Automated Compliance Mapping in Cloud Security with Domain-Adapted Sentence Transformers

# Automated Compliance Mapping in Cloud Security with Domain-Adapted Sentence Transformers
Source: [https://arxiv.org/html/2607.06364](https://arxiv.org/html/2607.06364)
Luca Petrillo222These authors contributed equally to this work\.Fabio MartinelliMarinella PetrocchiInstitute for Informatics and Telematics \(IIT\-CNR\), Pisa, ItalyIMT School for Advanced Studies Lucca, Lucca, ItalyInstitute for High Performance Computing and Networking \(ICAR\-CNR\), Rende \(CS\), Italy

###### Abstract

Mapping cloud security controls to technical metrics is currently a manual process\. This paper proposes domain adaptation of Sentence Transformer models to automate it\. We build a training corpus of 3,499 semantic pairs from five European security standards and a set of technical metrics, then expand it via back\-translation and LLM\-based paraphrasing to up to 13,996 samples across four scenarios\. We fine\-tune five architectures and evaluate their performance on two independent tasks: control\-to\-metric and cross\-standard controls association\. All fine\-tuned models outperform their zero\-shot baselines\. On the control\-to\-metric task, the best model gains up to 23 nDCG@10 points, while on the cross\-standard control task,multi\-qa\-mpnet\-dot\-v1under back\-translation reaches 0\.870 nDCG@10\. The results show that in\-domain training data is a primary driver of performance for the considered case studies\.

###### keywords:

Cloud Security; EUCS; Automatic Regulatory Compliance; Sentence Transformers; NLP; Fine\-Tuning; Data Augmentation

## 1Introduction

Cloud Service Providers \(CSPs\) in Europe operate within a shifting regulatory environment\. The European Cybersecurity Certification Scheme for Cloud Services \(EUCS\)\[ENISA2020\]aims to replace fragmented national standards with a unified framework\. While this unification strengthens security, it imposes a heavy compliance burden on providers\. To obtain certification, CSPs must demonstrate that their technical operations satisfy high\-level legal mandates\. This process relies on technical evidence, which we callMetrics\. Metrics support the evaluation of abstract normative texts, which we callControls\.

Currently, experts carry out the mapping between controls and metrics manually\. This process is slow, costly and error\-prone\. The continuous evolution of standards \(e\.g\., the transition from BSI C5 to EUCS\[BSIc5\]\) means organizations have to redo these mappings repeatedly, creating a scalability bottleneck\. Existing approaches to compliance automation leave a clear gap\. The efforts mainly focus on structured formats, while cross\-standard mapping and compliance reasoning still rely heavily on manual modeling and rule\-based approaches, often requiring handcrafted ontologies or metamodels that are brittle to control rephrasing\[castellanos2022compliance\]\. At the same time, semantic similarity models based on Sentence Transformers perform well on general text, yet they are not specifically trained on cloud\-security language, nor systematically evaluated for both control\-to\-metric and control\-to\-control matching\.

In our previous work\[emerald1,emerald2\], we explored the use of pre\-trained Sentence Transformers \(SBERT\) to match controls to metrics\. That study relied on generic models with no prior knowledge of cloud security terminology\. Although the results showed promise \(n​D​C​G10=0\.640nDCG\_\{10\}=0\.640\), performance remained limited, likely due to the absence of domain\-specific knowledge\. This paper addresses this gap through domain adaptation via fine\-tuning, using a data\-centric approach for cloud\-compliance matching\. In particular, the main contributions of this work are:

- 1\.We introduce a domain\-specific training corpus for cloud compliance, built by integrating heterogeneous standards \(BSI C5, ENS, SecNumCloud, EUCS\) through a common reference framework \(Cisco CCF\) and associating them with metrics developed within the EMERALD EU project\[emeraldProject\]\.
- 2\.We fine\-tune Sentence Transformer models on this corpus to support both control\-to\-metric and control\-to\-control matching tasks in cloud\-security compliance\.
- 3\.We investigate the impact of data augmentation strategies, including back\-translation and LLM\-based paraphrasing, across four training scenarios\.
- 4\.We show that domain\-adapted models perform better than generic baselines, demonstrating the importance of domain\-specific knowledge for automated compliance mapping\.

