[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-84100-en":3,"doc-seo-84100-105":30,"detail-sidebar-cat-0-en-105":92},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":21,"is_downloadable":21,"audit_status":21,"page_count":22,"language":23,"language_code":24,"site_id":25,"html_lang":24,"table_of_contents":26,"faqs":27,"seo_title":13,"seo_description":14,"update_tm":28,"read_time":29},84100,1099514067438,"River Wang","https://ap-avatar.wpscdn.com/avatar/100002539ee87300030?x-image-process=image/resize,m_fixed,w_180,h_180&k=1780474512215547542",8,"Research & Report","Automated Compliance Mapping in Cloud Security with Domain-Adapted Sentence Transformers","Cloud security control-to-technical-metric mapping remains a manual, slow, and error-prone process. This work automates the task by applying domain adaptation to Transformer-based sentence embedding models. A corpus of 3,499 control/metric semantic pairs is built from European security standards and EMERALD metrics, then expanded via back-translation and LLM paraphrasing to 13,996 samples across four scenarios. Five architectures are fine-tuned and evaluated on control-to-metric and cross-standard control association tasks, outperforming zero-shot baselines.","Available [online at www.sciencedirect.com](online at www.sciencedirect.com)  \nProcedia Computer Science 00 (2026) 000–000  \n[www.elsevier.com](www.elsevier.com/locate/procedia)[/](www.elsevier.com/locate/procedia)[locate](www.elsevier.com/locate/procedia)[/](www.elsevier.com/locate/procedia)[procedia](www.elsevier.com/locate/procedia)  \n30th International Conference on Knowledge-Based and Intelligent Information & Engineering  \nSystems (KES 2026)  \nAutomated Compliance Mapping in Cloud Security with Domain-Adapted Sentence Transformers  \nJohn Bianchib,a,1 , Luca Petrilloa,b,1 , Fabio Martinellic , Marinella Petrocchia,b  \na Institute for Informatics and Telematics (IIT-CNR), Pisa, Italy  \nbIMT School for Advanced Studies Lucca, Lucca, Italy  \nc Institute for High Performance Computing and Networking (ICAR-CNR), Rende (CS), Italy  \nAbstract  \n2026  \ncloud security controls to technical metrics is currently a manual process. This paper proposes domain adaptation of Transformer models to automate it. We build a training corpus of 3,499 semantic pairs from five European security and a set of technical metrics, then expand it via back-translation and LLM-based paraphrasing to up to 13,996 samples  \nacross four scenarios. We fine-tune five architectures and evaluate their performance on two independent tasks: control-to-metric and cross-standard controls association. All fine-tuned models outperform their zero-shot baselines. On the control-to-metric task, the best model gains up to 23 nDCG@10 points, while on the cross-standard control task, multi-qa-mpnet-dot-v1 under backtranslation reaches 0.870 nDCG@10 . The results show that in-domain training data is a primary driver of performance for the considered case studies.  \n© 2026 The Authors. Published by Elsevier B.V.  \nThis is an open access article under the CC BY-NC-ND license ([http:](http://creativecommons.org/licenses/by-nc-nd/4.0/)[//](http://creativecommons.org/licenses/by-nc-nd/4.0/)[creativecommons.org](http://creativecommons.org/licenses/by-nc-nd/4.0/)[/](http://creativecommons.org/licenses/by-nc-nd/4.0/)[licenses](http://creativecommons.org/licenses/by-nc-nd/4.0/)[/](http://creativecommons.org/licenses/by-nc-nd/4.0/)[by-nc-nd](http://creativecommons.org/licenses/by-nc-nd/4.0/)[/](http://creativecommons.org/licenses/by-nc-nd/4.0/)[4.0](http://creativecommons.org/licenses/by-nc-nd/4.0/)[/](http://creativecommons.org/licenses/by-nc-nd/4.0/))  \nPeer-review under responsibility of the scientific committee of the KES International.  \nKeywords: Cloud Security; EUCS; Automatic Regulatory Compliance; Sentence Transformers; NLP; Fine-Tuning; Data Augmentation  \n1. Introduction  \nCloud Service Providers (CSPs) in Europe operate within a shifting regulatory environment. The European Cybersecurity Certification Scheme for Cloud Services (EUCS) [12] aims to replace fragmented national standards with a unified framework. While this unification strengthens security, it imposes a heavy compliance burden on providers. To obtain certification, CSPs must demonstrate that their technical operations satisfy high-level legal mandates. This process relies on technical evidence, which we call Metrics. Metrics support the evaluation of abstract normative texts, which we call Controls.  \nCurrently, experts carry out the mapping between controls and metrics manually. This process is slow, costly and error-prone. The continuous evolution of standards (e.g., the transition from BSI C5 to EUCS [13]) means organi-  \narXiv :2607 .06364v1 [ cs .CL] 7  \n1 These authors contributed equally to this work.  \n1877-0509 © 2026 The Authors. Published by Elsevier B.V.  \nThis is an open access article under the CC BY-NC-ND license ([http:](http://creativecommons.org/licenses/by-nc-nd/4.0/)[//](http://creativecommons.org/licenses/by-nc-nd/4.0/)[creativecommons.org](http://creativecommons.org/licenses/by-nc-nd/4.0/)[/](http://creativecommons.org/licenses/by-nc-nd/4.0/)[licenses](http://creativecommons.org/licenses","cbCaicPdRY1AEW8P","https://ap.wps.com/l/cbCaicPdRY1AEW8P","pdf",202904,5,1,10,"English","en",105,"# Introduction\n## Cloud compliance problem\n## EUCS and metrics/controls concepts\n## Existing automation gaps\n# Method\n## Domain-adapted Transformer fine-tuning\n## Training corpus construction and augmentation\n## Model architectures and training scenarios\n# Experiments and Results\n## Control-to-metric evaluation\n## Cross-standard control association evaluation\n# Conclusions and Contributions\n## Main contributions of the work","[{\"question\":\"What problem does the paper address in cloud security compliance mapping?\",\"answer\":\"It targets the manual mapping from cloud security controls to technical metrics, which is slow, costly, and error-prone, and becomes a scalability bottleneck as standards evolve.\"},{\"question\":\"How is domain adaptation applied to automate compliance mapping?\",\"answer\":\"The approach fine-tunes Transformer-based sentence embedding models using a domain-specific training corpus and then evaluates them against tasks such as control-to-metric matching and cross-standard control association.\"},{\"question\":\"How is the training data expanded beyond the initial corpus?\",\"answer\":\"The study builds an initial dataset of 3,499 semantic pairs and increases it to 13,996 samples using back-translation and LLM-based paraphrasing, covering multiple scenarios.\"}]",1784192794,25,{"code":4,"msg":31,"data":32},"ok",{"site_id":25,"language":24,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":87,"head_meta":89,"extra_data":91,"updated_unix":28},"automated-compliance-mapping-in-cloud-security-with-domain-adapted-sentence-transformers","",{"@graph":36,"@context":86},[37,54,69],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":21},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/automated-compliance-mapping-in-cloud-security-with-domain-adapted-sentence-transformers/84100/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":24,"description":14,"dateModified":62,"datePublished":63,"encodingFormat":61,"isAccessibleForFree":64,"interactionStatistic":65},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-07-27","2026-07-16",true,{"@type":66,"interactionType":67,"userInteractionCount":20},"InteractionCounter",{"@type":68},"ViewAction",{"@type":70,"mainEntity":71},"FAQPage",[72,78,82],{"name":73,"@type":74,"acceptedAnswer":75},"What problem does the paper address in cloud security compliance mapping?","Question",{"text":76,"@type":77},"It targets the manual mapping from cloud security controls to technical metrics, which is slow, costly, and error-prone, and becomes a scalability bottleneck as standards evolve.","Answer",{"name":79,"@type":74,"acceptedAnswer":80},"How is domain adaptation applied to automate compliance mapping?",{"text":81,"@type":77},"The approach fine-tunes Transformer-based sentence embedding models using a domain-specific training corpus and then evaluates them against tasks such as control-to-metric matching and cross-standard control association.",{"name":83,"@type":74,"acceptedAnswer":84},"How is the training data expanded beyond the initial corpus?",{"text":85,"@type":77},"The study builds an initial dataset of 3,499 semantic pairs and increases it to 13,996 samples using back-translation and LLM-based paraphrasing, covering multiple scenarios.","https://schema.org",{"og:url":52,"og:type":88,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":90,"canonical":52},"index,follow",{"doc_id":7,"site_id":25},{"code":4,"msg":5,"data":93},[94,98,102,106,110,115,120,123,128,131,134],{"id":21,"doc_module":4,"doc_module_name":46,"category_name":95,"show_sort_weight":96,"slug":97},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":99,"show_sort_weight":100,"slug":101},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":103,"show_sort_weight":104,"slug":105},"Exam",70,"exam",{"id":20,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":22,"doc_module":4,"doc_module_name":46,"category_name":132,"show_sort_weight":22,"slug":133},"Lifestyle","lifestyle",{"id":135,"doc_module":4,"doc_module_name":46,"category_name":136,"show_sort_weight":20,"slug":137},19,"General","general"]