Abstract

A system is proposed herein for real-time compliance management using artificial intelligence (AI)-assisted agents, an orchestration layer, and the Open Security Controls Assessment Language (OSCAL). The system collects evidence from disparate sources, evaluates implementation of security controls in response to software-lifecycle events, threat intelligence, risk-posture changes, and regulatory updates, and generates remediation tasks and standardized outputs. A dynamic skill-synthesis process combines an immutable control standard with application-specific context while keeping those inputs segregated, so the audit criteria remain fixed and the execution directions adapt to heterogeneous environments. Verified results are recorded as reusable, version-controlled OSCAL-based tokens in an append-only ledger, creating traceable evidence that can be re-evaluated as systems or requirements change. The architecture can operate without AI, while AI reduces repetitive evidence collection and auditing. The system can also reduce model-processing token use by deterministically reusing retained evidence and screening controls with lower-cost classifiers before invoking a deeper control agent.

Creative Commons License

Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.

Download

Share

COinS