## 2Related Work

The use of NLP for regulatory compliance has been explored in several settings\. Chalkidis et al\.\[chalkidis2021regulatory\]treated cross\-legislation alignment as a document retrieval problem over EU and UK statutes, showing that in\-domain fine\-tuning improves retrieval over lexical baselines when surface\-level text similarity is weak\. The work in\[ciaramella2025leveraging\]leveraged pre\-trained transformer models to determine whether a privacy policy complies with the single duty specified in Article 13\(2\)\(b\) of the GDPR, i\.e\., whether it informs data subjects of their right to rectification or erasure of personal data\. Amaral et al\.\[cejas2023nlp\]applied NLP to check data processing agreements against GDPR requirements automatically, targeting the semantic gap between legal mandates and operational artifacts\. Carello et al\.\[carello2024study\]mapped cybersecurity controls to vulnerability catalogs using semi\-automated NLP techniques, confirming that vocabulary mismatch between normative and technical text remains an open problem in the security domain\. In\[agarwal2021ai\], Agarwal et al\. map regulatory controls to NIST 800\-53 using fine\-tuned Transformers \(best: hierarchical classification, Recall@K on 1,580→826 mappings\)\. In\[ahmed2024prompting\], Ahmed et al\. translate Center for Internet Security \(CIS\) Critical Security Controls into measures/metrics via few\-shot LLM prompting, evaluated by LLM\-as\-judge correlation\. Unlike both, we target EU schemes \(EUCS, BSI C5, ENS, SecNumCloud\) and jointly address control\-to\-control and control\-to\-metric retrieval with domain\-adapted sentence transformers\.

In our previous work\[emerald1,emerald2\], we evaluated pre\-trained sentence transformers for the association of cloud security controls with metrics in a zero\-shot setting\. We found that generic models performed modestly without domain knowledge\. Building on this research, this study creates a labeled training corpus from various European standards and uses back\-translation and LLM\-based paraphrasing as augmentation strategies\. It also examines the impact of fine\-tuning across four training configurations\.

## 3Data Sources

We compile our knowledge base from six sources\. These sources cover three dimensions: structural association via a central hub, technical specificity via metric catalogues and linguistic variety via national standards\. Two additional datasets, the MEDINA metric catalogue and the EUCS\-Legacy control snapshot, are reserved exclusively for evaluation purposes and are described in Section[5\.3](https://arxiv.org/html/2607.06364#S5.SS3)\.

##### Cisco Cloud Controls Framework

The CISCO Cloud Controls Framework \(CCF\) v2\.0\[ciscoCCF\]is a publicly available framework that aggregates international and national security compliance and certification requirements, including ISO 27001333ISO/IEC 27001 – Information security management systems standard:[https://www\.iso\.org/standard/27001](https://www.iso.org/standard/27001)and SOC 2444Service Organization Control 2 – Trust services criteria for security, availability, and confidentiality:[https://www\.aicpa\-cima\.com/topic/audit\-assurance/audit\-and\-assurance\-greater\-than\-soc\-2](https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2), into a single unified resource\. It provides a structured approach to managing cloud security controls and monitoring their effectiveness in cloud infrastructure deployments\. The CCF encompasses multiple control domains, including identity and access management, data protection, incident response, and vulnerability management\. Each domain contains specific controls that organizations can implement based on their risk profile and regulatory requirements\.

##### Cloud Computing Compliance Criteria Catalogue

The Cloud Computing Compliance Criteria Catalogue \(BSI C5\)\[BSIc5\], developed by the German Federal Office for Information Security, is a set of security and compliance criteria specifically designed for evaluating cloud service providers\. This catalogue aims to establish minimum security standards and requirements that cloud providers must adhere to, ensuring the protection of sensitive data and critical infrastructure in cloud environments\. It specifically encompasses thirteen primary control areas, including information security management, identity and access management, cryptography and key management, where each domain contains detailed criteria and requirements that cloud service providers must satisfy to achieve certification\. In the context of this work, it serves as a structural bridge in our knowledge base as it is the only source with native mappings both to the CCF and to the EMERALD operational metrics, which connects normative requirements to technical evidence\.

