AI-Based Security Posture Management as an Enabling Layer for Real-Time NIST Cybersecurity Framework Adherence: A Theory- Grounded Conceptual Framework
Abstract
Critical infrastructure (CI) operators face a widening gap between the point-in-time, audit- oriented mechanisms through which they demonstrate compliance with the NIST Cybersecurity Framework and the continuous, machine-speed dynamics of the environments those mechanisms are meant to protect. This article develops a theory-grounded conceptual framework that positions AI-Based Security Posture Management as the enabling layer through which CSF functions are transformed from periodically evidenced artifacts into continuously operating control mechanisms. The paper first distills five continuous control principles latent in NIST guidance: real-time assessment, automated detection and analytics, responsive and adaptive control, policy-based enforcement, and cross-environment visibility. It then defines five corresponding ASPM capabilities grounded in the artificial intelligence and machine learning literature: automated configuration monitoring, real-time control mapping, behavior and pattern analysis, automated remediation, and unified cross-environment visibility. The framework is anchored in three complementary theoretical traditions: Risk Management Theory, which justifies continuous risk sensing under Knightian uncertainty; Control Theory and cybernetics, which supply the feedback-loop logic of measurement, comparison, and correction; and Sociotechnical Systems Theory, which insists that automated control be embedded in a balanced human and technological ecosystem. A capability-to-function mapping across the six CSF 2.0 functions (Govern, Identify, Protect, Detect, Respond, Recover) is presented, together with seven testable propositions. The article closes with implications for CI operators and regulators, boundary conditions of the framework, and a research agenda for empirical validation.
Keywords
AI-based security posture management; NIST Cybersecurity Framework; critical infrastructure; continuous monitoring; cybernetics; sociotechnical systems
References
Adadi, A., & Berrada, M. (2018). Peeking inside the black-box: A survey on explainable artificial intelligence . IEEE Access, 6, 52138-52160. https://doi.org/10.1109/ACCESS.2018.2870052 Adebayo, A., Adegbite, M. P., & Ahmed, M. O. (2022). Adversarial machine learning in critical infrastructure: A conceptual framework for threat modeling AI enabled OT systems. World Journal of Innovation and Modern Technology, 6(1), 184-234. https://doi.org/10.56201/wjimt.v6.no1.2022.pg184.234 Adebayo, A., Adegbite, M. P., & Ahmed, M. O. (2023a). AI augmented threat detection in industrial control systems: A systematic review of machine learning approaches for ICS anomaly detection. International Journal of Engineering and Modern Technology, 9(3), 287-340. https://doi.org/10.56201/ijcsmt.v9.no3.2023.pg287.340 Adebayo, A., Adepoju, P. A., & Ozowara, D. E. (2023b). Conceptual model for cyber risk pricing and insurance structuring in health technology platforms. Gyanshauryam, International Scientific Refereed Research Journal, 6(6). Adebayo, A., Anunagba, C. O., & Ozowara, D. E. (2025). A review of zero trust security models and cost effectiveness in healthcare infrastructure. International Journal of Advanced Multidisciplinary Research and Studies, 5(6), 2269-2283. https://doi.org/10.62225/2583049X.2025.5.6.6051 Adegbite, M. P., Adebayo, A., & Ahmed, M. O. (2020). Securing operational technology networks in electric utilities: A systematic review of NERC CIP compliance and architectural threat mitigation. International Journal of Engineering and Modern Technology, 6(3), 103-146. https://doi.org/10.56201/ijemt..pg103.146 Adegbite, M. P., Adebayo, A., & Ahmed, M. O. (2022). A security architecture model for IT and OT convergence in regulated energy networks: Design principles and governance alignment. International Journal of Computer Science and Mathematical Theory, 8(2), 81- 132. https://doi.org/10.56201/ijcsmt.v8.no2.2022.pg81.132 