## 1 Introduction  
In response to the increasing amount of cyberattacks, government regulatory authorities' pressure is increasing since they are concerned in the current situation with information and personal data protection. As an example of increasing regulatory pressure, the European Union General Data Protection Regulation (GDPR) [1] can be mentioned, which came into power on May 2018 and is applicable for all organizations. Trying to protect their most valuable assets, organizations deploys controls that reduce existing risks. One of the best approaches for the organization would be the implementation of all applicable security standard controls. The main issue in such a case is related to the fact that applied controls have different effectiveness and cost, and from an organization's point of view it is critical to ensure that enforced security controls are cost-effective and guarantee the needed level of protection. This task can be solved by implementing only mandatory requirements, which would be part of the minimum security baseline of a security standard or set of standards. Another problem, which is becoming more and more important nowadays, is related to the fact that in order to achieve a competitive advantage, an organization has to be aligned with more than one security standard. For example, financial organizations could be required to be compliant with the Payment Card Industry Data Security Standard (PCI DSS) [2] requirements (in case they process cardholder data) and the Sarbanes-Oxley (SOX) Act [3], which is applicable for all organization that provide financial services in the USA. The fact that SOX controls can be covered by implementing different frameworks, such as Control Objectives for Information and Related Technologies COBIT [4] or Committee of Sponsoring Organizations of the Treadway Commission COSO [5], complicates the situation even more. In such a case it is necessary to ensure that redundant controls are not implemented and there are no overlapping or conflicting controls. However, when an organization is fulfilling requirements from a set of standards, it is difficult to ensure effective cost management of security control implementation. The main issues are related to the fact that different standards define requirements with a different level of detail. This can lead to a situation where different technical solutions might cover the same requirement coming from different standards in the same organization. The most common solutions currently used are different harmonization techniques that visualize possible results. There exist a few different methods on how different standards can be linked. These techniques can be grouped into four main areas: semantic compatibility, mapping, adaptive mapping, and integration. Furthermore, 2.5D [6], 3D [7], or chord diagrams [8] can be used for harmonization results visualization. These techniques for harmonization and visualization allow us to understand links of different standards. However, identification of mandatory requirements still requires manual review of mapped information. In order to solve this problem, we propose linking different standards with the help of graphs, where security requirements are presented as a graph's vertexes. It allows us to use graph theory methods and especially graph optimization algorithms, such as vertex cover and graph isomorphism properties, for identifying overlapping and redundant controls. In our case, we propose the usage of a vertex cover algorithm for identification of the minimum set of security requirements in instances where an organization has to be aligned with multiple security standards. When a set of minimum security requirements is identified, graph isomorphism algorithms are applied for automatic verification of similarities between controls already implemented by the organization and the minimum security set determined by the vertex cover algorithm.