Using Large Language Models to Generate Security Policies: Quality, Compliance, and Expert Evaluation

What Did This Cybersecurity Research Find?

This cybersecurity GRC study tested whether LLMs could generate security policies (access control, incident response, acceptable use) that met compliance requirements. Cybersecurity policy drafts generated by GPT-4 class models covered 79% of required control areas for SOC 2 and ISO 27001, but expert reviewers identified critical omissions in 34% of generated policies, primarily around jurisdiction-specific requirements and industry-specific regulations.

Key Findings

• 1LLM-generated policies covered 79% of SOC 2 and ISO 27001 required control areas
• 2Expert reviewers found critical omissions in 34% of generated policies
• 3Jurisdiction-specific requirements were the most commonly missed area
• 4AI-assisted policy drafting reduced total authoring time by 55% when expert-reviewed
• 5Iterative prompting (providing framework checklists) improved coverage to 89%

How Does This Apply to Cybersecurity Careers?

GRC professionals can use AI as a starting point for policy development while understanding its limitations. Security policy writers can focus their expertise on the areas where AI falls short.

Who Should Read This?

Frequently Asked Questions