CertGraph: Towards a Comprehensive Knowledge Graph for Cloud Security Certifications

This paper introduces CertGraph, a knowledge graph-based approach designed to streamline security certification which integrates evidence from multiple sources. Unlike existing approaches, we consider the complete stack from software to policies, and enable the fusion of evidence from different views and sources. Its extensible ontology is designed to accommodate multiple domains, including cloud security, AI models, and source code. By providing an automated and systematic approach to build an ontology, CertGraph aims to facilitate more effective security certification and compliance verification.