Security Control Coverage and Maturity Across Regulatory Compliance Frameworks for Generative AI Systems

Abstract

Security governance is needed that links security technical controls to security regulatory requirements to support Generative artificial intelligence (GenAI). This study has compared the coverage and maturity of security controls as outlined in HIPAA, GDPR, the EU AI Act and financial regulations. A curated dataset of 47 requirements, 24 controls, coverage ratings, and a control–requirement mapping matrix was analyzed descriptively as a secondary analysis. One of the links was not consistent, and was not included in the identification of valid relationships, leaving 128 valid relationships. In total, 41 requirements (87.23%) were mapped with at least one control and six requirements were unmapped. Of the 96 control–framework assessments, 34.38% reported full coverage, 54.17% reported partial coverage, and 11.46% reported coverage of an unspecified nature. Controls were classified as production (58.33%), emerging (37.50%), or research (4.17%). There were 19 controls across all four regulatory groups and 16 requirements, which were supported by only one control. These results show significant common mapping and depth and maturity issues. They help you to have expert review on unmapped requirements, unspecific ratings, and control dependencies in a targeted way. These results reflect curated assessments, and are not to be used as a measure of organizational implementation, effectiveness or legal compliance.