## 3 The Proposed Method for MSB Identification and Verification Against Deployed Controls  
Identification of a minimum set of security requirements, i.e., of only mandatory security standard requirements, is a challenging task. The scope of the MSB depends on the needs of the organization [55]. The objectives are chosen to be pragmatic and complete and do not impose technical means. Since MSB is a set of compulsory requirements for all systems [17] and presents a subset of information security standard requirements, formation of such a set of sets in cases of multiple security standards becomes even more complicated. Currently, organizations are solving this issue by applying risk analysis and risk management techniques, which allow them to evaluate business demands and existing environments, and to summarize the list of security requirements applicable to the organization. Unfortunately, such an approach is based on subjective factors, such as security expert knowledge, skills, and experience. Well known vendors, such as Microsoft [56] and Cisco [57], are publishing recommendations related to the configuration of their products. International associations, such as the Center of Internet Security [58], are publishing recommendations with a list of the most effective risk mitigation controls. However, such approaches are ad hoc-based and are not directly linked with existing security standards. MSB verification could be implemented in different ways, starting from the expert review [18], including information security consultant analysis. Authors of [18] conducted an explorative expert study to derive a set of COBIT 5 processes that could serve as a basis for an enterprise governance of IT implementation and discussed how this approach could contribute to complexity reduction. This research was based on an earlier [19] study, which was focused on identifying which practices (structures, processes, and relational mechanisms) an organization could leverage to ensure that IT governance becomes a reality in the organization. However, it is also necessary to state that both [18] and [19] concentrated on general IT management processes, rather than security MSB. Some other approaches utilize penetration testing or use of specific tools, such as vulnerability scanners, for potential security gap identification [59]. However, the use of tools will not link the identified gaps with applicable security standards. In this article, we are presenting a holistic method for solving two different problems: MSB identification and its verification against controls implemented by the organization. The method is based on graph theory and graph optimization algorithms (vertex cover and subgraph isomorphism). For MSB identification the use of a vertex cover algorithm is proposed. It is used for amending the created mapping graph, by removing from it specific vertexes. However, we have to ensure that only duplicated requirements will be removed. To achieve that we have two options:  
* to apply minimum weighted vertex cover algorithms in order to ensure those critical requirements having a lower value will be presented in a newly generated graph;
* to apply the selected minimum vertex cover algorithm with additional rules to ensure that higher level security requirements will not be overwritten by lower level requirements, and requirements without direct connections with another standard will not be removed. The second option was selected for implementation for simplicity reasons. The following rules were specified to ensure prioritization of specific requirements:  
1. Restriction to remove requirements, with a connection to parent vertex but no links to other standards. To achieve that, additional null vertex to such vertex will be added. 2. Additional evaluation of removed vertexes in order to ensure that vertexes without a direct connection to other standards are not removed from the graph. If such vertex were removed, we would restore them manually.