Adegbite, M. P., Adebayo, A., & Ahmed, M. O. (2023). ICS and SCADA threat detection architectures in energy sector networks: A systematic review of SIEM, NDR, and anomaly detection approaches. , 7(2), 121- 182. https://doi.org/10.56201/wjimt.v7.no2.2023.pg121.182 Adegbite, M. P., Adebayo, A., & Ahmed, M. O. (2024a). A vulnerability governance architecture for power and utilities corporations: From exposure mapping to remediation verification. World Journal of Innovation and Modern Technology, 8(6), 185-246. https://doi.org/10.56201/wjimt.v8.no6.2024.pg185.246 Adegbite, M. P., Adebayo, A., & Ahmed, M. O. (2024b). An AI driven security operations architecture for utility sector SOCs: Integrating threat intelligence, behavioral analytics, and automated response. International Journal of Engineering and Modern Technology, 10(11), 197-256. https://doi.org/10.56201/ijemt.v10.no11.2024.pg197.256 Adegbite, M. P., Adebayo, A., & Ahmed, M. O. (2025). A cyber risk quantification and governance architecture for critical infrastructure: From posture measurement to executive reporting. International Journal of Computer Science and Mathematical Theory, 11(12), 232-293. https://doi.org/10.56201/ijcsmt..pg232.293 Adenuga, O. M. (2022). Smart grid architectures and energy distribution for high renewable penetration: A comprehensive review of technologies, operations, and deployment pathways. International Journal of Engineering and Modern Technology, 8(5), 125-155. https://doi.org/10.56201/ijemt.v8.no5.2022.pg125.155 Adesuyi, M. O., Akomolafe, O., Olaogun, B. O., Ndukwe, V. U., & Sakyi, J. K. (2025a). AI- enabled fraud detection ecosystem model for securing international payment channels. International Journal of Advanced Multidisciplinary Research and Studies, 5(6), 866-882. https://doi.org/10.62225/2583049X.2025.5.6.5284 Adesuyi, M. O., Akomolafe, O., Olaogun, B. O., Ndukwe, V. U., & Sakyi, J. K. (2025b). Resilience and continuity model for global payment infrastructure under geopolitical risks. International Journal of Multidisciplinary Research and Growth Evaluation, 6(4), 1467- 1482. https://doi.org/10.54660/.IJMRGE.2025.6.4.1467-1482 Adeyelu, O. O. (2018). A predictive compliance monitoring framework for detecting systemic safety risks through aviation consumer complaint data. Iconic Research and Engineering Journals, 1(8), 250-276. https://doi.org/10.64388/IREV1I8-1718478 Adeyelu, O. O., & Dagodzo, D. (2022). A comparative benchmarking model for aerodrome certification compliance across developing economy civil aviation authorities. International Journal of Multidisciplinary Research and Growth Evaluation, 3(6), 1016- 1035. https://doi.org/10.54660/.IJMRGE.2022.3.6.1016-1035 Adeyelu, O. O., & Dagodzo, D. (2024). A maturity model for predicting airport safety audit outcomes in resource-constrained regulatory environments. International Journal of Scientific Research in Civil Engineering, 8(4), 132-170. https://doi.org/10.32628/IJSRCE248423 Afrihyia, E., Akinse, S. G., & Ojukwu, P. U. (2024). Comparative governance of AI-driven healthcare management: Executive oversight, regulatory structures, and accountability in the United States and developing countries. International Journal of Advanced Multidisciplinary Research and Studies, 4(6), 3087-3102. https://doi.org/10.62225/2583049X.2024.4.6.5920 Afrihyia, E., Akinse, S. G., & Ojukwu, P. U. (2025). Organizational readiness for generative AI integration in healthcare operations: Comparative management capabilities between the U.S. and low- and middle-income countries. Iconic Research and Engineering Journals, 8(10), 1673-1697. https://doi.org/10.64388/IREV8I10-1714670 Agbabiaka, J., Okonkwo, C. S., Ogunwole, O., Mayo, W., & Okeke, O. T. (2019). Supply chain risk management model for EPC and gas processing projects. Iconic Research and Engineering Journals, 3(2), 968-980. https://doi.org/10.64388/IREV3I2-1713124 Agu, M. U., Akomolafe, O., & Bello, A. (2023). A comparative review of SOX compliance frameworks in cross-border financial auditing. International Journal of Advanced Multidisciplinary Research