##### Esquema Nacional de Seguridad

The Esquema Nacional de Seguridad \(ENS\)\[spanishENS\]is a Spanish regulatory framework that establishes principles and requirements for the security of information handled by the Spanish public sector entities, aiming to ensure the protection of information systems and data\. It is built on the CIA triad \(confidentiality, integrity, and availability\) and mandates a risk\-based approach, requiring organizations to conduct security assessments to implement proportionate security controls\.

##### SecNumCloud

SecNumCloud \(v3\.2\)\[secnumcloud\]is a French national cloud security qualification framework established by the French National Cybersecurity Agency \(ANSSI\)555https://cyber\.gouv\.fr\. It defines stringent security, compliance, and data sovereignty requirements for cloud service providers handling sensitive data, particularly for public sector and critical use cases\. The framework applies to providers offering services under European jurisdiction, ensuring protection against extra\-territorial laws and strong guarantees of data sovereignty, often involving infrastructure located within France or the EU\.

##### EUCS Candidate Scheme

The European Cybersecurity Certification Scheme for Cloud Services \(EUCS\) \(draft version v2020\[ENISA2020\]\) is a framework proposed to standardize cybersecurity certifications across the European Union in order to harmonize national certification schemes, security, and governance standards for cloud service providers\.

##### Repository of Controls and Metrics

The Horizon Europe EMERALD Project\[emeraldProject\]is developing an evidence management platform for continuous certification\-as\-a\-service in the cloud\. This includes a repository of controls and metrics for assessing compliance with schemes such as those listed in previous subsections\. The security metrics cover various areas, including transport encryption, TLS\-related metrics, password metrics and antimalware scan frequency\.

## 4Problem Definition

We formalize the association between controls from different standards, as well as between controls and metrics, as an open\-domain information retrieval problem\. Keyword search is insufficient here because the vocabulary and abstraction level of controls and metrics, as well as controls from different standards, differ\. A technical metric such as“OPS\-05\.3H: Antimalware enabled”and a normative control such as“The CSP shall deploy malware detection mechanisms on all compute nodes”express the same requirement in very different terms\. Let𝒬\\mathcal\{Q\}be a set of queries and𝒟\\mathcal\{D\}be a set of documents\. Our system takes a control as input, thus a queryq∈𝒬q\\in\\mathcal\{Q\}is always a control\. Conversely, a list of documentsd∈𝒟d\\in\\mathcal\{D\}represents the target artifacts to be retrieved, which can be either controls from a target scheme \(e\.g\., EUCS\) or technical metrics\.

The goal is to learn a similarity functionf​\(q,d\)→ℝf\(q,d\)\\rightarrow\\mathbb\{R\}\(whereℝ\\mathbb\{R\}is the set of real numbers representing the similarity score\) that is used to score a set of candidate documents\. Given a queryqq, the system appliesffto produce a ranked list of documentsd∈𝒟d\\in\\mathcal\{D\}ordered by decreasing similarity scores, such that the documents semantically satisfyingqqappear at the top of the ranking\.

We parameterizeffusing a bi\-encoder based on Sentence Transformers, which mapsqqandddindependently into a shared vector space:

f​\(q,d\)=cos⁡\(𝐮,𝐯\)=𝐮⋅𝐯‖𝐮‖​‖𝐯‖f\(q,d\)=\\cos\(\\mathbf\{u\},\\mathbf\{v\}\)=\\frac\{\\mathbf\{u\}\\cdot\\mathbf\{v\}\}\{\\\|\\mathbf\{u\}\\\|\\\|\\mathbf\{v\}\\\|\}\(1\)
where𝐮\\mathbf\{u\}and𝐯\\mathbf\{v\}represent the embeddings extracted fromqqanddd, respectively\.

