). How to increase the inventory efficiency in information security risk and compliance management. 2015-May.

Fenz, S., Neubauer, T., Accorsi, R., & Koslowski, T. (2013). FORISK: Formalizing information security risk and compliance management. 4 pp.-. https://doi.org/10.1109/DSNW.2013.6615533

Foorthuis, R., & Bos, R. (2011). A Framework for Organizational Compliance Management Tactics. In C. Salinesi & O. Pastor (Éds.), Advanced Information Systems Engineering Workshops (Vol. 83, p. 259-+). Springer-Verlag Berlin. http://www.webofscience.com/wos/woscc/summary/ef98347e-e620-4445-90b7-1dcb9f988d95-417d1e10/relevance/1

Gupta, B. B., & Badve, O. P. (2017). Taxonomy of DoS and DDoS attacks and desirable defense mechanism in a cloud computing environment. Neural Computing and Applications, 28(12), 3655‑3682.

Hassanzadeh, A., Rasekh, A., Galelli, S., Aghashahi, M., Taormina, R., Ostfeld, A., & Banks, K. (2020). A review of cybersecurity incidents in the water sector. arXiv preprint arXiv:2001.11144.

Jacobs, P., Arnab, A., & Irwin, B. (2013). Classification of security operation centers. 7 pp.-. http://dx.doi.org/10.1109/ISSA.2013.6641054

Janpitak N. & Sathitwiriyawong C. (2015). Automated Compliance Checking Methodology for Non-Log Operations. Information Security Journal, 24(4‑6), 98‑108. https://doi.org/10.1080/19393555.2015.1067340

Joshi, S. (2008). HIPAA, HIPAA, Hooray? : Current Challenges and Initiatives in Health Informatics in the United States. Biomedical informatics insights, 1. https://doi.org/10.4137/BII.S2007

Marbouh, D., Abbasi, T., Maasmi, F., Omar, I. A., Debe, M. S., Salah, K., Jayaraman, R., & Ellahham, S. (2020). Blockchain for COVID-19 : Review, opportunities, and a trusted tracking system. Arabian journal for science and engineering, 45(12), 9895‑9911.

Martínez-González, M. M., Alvite-Díez, M. L., Casanovas, P., Casellas, N., Sanz, D., & Aparicio, A. (2021). OntoROPA Deliverable 1. State of the Art and Ambition.

Massey, A. K., Otto, P. N., & Antn, A. I. (2015). Evaluating Legal Implementation Readiness Decision-Making. IEEE Transactions on Software Engineering, 41(6). https://doi.org/10.1109/TSE.2014.2383374

Mayer, N., & De Smet, D. (2017). Systematic Literature Review and ISO Standards analysis to Integrate IT Governance and Security Risk Management. International Journal for Infonomics (IJI), 10(1), 1255‑1263.

Nissen, V., & Marekfia, W. (2013). Towards a research agenda for strategic governance, risk and compliance (GRC) management. 2013 IEEE 15th Conference on Business Informatics, 1‑6.

Noor, T. H., Sheng, Q. Z., Maamar, Z., & Zeadally, S. (2016). Managing Trust in the Cloud : State of the Art and Research Challenges. Computer, 49(2). https://doi.org/10.1109/MC.2016.57

Pereira, R., & da Silva, M. M. (2013). IT Compliance Management Process Modeling Based on Best Practices Reference Models and Qualitative Data. 2013 17th IEEE International Enterprise Distributed Object Computing Conference Workshops, 178‑187.

Plá, L. F., Shashidhar, N., & Varol, C. (2020). On-premises versus SECaaS security models. 2020 8th International Symposium on Digital Forensics and Security (ISDFS), 1‑6.

Reshmi, T. R. (2021). Information security breaches due to ransomware attacks-a systematic literature review. International Journal of Information Management Data Insights, 1(2), 100013. https://doi.org/10.1016/j.jjimei.2021.100013

Sabillon, R., Serra-Ruiz, J., Cavaller, V., & Cano, J. (2017). A comprehensive cybersecurity audit model to improve cybersecurity assurance : The cybersecurity audit model (CSAM). 2017 International Conference on Information Systems and Computer Science (INCISCOS), 253‑259.

Sackmann, S., Kuehnel, S., & Seyffarth, T. (2018). Using business process compliance approaches for compliance management with regard to digitization : Evidence from a systematic literature review. International Conference on Business Process Management, 409‑425.

Salek, M. S., Khan, S. M., Rahman, M., Deng, H.-W., Islam, M., Khan, Z., Chowdhury, M., & Shue, M. (2022). A Review on Cybersecurity of Cloud Computing for Supporting Connected Vehicle Applications. IEEE Internet of Things Journal, 9(11), 8250‑8268. https://doi.org/10.1109/JIOT.2022.3152477

Shamsaei, A., Amyot, D., & Pourshahid, A. (2011). A systematic review of compliance measurement based on goals and indicators. International Conference on Advanced Information Systems Engineering, 228‑237.

Sillaber, C., Mussmann, A., & Breu, R. (2019). Experience Data and Information Quality Challenges in Governance, Risk, and Compliance Management. Journal of Data and Information Quality (JDIQ), 11(2), 1‑14. https://doi.org/10.1145/3297721

Stroup, J. W. (2014). The current mind-set of federal information security decision-makers on the value of governance : An informative study.

von Solms, S. H. (Basie). (2005). Information Security Governance—Compliance management vs operational management. Computers & Security, 24(6), 443‑447. https://doi.org/10.1016/j.cose.2005.07.003

Wollersheim, J., & Krcmar, H. (2014). Quality analysis approaches for cloud services-towards a framework along the customer’s activity cycle. Trusted Cloud Computing, 109‑124.

Yang, Y. (2018). Literature review of information security practice survey reports.

Yimam, D., & Fernandez, E. B. (2016). A survey of compliance issues in cloud computing. Journal of Internet Services and Applications, 7(1), 1‑12. https://doi.org/10.1186/s13174-016-0046-8

Yip, F., Ray, P., & Paramesh, N. (2006). Enforcing business rules and information security policies through compliance audits. 2006, 81‑90. Scopus. https://www.scopus.com/inward/record.uri?eid=2-s2.0-33847152561&partnerID=40&md5=0c52f181e1f0c2715a294162858de3b5

Zandesh, Z., Ghazisaeedi, M., Devarakonda, M. V., & Haghighi, M. S. (2019). Legal framework for health cloud : A systematic review. International journal of medical informatics, 132, 103953.

---

[1] N. Racz, E. Weippl, A. Seufert, A Frame of Reference for Research of Integrated Governance, Risk and Compliance (GRC), in: B.D. Decker, I. Schaumüller-Bichl (Eds.), Communications and Multimedia Security, Springer Berlin Heidelberg, 2010: pp. 106–117. cited in (Mayer & De Smet, 2017)