Work in Progress: Leveraging Large Language Models for Cybersecurity Compliance: A Pilot Study in ISO 27001 Audit Planning

Cybersecurity compliance processes are often subjective and error-prone due to their reliance on manual documentation. This pilot study evaluates the potential of Large Language Models (LLMs) in cybersecurity compliance during the planning phase of ISO 27001 standard. Using a hypothetical telecommunications organization, we evaluated three tasks: Statement of Applicability generation, audit scope definition, and compliance checklist development, assessing Sonnet 3.5, ChatGPT 4o, and Llama 3.1 via ordinal scoring and qualitative factors (e.g., scalability, skill coverage). Sonnet 3.5 consistently outperformed other models across all tasks, though all struggled with completeness and data assimilation. These findings validate LLMs' ability to streamline compliance workflows while highlighting key limitations that must be addressed for practical deployment.