The model evaluates a pair of texts\(q,d\)\(q,d\)in input and outputs a scalar similarity score, without having a built\-in notion of whether the text represents a metric or a control\. While the system’s final output is a ranked list, the underlying function operates on pairs, learning that some pairs are semantically related and others are not\. A single formulation allows control\-to\-control and control\-to\-metric pairs to contribute to the same learning objective, resulting in a larger, more uniform training corpus\. It also eliminates the need to maintain separate models for each task, reducing engineering complexity and making the system easier to extend to new standards\. Thus, this formulation covers two tasks\. InControl\-to\-Control Association, the query is a control from one framework and the goal is to retrieve semantically equivalent controls from another \(e\.g\., a control in CCF to a control in EUCS\)\. InControl\-to\-Metric Association, the query is a control, and the goal is to retrieve the metrics that declines that control in a technical way\.

## 5Methodology

Pre\-trained generic models can underperform on specialized regulatory texts\[emerald1,emerald2\]\. To address this issue, we have adopted a three\-stage domain adaptation pipeline\. First, we construct a corpus of semantic pairs from our knowledge base\. Second, we expand this corpus through data augmentation\. We then fine\-tune the encoder using a contrastive learning objective\[gao2021simcse\]\. Given a queryqq, letd\+d^\{\+\}denote a relevant \(positive\) document andd−d^\{\-\}an irrelevant \(negative\) one\. The objective encourages representations of\(q,d\+\)\(q,d^\{\+\}\)to be close in the embedding space, while pushing\(q,d−\)\(q,d^\{\-\}\)farther apart\.

### 5\.1Training Corpus Construction

We construct a labeled dataset of anchor–target pairs, where each pair links a control from one framework to a semantically equivalent control \(or metric\) from another\. The dataset is assembled from publicly documented frameworks, as described in Section 3, using two different strategies\.

#### 5\.1\.1Semantic Pair Extraction

##### Strategy I: Control\-to\-Control Association via Cisco CCF

As described in Section[3](https://arxiv.org/html/2607.06364#S3.SS0.SSS0.Px1), the Cisco CCF serves as a central hub for various international and national security compliance requirements and has also been designed to provide cross\-framework mapping\. In particular, ENS, BSI C5, and SecNumCloud have mappings to CCF, so we can use it to derive mappings between the three schemes as well\.

Since both ENS and SecNumCloud are distributed as unstructured PDFs in their source languages \(Spanish and French\), we usepdfplumber666[https://github\.com/jsvine/pdfplumber](https://github.com/jsvine/pdfplumber)to extract the text from these documents, and we subsequently translate them into English using the DeepL API777[https://www\.deepl\.com/pro\-api](https://www.deepl.com/pro-api)\.

As the Cisco CCF dataset contains columns that indicate which ENS controls correspond to each CCF control, we extract the referenced ENS codes and match them against a lookup table that was created using the ENS dataset\. This results in 318 pairs linking ENS controls to CCF controls\. We apply the same procedure to SecNumCloud, obtaining an additional 563 pairs\. We then map the CCF dataset directly to BSI C5 pairs, resulting in an additional 555 pairs\. Similarly, for the mapping between CCF and EUCS\-2020 \(the 2020 draft candidate scheme\[ENISA2020\]\)888We would like to highlight that EUCS\-2020 differs from the EUCS\-Legacy version used in evaluation, see Section[5\.3](https://arxiv.org/html/2607.06364#S5.SS3)\., we extract the mappings directly from the Cisco CCF dataset, producing 1,270 pairs\. Finally, we create a further 564 direct EUCS\-2020\-to\-BSI\-C5 mappings\.

##### Strategy II: Control\-to\-Metric Association via Semantic Bridge

The EMERALD partners are working on constructing a catalogue of metrics to create pairs connecting the metrics to controls\. As the EMERALD catalogue contains references to BSI C5 controls, we can match the metrics directly against the BSI C5 lookup table to yield 27 pairs\. The catalogue does not provide a direct mapping to the EUCS, but we have the mapping between the EUCS and C5 controls, so we can also determine the associations between the catalogue’s metrics and EUCS \(202 new semantic pairs\)\.

The semantic pairs generated through Strategies I and II form a dataset of 3,499 pairs\. This collection forms the base training corpus \(Scenario I\) prior to any data augmentation\.

