## 2 Prior and Related Work  
From the security point of view, an organization has to implement controls that would let an organization protect its most valuable assets, which can be achieved using different methods and techniques. One of the ways would be to apply a multi-criteria model for management decision making oriented to cost-effective management [9]. Another approach is the implementation of requirements defined by information security standards or best practices. In such a case, an organization would be able to prove that it ensures \"due diligence\" and \"due care\" principles. Organizations that are planning to implement information security standards or best practices have to verify the organization's components to be protected and the applicable requirements for protection. While some regulations and standards are mandatory (e.g., GDPR [1], PCI DSS [2], and Health Insurance Portability and Accountability Act (HIPAA) [10]), others are not, however, making it important to ensure that an organization's environment and information are protected adequately. Problems arise from the fact that organizations are required to be aligned with more than one security standard or other regulating documents. A most famous example would be requirements for financial organizations to be aligned with Payment Card Industry Data Security Standard [2] (PCI DSS) requirements and the Sarbanes-Oxley Act [3], or requirement to be alignment with ISO 27001/ISO27002 [11] and PCI DSS. To solve this issue, scientists and researchers are using harmonization techniques [12; 13]. The most popular technique is mapping when two different documents or framework requirements are linked to one another [14]. We have proposed the use of adaptive mapping through security ontology [15], which would allow the linking of different standards and identification of the level of coverage between different standards. Another method of analysis of information security standard requirements and their interlinks would be the usage of data mining and knowledge discovery techniques [16]. In many cases, organizations decide to implement only mandatory security standard requirements that are named as a minimum security baseline (MSB). MSB is a set of primary security objectives that must be met by any given service or system [17]. In other words, the MSB would be a subset of an information security standard and could be represented as a subpart of it. The standard approach for minimum security baseline identification is the use of expert knowledge [18]. Information security specialists review the standard or framework and identify which requirements are mandatory and are a part of the MSB. Some researchers propose the use of Delphi method research for IT governance MSB identification [19]. The main disadvantages of these methods are related to the fact that they are based on expert knowledge, could be influenced by subjective opinion, are not affordable for small and medium-sized enterprises (SMEs), and cannot be easily adapted for dynamic changes in the information security area. The previously proposed adaptive mapping method [15] was useful for an understanding of the overall security requirements and visualization of their connections but could not be used for MSB identification. It was proved in articles [20; 21], that where security requirement implementation cost evaluation through control-based method were proposed, security controls and security standard requirement presentation as nodes and their connections as a link between nodes, was effective. For MSB identification, we propose to present information security standards as undirected graphs, where the graph is defined as a pair of sets (V, E), where V is the set of vertices and E is the set of edges formed by pairs of vertices [22]. In our case, security requirements are graph nodes, and edges between graph nodes show the links between these requirements.