and Studies, 3(6), 2297-2306. https://doi.org/10.62225/2583049X.2023.3.6.5362 Ahmed, M., Mahmood, A. N., & Hu, J. (2016). A survey of network anomaly detection techniques. Journal of Network and Computer Applications, 60, 19-31. https://doi.org/10.1016/j.jnca.2015.11.016 Ahmed, M. O., Adegbite, M. P., & Adebayo, A. (2021). Zero trust architecture for operational technology in North American critical infrastructure: A framework for implementation and resilience optimization. International Journal of Engineering and Modern Technology, 7(1), 66-113. https://doi.org/10.56201/ijemt..pg66.113 Akanbi, O., Ganiu, O. S., & Sunday, E. A. (2025). A multi-agent AI framework for swarm intelligence in autonomous mobile robot fleet coordination. International Journal of Scientific Research in Humanities and Social Sciences, 2(1), 81-109. Akeju, B., Edivri, J., Ogbole, J. I., Okoruwa, P. O., Fadayomi, O., & Abolaji, T. O. (2018). Conceptual model for insider threat classification and risk modeling in complex digital systems. Iconic Research and Engineering Journals, 1(9), 476-492. https://doi.org/10.64388/IREV1I9-1713778 Akin-Oluyomi, O. T., Atima, M. E., & Akinleye, O. K. (2023). Regulatory compliance and supplier risk assessment frameworks in international pharmaceutical procurement. International Journal of Advanced Multidisciplinary Research and Studies, 3(6), 2194- 2204. Akomolafe, O., & Agu, M. U. (2018). A conceptual model for enhancing internal audit quality through technology-enabled risk assessment frameworks. Iconic Research and Engineering Journals, 1(9), 458-475. Akomolafe, O., & Agu, M. U. (2019a). A conceptual framework for developing risk-based internal control models in the insurance and banking sectors. Iconic Research and Engineering Journals, 2(8), 335-354. Akomolafe, O., & Agu, M. U. (2019b). A review of data-driven risk evaluation models for emerging market financial institutions. Iconic Research and Engineering Journals, 3(6), 433-448. Akomolafe, O., & Agu, M. U. (2019c). Advances in financial resilience through integrated governance and compliance strategies. Iconic Research and Engineering Journals, 2(10), 607-620. Akomolafe, O., Agu, M. U., & Bello, A. (2023a). A conceptual model for implementing risk-based auditing in strategic financial management. International Journal of Advanced Multidisciplinary Research and Studies, 3(6), 2274-2286. https://doi.org/10.62225/2583049X.2023.3.6.5359 Akomolafe, O., Agu, M. U., & Bello, A. (2023b). A quantitative conceptual model for assessing compliance risk in emerging economies. International Journal of Advanced Multidisciplinary Research and Studies, 3(6), 2287-2296. https://doi.org/10.62225/2583049X.2023.3.6.5360 Akomolafe, O., Agu, M. U., & Bello, A. (2025). A conceptual model for advancing risk governance through data-driven compliance analytics in financial institutions. Journal of Accounting and Financial Management, 11(11), 211-228. https://doi.org/10.56201/jafm..pg211.228 Alahmadi, B. A., Axon, L., & Martinovic, I. (2022). 99% false positives: A qualitative study of SOC analysts’ perspectives on security alarms. Proceedings of the 31st USENIX Security Symposium, 2783-2800. https://www.usenix.org/conference/usenixsecurity22/presentation/alahmadi Alcaraz, C., & Zeadally, S. (2015). Critical infrastructure protection: Requirements and challenges for the 21st century. International Journal of Critical Infrastructure Protection, 8, 53-66. https://doi.org/10.1016/j.ijcip.2014.12.002 Alexander, O., Belisle, M., & Steele, J. (2020). MITRE ATT&CK for Industrial Control Systems: Design and Philosophy. The MITRE Corporation. https://attack.mitre.org/docs/ATTACK_for_ICS_Philosophy_March_2020.pdf AlHogail, A. (2015). Design and validation of information security culture framework. Computers in Human Behavior, 49, 567-575. https://doi.org/10.1016/j.chb.2015.03.054 Aliliele, C., Mbonu, I. S., & Iwuanyanwu, U. (2023). A conceptual framework for continuous cloud misconfiguration monitoring and enterprise risk mitigation strategies. International Journal of Scientific Research in Computer