## 3 Related Works  
Adopting a cybersecurity framework can be seen as a best practice, effectively showing that an organization has taken a robust duty of care. However, in today's digital transformation era, this is insufficient. The constantly evolving threat landscape presents new challenges, necessitating tailored and innovative solutions to prevent malicious actions and disruptions. Consequently, organizations need to establish, apply, and uphold various controls from diverse regulatory frameworks. Over the past few years, many researchers have evaluated the EU's cybersecurity environment, considering the increasing scale and sophistication of present cyber threats. They have also conducted studies comparing the relationships or correlations among existing regulatory frameworks. The research mainly centers on manual techniques or security ontologies to develop security standard mappings. This section aims to delve into these studies, illustrating that various legal regulations in the cybersecurity age can be effectively compared using generalized requirements. In 2019, the authors in [12] examined the interplay between the GDPR and NIS Directive focusing mainly on the incident notification obligations and their enforcement, while demonstrating that the two instruments represent a cross-sectorial approach. They also stated that any overlap of two instruments may only occur with respect to the operators and providers encompassed by the NIS Directive. They concluded that various legal uncertainties remain that are hard to translate into deterministic requirements for software design, and the choice of the instrument for a Directive adds to this dilemma. Moreover, the interplay between the NIS Directive and the GDPR is unclear where similar obligations exist, running the risk of the double jeopardy of non-compliance. In 2020, [PERSON] [13] provided a high-level comparison between the National Institute of Standards and Technology's (NIST) Cyber Security Framework (CSF), which is closely aligned to the NIS Directive and the ISO 27001 Security Standard. The pros, cons, and benefits of each risk management framework have been examined, particularly when choosing between the NIST CSF and ISO 27001. A thorough comparison was made on how major security control frameworks/guidelines, such as NIST SP 800-53 [14], CIS Top-20, and ISO 27002, align with one another. Both ISO 27001 and NIST CSF offer guidelines, policies, and procedures to establish a comprehensive Information Security Management System (ISMS). They can be enhanced with other guidelines. It was concluded that the optimal strategy to prevent unforeseen disasters is to integrate the strengths and recommendations of both frameworks. In the same year, [PERSON] et al. [15] provided an overview of research focused on mapping security standards (e.g., ISO 27001, ISO 27002, ITIL, COBIT, NIST SP800-53, GDPR). They explored methodologies formulated for these mappings and delved into tools, such as mapping tables, that support the process. [PERSON] noted that the mapping between standards is not comprehensive but rather focuses on subsets of standard controls or on a more general mapping. She asserted that fully automating this mapping process is crucial, and future research on security standard mappings should embrace Natural Language Processing (NLP) methods, potentially combined with existing security ontologies and manual comparison techniques. [PERSON] in [16] has carried out a comparative analysis of the cybersecurity strategies of the EU members taking into account the NCSS documents published by EU and European countries. Even if they benefit from the same guidelines, the documentation that makes them up is different from one state to another, based on a preliminary analysis of each national cyber framework. This has the effect of promoting diverse approaches in terms of priorities, objectives, set of measures, and their corresponding fields of action.