#### 5\.1\.2Data Augmentation

We apply two augmentation strategies\. The back\-translation strategy adds 3,499 samples, while the LLM\-based paraphrasing, using two models, adds 6,998 samples\. This results in three additional scenarios:

- 1\.Scenario II— Original \+ Back\-Translation: 6,998 samples
- 2\.Scenario III— Original \+ Paraphrase: 10,497 samples
- 3\.Scenario IV— Original \+ Back\-Translation \+ Paraphrase: 13,996 samples

##### Back\-Translation

We translate each text into a randomly selected intermediate language using the Google Translate API, then translate it back to English\. This introduces lexical and syntactic variation while preserving meaning\.

##### LLM\-Based Paraphrasing

We use two instruction\-tuned models to paraphrase each text:

- 1\.
- 2\.

Both models run in 4\-bit quantization \(NF4\) viaBitsAndBytesConfig\. Each model receives a prompt instructing it to rephrase the input while preserving: \(i\) the technical meaning, \(ii\) domain\-specific terminology \(e\.g\.,least\-privilege,two\-factor authentication\), and \(iii\) the logical structure of the original text\. The outputs of both models are pooled into a single paraphrase set, contributing 6,998 samples in Scenarios III and IV\.

The proportion of pairs from each source\-target mapping remains consistent throughout the augmentation process, ensuring that no mapping type is over\-represented in the final augmented corpus\.

Table 1:Composition of the training and test datasets\. The training block lists the number of pairs per mapping topology\. The augmentation block shows the contribution of each strategy and the total sample count per experimental scenario\. Both test sets are held out across all four scenarios\.PhaseTopologyAnchor Source\(AA\)Positive Target\(PP\)Unique\|A\|\|A\|Unique\|P\|\|P\|Pairs\(A,P\)\(A,P\)TrainingHub AssociationCisco CCFSpanish ENS713169318Hub AssociationCisco CCFSecNumCloud713261563Hub AssociationCisco CCFBSI C5:2020713223555Hub AssociationCisco CCFEUCS\-20207135221,270Semantic BridgeBSI C5:2020Emerald\-Metrics275727Semantic BridgeEUCS\-2020 \(via BSI\)Emerald\-Metrics11057202Cross\-Standard \(Filtered\)EUCS\-2020BSI C5:2020489107564Scenario I — Original \(after augmentation\)3,499AugmentationBack\-TranslationGoogle Translate\(all pairs\)\+3,499ParaphrasePhi\-4\-mini\-instruct\(all pairs\)\+3,499ParaphraseLlama\-3\.1\-8B\-Instruct\(all pairs\)\+3,499Scenario II — Original \+ Back\-Translation6,998Scenario III — Original \+ Paraphrase10,497Scenario IV — Original \+ Back\-Translation \+ Paraphrase13,996TestTest Set A\(Control\-to\-Metric\)EUCS\-LegacyMedina\-Metrics70166179Test Set B\(Cross\-Standard\)EUCS\-LegacyBSI C5:202014051140

### 5\.2Dataset Statistics

Table[1](https://arxiv.org/html/2607.06364#S5.T1)shows the full corpus structure\. The CCF hub produces the majority of training pairs by linking its controls to four target standards\. The EMERALD bridge adds a smaller set of pairs that controls to metrics\. Then we have the cross\-standard set that maps EUCS\-2020 to C5:2020\. The seven mapping steps produce 3,499 pairs before augmentation\. Each anchor can be associated with one or more targets \(one\-to\-many relationship\), reflecting that a single normative control may be linked to multiple equivalent controls or technical metrics\. The unique counts for the Cross\-Standard mapping \(Row 7\) are lower than the full EUCS\-2020 and BSI C5:2020 pool sizes because EUCS\-2020 entries overlapping with the test sets were removed by the decontamination filter\. The 564 pairs are generated as follows: each EUCS\-2020 control may reference multiple BSI C5 controls, and each such reference yields one training pair\. Only references that survive the decontamination filter and match a known BSI C5 entry are retained\. For example, a single EUCS control mapped to three BSI C5 controls contributes three distinct pairs to the corpus\.

### 5\.3Test Sets

We evaluate all models on two test sets that are completely independent of any training scenario\.