Science, Engineering and Information Technology, 9(10), 373-394. https://doi.org/10.32628/CSEIT2361071 Aliliele, C., Mbonu, I. S., & Iwuanyanwu, U. (2024a). A conceptual framework for enterprise data sensitivity classification and regulatory traceability mechanisms. International Journal of Advanced Multidisciplinary Research and Studies, 4(6), 3103-3124. https://doi.org/10.62225/2583049X.2024.4.6.5991 Aliliele, C., Mbonu, I. S., & Iwuanyanwu, U. (2024b). Advances in HIPAA compliant data architecture and secure analytics frameworks for community healthcare organizations. Shodhshauryam, International Scientific Refereed Research Journal, 7(2), 277-324. https://doi.org/10.32628/SHISRRJ2472163 Aliliele, C., Mbonu, I. S., Uzoka, E., & Iwuanyanwu, U. (2025a). A review of AI assisted continuous auditing systems in technology risk and cybersecurity oversight. Gyanshauryam, International Scientific Refereed Research Journal, 8(4), 210-250. https://doi.org/10.32628/GISRRJ258369 Aliliele, C., Mbonu, I. S., Uzoka, E., & Iwuanyanwu, U. (2025b). Advances in data lakehouse governance architectures for enterprise data loss prevention and compliance assurance. Shodhshauryam, International Scientific Refereed Research Journal, 8(4), 171-213. https://doi.org/10.32628/SHISRRJ258474 Alles, M. G., Kogan, A., & Vasarhelyi, M. A. (2008). Putting continuous auditing theory into practice: Lessons from two pilot implementations. Journal of Information Systems, 22(2), 195-214. https://doi.org/10.2308/jis.2008.22.2.195 Ambali, K. B., Eyetsemitan, R. A., Oyeleye, A. O., & Fadayomi, O. (2021). Lean Six Sigma for small enterprises: A systematic review and Lite-DMAIC adaptation framework for resource-constrained organizations. Iconic Research and Engineering Journals, 5(5), 562- 583. https://doi.org/10.64388/IREV5I5-1716957 Ani, U. P. D., He, H., & Tiwari, A. (2017). Review of cybersecurity issues in industrial critical infrastructure: Manufacturing in perspective. Journal of Cyber Security Technology, 1(1), 32-74. https://doi.org/10.1080/23742917.2016.1252211 Annan, A. O. (2022). Data privacy governance models for cross-border digital platforms. International Journal of Multidisciplinary Research and Growth Evaluation, 3(6), 949- 964. Annan, A. O. (2024). Algorithmic accountability and trade secret protection in artificial intelligence. Shodhshauryam, International Scientific Refereed Research Journal, 7(5), 315-347. Annan, A. O. (2025a). Automated decision-making and anti-discrimination compliance under U.S. law. International Journal of Advanced Multidisciplinary Research and Studies, 5(2), 2522-2540. Annan, A. O. (2025b). Cybersecurity compliance as a source of competitive advantage in technology markets. International Journal of Scientific Research in Computer Science, Engineering and Information Technology, 11(5), 456-487. Apruzzese, G., Colajanni, M., Ferretti, L., Guido, A., & Marchetti, M. (2018). On the effectiveness of machine and deep learning for cyber security. Proceedings of the 10th International Conference on Cyber
More Articles from WORLD JOURNAL OF INNOVATION AND MODERN TECHNOLOGY
Decoupled from Nature: Tracking the Climate-Driven Degradation and Socio-Economic Barriers of Indigenous Flood Early Warning Systems in the Central Niger Delta
Author: Chumu, M. U., Abam, T. K. S., Ayotamuno, A, Ogboeli, G. P
Optimizing Freight Forwarding Across Road, Rail, and Maritime Systems for Speed and Cost-Effectiveness
Author: Gbasibo, Lawrence Addah, Oku-obong Udofia
Occupants' Preferences for Regenerative Architectural Elements in Enhancing Thermal Comfort in Corporate Headquarters Buildings
Author: Hauwa Jiddah1, Williams A. Idakwoji2 and Beatrice Chapi-Owoicho3
Socio-Economic Influences and Geographical Differences in Waste Production and Management Methods among Economically Disadvantaged Households in Rivers State, Nigeria
Author: Takerhi, Q., Ayotamuno, A , Dollah, O. C
Assessment of Flood Risks on Power Infrastructure and Renewable Energy Installations in Ogba-Egbema-Ndoni Local Government Area, Rivers State
Author: David, P. A., Iyama, W. A , Gobo, A. E