A Risk-Weighted Framework for Integrating Technical Vulnerability Intelligence into Information Security Compliance Audits

This paper presented VACAF, a framework for integrating technical vulnerability intelligence into compliance audits through a control-to-vulnerability mapping model and a Risk-Weighted Compliance Score, embedded within the standard audit lifecycle. Demonstrated on an illustrative case study, RWCS-based prioritization redirected attention toward control areas where documentation weaknesses and severe technical exposure coincide, correcting a blind spot in both compliance-only and CVSS-only prioritization. The results reported here are illustrative rather than empirical; future work includes validating VACAF against real, anonymized, multi-cycle audit data, extending the mapping table to full coverage of ISO/IEC 27001 Annex A and to other frameworks (NIST CSF, PCI DSS, SOC 2), and exploring semi-automated mapping using vulnerability-scanner taxonomies and cautious LLM-assisted classification.

[1] ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security management systems — Requirements, ISO, Geneva, 2022. [2]   National Institute of Standards and Technology, “The NIST Cybersecurity Framework (CSF) 2.0,” NIST CSWP 29, Feb. 2024. [3] National Institute of Standards and Technology, “Security and Privacy Controls for Information Systems and Organizations,” NIST SP 800-53, Rev. 5, 2020. [4] PCI Security Standards Council, “Payment Card Industry Data Security Standard, Version 4.0,” 2022. [5] AICPA, “2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (SOC 2),” revised 2022. [6] Verizon, “2024 Data Breach Investigations Report,” Verizon Business, 2024. [7] IBM Security, “Cost of a Data Breach Report 2024,” IBM Corporation, 2024. [8] D. McQuade, “Leveraging Large Language Models for Security-Focused Code Reviews,” SANS Technology Institute Graduate Student Research, 2025. [9] R. Wehe, “Out-of-Band Defense: Securing VPNs from Password-Spray Attacks with Cloud Automation,” SANS Technology Institute Graduate Student Research, 2025. [10] J. Mull, “From Crash to Compromise: Unlocking the Potential of Windows Crash Dumps in Offensive Security,” SANS Technology Institute Graduate Student Research, 2025.