##### Test Set A — Control\-to\-Metric Association

This set comes from the MEDINA project\[medinaProject\], a Horizon 2020 European project predecessor of Emerald\. The queries comprise 70 unique controls from a specific snapshot of the EUCS 2020 candidate scheme, referred to as EUCS\-Legacy111111EUCS\-Legacy is a subversion of the 2020 candidate scheme adopted during the early stages of the MEDINA project, sharing the same identifier and file structure as the official 2020 release but featuring minor structural and phrasing differences from it\.\. The target corpus consists of 166 unique metrics defined by the MEDINA partners, where each metric is a short identifier\-prefixed technical description \(e\.g\.,“OPS\-05\.3H: Antimalware enabled”\)\. The ground truth, that is, the set of control\-metric pairs, comprises 179 pairs produced by domain experts\.

##### Test Set B — Cross\-Standard Control\-to\-Control Association

The queries are 140 EUCS\-Legacy controls, while the target corpus is 51 BSI C5:2020 controls\. The ground truth comprises 140 pairs derived by mapping EUCS\-Legacy identifiers to the corresponding BSI C5 controls\.

##### Decontamination

We filter the training corpus to remove any EUCS\-2020 controls whose text overlaps with an EUCS\-Legacy entry in either of the test sets\. This filter is applied before augmentation, meaning that no back\-translated or paraphrased variant of a filtered entry will be included in any training scenario\.

### 5\.4Model Selection

We evaluate the same five Sentence Transformer models used in\[emerald1,emerald2\]\. This allows for a direct comparison of zero\-shot and fine\-tuned performance on the same architectures, thus eliminating the confounding factor of model selection\. The five models differ in terms of their architecture, size and pre\-training objective, and they encompass both general\-purpose encoders and retrieval\-oriented variants\. This allows us to determine whether domain adaptation improves performance consistently across encoder families or if its impact is architecture\-specific\.

- 1\.
- 2\.
- 3\.
- 4\.
- 5\.

### 5\.5Baseline

We evaluate each model on both test sets prior to any fine\-tuning, using the models’ original off\-the\-shelf weights\. These performances serve as the baseline that domain\-adapted models must improve upon\. These also replicate the zero\-shot setting of\[emerald1,emerald2\], enabling us to evaluate the benefits of domain adaptation in relation to the previous study\.

### 5\.6Training Strategy

We fine\-tune each of the five models across the four training scenarios, yielding 20 fine\-tuned models in total\. The training objective is Multiple Negatives Ranking Loss \(MNRL\)\[gao2021simcse\]\. For each positive pair in a batch, all other positive pairs in the same batch act as implicit negatives\. The model learns to score the correct pair higher than all others without requiring manually labeled negative examples\. All runs use a batch size of 64, 3 training epochs, a learning rate of2×10−52\\times 10^\{\-5\}, and a linear warmup over the first 10% of training steps\.

### 5\.7Evaluation Protocol

At inference time, the model operates in two directions\. For Test Set A, controls are the queries and metrics are the candidate pool\. For Test Set B, controls from one framework are the queries and controls from another framework are the candidate pool\. In both cases, the model computes cosine similarity against every candidate and returns a ranked list\. The model has no notion of whether a candidate is a metric or a control\. It scores all text pairs with the same function\. This retrieval direction matches the setting in\[emerald1,emerald2\]and reflects the operational use case: an auditor starts from a normative control and retrieves the artifacts that satisfy it or similar controls\. We evaluate the ranking quality using nDCG@10\.

##### Normalized Discounted Cumulative Gain \(nDCG@10\)

nDCG@10 measures ranking quality up to rank 10, giving higher importance to relevant items appearing at top positions through logarithmic discounting\.

DCG​@​k=∑i=1kr​e​lilog2⁡\(i\+1\),nDCG​@​k=DCG​@​kIDCG​@​k\\text\{DCG\}@k=\\sum\_\{i=1\}^\{k\}\\frac\{rel\_\{i\}\}\{\\log\_\{2\}\(i\+1\)\},\\qquad\\text\{nDCG\}@k=\\frac\{\\text\{DCG\}@k\}\{\\text\{IDCG\}@k\}
Here,r​e​li∈0,1rel\_\{i\}\\in\{0,1\}denotes the relevance of the item at rankii, and IDCG@kkcorresponds to the maximum possible DCG obtained from an ideal ranking\.

