DRCRM: A Dynamic Framework for Regulatory and Certification Readiness for Cyber-Resilient Systems
Year: 2026
Type: conference-paper
Abstract: Cybersecurity certification and regulatory compliance are still managed in many organizations as periodic, document-heavy exercises centered on audits and less on continuous operational readiness. At the same time, sectors affected by standards and regulations such as ISO/IEC 27001, NIS2, and DORA increasingly need sustained evidence of cybersecurity posture, while external stakeholders such as auditors and cyber insurers require more reliable and timely signals than static questionnaires can provide. This paper presents the Dynamic Regulation and Certification Readiness Model (DRCRM), a lifecycle-oriented framework for managing readiness as an ongoing process. DRCRM combines machine-readable checklists, organization-specific readiness instances, manual and automated evidence handling, controlled stakeholder visibility, and a community-based contribution mechanism for sharing implementation practices. The model is operationalized within the ERMIS platform a marketplace for cyberassurance and -insurance developed in the context of an EU-funded project, which enables checklist discovery, evidence integration, dashboards, and access control. We position DRCRM relative to work on continuous monitoring, compliance automation, and cyber risk transparency, and we discuss representative use cases in regulated and critical environments.
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: hybrid
OpenAlex ID: W7225614902