## 4 Experimental Method Verification Results and Discussion  
Three regulating documents were selected for mapping: ISO27002, PCI DSS, and a newly introduced GDPR. Mapping (see Figure 6) was based on the HITRUST CSF 9.1 framework [60], which provides a table-based mapping of the majority of modern information security standards and other regulating documents. \begin{table}
\begin{tabular}{l l} \hline \hline
**Action No.** & **Description** \\ \hline \multirow{6}{*}{I} & This action includes two main activities: \\  & Information gathering about controls deployed; \\  & Presentation of information gathered in the form of a graph. \\  & Information gathering could be done manually or by automation tools that can process Business \\  & Process Model and Notation (BPMN) or Event-Driven Process Chain (EPC) diagrams. \\  & The generated graph may have stand-alone vertexes, i.e., not connected with any other vertexes. \\  & The process of identification of links between controls in the organization is a complicated task \\  & and could be accelerated if it is known if the organization is compliant with one or another \\  & security standard. \\ \hline \multirow{6}{*}{II} & MSB and deployed control graphs (DCGs) (or their representation form, like adjacency matrix, \\  & table) are imported to the graph processing tool, and the subgraph isomorphism algorithm \\  & is executed. \\  & If DCG graph has stand-alone vertexes or small subgraphs, then the subgraph isomorphism \\  & algorithm is executed for each of them separately. \\ \hline \multirow{6}{*}{III} & Since a stand-alone vertex is isomorphic to any vertex of MSB, additional verification based on a \\  & specified criterion (e.g., semantic similarity) should be used. \\ \cline{1-1}  & Error verification can be done automatically, by applying addition verification criteria and \\ \cline{1-1}  & re-executing the subgraph isomorphism algorithm against subgraph or manually by \\ \cline{1-1}  & a security specialist. \\ \hline IV & Controls required by MSB but are not present in DCG are identified. \\ \hline \hline \end{tabular}
\end{table} 
Table 2: The formal MSB verification against deployed controls method actions description. Figure 5: Method of MSB verification against deployed controls. Each of the standards (ISO27002, PCI DSS, GDPR) was presented as a graph (sample presented in Figure 7). Cytoscape 3.6.1 application [61] was used for graph visualization. Later, mapping of separately generated graphs from HITRUST CSF 9.1 framework was performed, although other mapping methods, like the expert-based approach, can be applied. The resulting graph (Figure 8) had 1267 vertexes (150 related to ISO27002 standard, 264 vertexes associated with PCI DSS standard, and 853 to GDPR) and 2512 edges. Figure 6: GDPR–ISO27002–PCI DSS mapping (partial view). Figure 7: Security standard graph (partial view). Null vertexes were added in order to ensure that vertexes that do not have direct connections with other standards were not removed. Addition of null vertexes increased the size of the mapping graph by 463 vertexes. The mapping graph was converted to the adjacency matrix by Cytoscape plug-in \"Adj Exporter\". The resulting matrix (Figure 9) was saved in *adj file. In Figure 9, part A presents a small part of the generated adjacency matrix and part B provides a presentation of the whole matrix. Black dots on the screen provide information on graph components and connections between them. Part B view was created by an open source TreeView 3.0 Java application [62]. After the adjacency matrix was created, the vertex cover algorithm was applied. For our experiment, a C++ application developed by [PERSON] [63] implementing his proposed polynomial time, vertex cover algorithm was used. The application requires one to specify the desired size k of the resulting vertex cover. In our case, k was defined as equal to 2 in order to find all possible vertex covers.