## 6Results

We evaluate all 25 models \(5 architectures×\\times4 training variants, plus 5 baselines\) on both test sets\. The results are reported as nDCG@10 for all queries, as well as for queries with at least one relevant document among the top 10 results\. These results are shown in Table[2](https://arxiv.org/html/2607.06364#S6.T2), where the first two rows are the zero\-shot baselines for each architecture\. Throughout the table, the best performance per architecture is highlighted in bold, while the best result across all models is in bold and underlined\.

Table 2:Performance comparison \(nDCG@10\)\.Boldvalues indicate the best score per architecture, whileunderlined boldindicates the best score across all models\. A = Test Set A \(Control\-to\-Metric Association\); B = Test Set B \(Cross\-Standard Control Association\); DA = Dataset\.all\-mpnet\-base\-v2multi\-qa\-mpnet\-base\-dot\-v1all\-distilroberta\-v1all\-MiniLM\-L12\-v2multi\-qa\-distilbert\-cos\-v1VariantTestAllNon\-AllNon\-AllNon\-AllNon\-AllNon\-SetQueriesZeroQueriesZeroQueriesZeroQueriesZeroQueriesZeroZero\-ShotA0\.4470\.5790\.4940\.6400\.4800\.6110\.5040\.6080\.4560\.591baselineB0\.7170\.8500\.7460\.8640\.7280\.8640\.7190\.8530\.7260\.882DA \(Base\)A0\.6750\.7520\.6820\.7500\.5990\.7050\.6510\.7020\.6690\.726B0\.8120\.9200\.8420\.9540\.8160\.9460\.8160\.9250\.8280\.939DA \+ Back\-TransA0\.6510\.7300\.6450\.7340\.6180\.7180\.6370\.7100\.6500\.710B0\.8230\.9320\.8700\.9650\.7710\.9150\.8270\.9370\.8110\.919DA \+ Paraph\.A0\.5950\.6910\.6330\.7050\.5230\.6430\.5730\.6700\.5820\.695B0\.8170\.9470\.8100\.9180\.6710\.7960\.7640\.8660\.8030\.891DA \+ Full Augm\.A0\.6080\.6960\.6230\.6850\.5280\.6360\.5880\.6730\.5850\.688B0\.8240\.9340\.8410\.9330\.7060\.8370\.7910\.8970\.8310\.921

### 6\.1Test Set A: Control\-to\-Metric Association

Domain adaptation improves performance consistently over the zero\-shot baseline for all models on Test Set A, with the most notable observation being that training on the unaugmented dataset \(DA Base\) yields the best results for four out of five architectures\. The largest absolute gain is achieved by theall\-mpnet\-base\-v2 model, which improves from 0\.447 to 0\.675 \(an increase of 0\.228 nDCG@10 points\) when trained on the Base dataset\. Similarly,multi\-qa\-mpnet\-base\-dot\-v1achieves the highest overall score on this test set with its Base variant, reaching 0\.682 \(an increase of 0\.188 points compared to the baseline\)\. The only exception to this trend isdistilroberta\-v1, which achieves its highest score when the data is augmented with back\-translation, yielding 0\.618 \(an improvement on its baseline score of 0\.480 by 0\.138\)\. For the other models, data augmentation strategies generally resulted in a slight drop in performance on this specific task compared to the Base variant\. After fine\-tuning, the gap between all\-queries and non\-zero performances is much smaller\. To understand why this is the case, we must examine how the two averages work\. Zero\-shot models perform poorly on many queries, scoring exactly zero\. Domain adaptation solves this issue\. It helps the model identify relevant documents for queries that it had previously missed\. This effectively transforms a zero score into a positive one\.

### 6\.2Test Set B: Cross\-Standard Control Alignment

Fine\-tuning also improves all architectures on Test Set B, but the pattern differs from that on Test Set A in two key ways\. Firstly, the absolute gains are smaller, primarily because the zero\-shot baselines for this task were already quite high \(ranging from 0\.717 to 0\.746\)\. Secondly, in contrast to Test Set A, data augmentation is highly beneficial here\.multi\-qa\-mpnet\-base\-dot\-v1, trained on the back\-translation dataset, achieves the highest absolute score of all models and test sets, with remarkable results of 0\.870 for all queries \(\+0\.124 over its baseline\) and 0\.965 for non\-zero queries \(\+0\.101\)\. Back\-translation is also the optimal strategy forMiniLM\-L12\-v2, achieving a score of 0\.827\. Conversely,all\-mpnet\-base\-v2anddistilbert\-cos\-v1achieve their best Test Set B scores overall using the fully augmented dataset\.distilroberta\-v1continues to exhibit distinct behavior, achieving its peak performance on Test Set B using the unaugmented Base dataset \(0\.816\)\.

### 6\.3The Effect of Augmentation Strategies

The results show that the effectiveness of data augmentation depends on the nature of the evaluation task\. For the control\-to\-metric association evaluated on Test Set A, the objective is to associate technical metrics with verbose legal mandates, and it appears that augmentation introduces noise\. Simple semantic pairs from the base scenario provide the clearest signal and result in the best performance across nearly all architectures\.

Cross\-standard control association, evaluated on Test Set B, involves matching legal mandates formulated by different regulatory bodies with distinct lexicons, and augmentation becomes valuable\. Specifically, Back\-Translation emerges as a highly robust strategy, propellingmulti\-qa\-mpnet\-base\-dot\-v1andMiniLM\-L12\-v2to their peak performance\. The lexical variety introduced by intermediate translation probably helps the models generalize across the different phrasings typical of various security frameworks\. The Full Augmentation scenario also performs well here, showing that exposing the models to a broader vocabulary during training improves their performance on cross\-standard association tasks\.

## 7Conclusions

This paper addresses the problem of automating compliance mapping between cloud security frameworks using fine\-tuned Sentence Transformers\. We construct a training corpus of 3,499 semantic pairs by aggregating seven heterogeneous standards around the Cisco CCF as a hub, and expand it via back\-translation and LLM\-based paraphrasing, yielding up to 13,996 training samples across four scenarios\.

All fine\-tuned models outperform their zero\-shot baselines on both test sets\.

For the control\-to\-metric association task, domain adaptation leads to improvements of up to 0\.228 nDCG@10 over the baseline\. These results extend our previous work\[emerald1,emerald2\]and support the role of domain\-specific paired data as a key driver of performance gains\.

For the control\-to\-control association task, the best\-performing model \(multi\-qa\-mpnet\-base\-dot\-v1trained with back\-translation\) achieves 0\.870 nDCG@10 across all queries and 0\.965 when considering only queries with at least one relevant match\. This suggests that the model is able to align framework pairs not observed during training\.

The results also highlight differentiated effects of data augmentation\. While the unaugmented base dataset performs best for linking technical metrics to controls, augmentation strategies, particularly back\-translation, are important for achieving stronger results in cross\-standard mapping\. Thedistilroberta\-v1model shows a distinct pattern, benefiting from back\-translation on Test Set A but performing better with the unaugmented dataset on Test Set B\.

In the future, we will incorporate systematic quality control into the augmentation pipeline\. Rather than relying solely on manual spot\-checks, we will use explainability methods, such as Integrated Gradients, to compare token\-level attributions between the original and augmented pairs\. This will enable us to identify and filter or regenerate low\-quality augmentations that harm performance\.

Another point is also to examine the scalability of the approach to denser evaluation settings and extend the training corpus to additional compliance frameworks\. Moreover, we plan to evaluate newer Sentence Transformer architectures and explore open\-weight generative models, such as Llama 3 or Mistral, to transition to Retrieval\-Augmented Generation \(RAG\) pipelines\.

## Acknowledgements

This work is partially supported by EMERALD \- Evidence Management for Continuous Certification as a Service in the Cloud \(101120688\) under the Horizon Europe program funded by the EU\.

## References