# Human-Adjudicated Semantic Alignment of Critical-Infrastructure Cybersecurity Requirements

**Status:** v0.1, author-verified 2026-09-19 (see `docs/VERIFY_CHECKLIST.md` -- some source-level spot checks remain open ahead of formal submission) | **Maintainer:** Friday Ogochukwu Ikwuogu, [ORCID 0009-0009-2222-1318](https://orcid.org/0009-0009-2222-1318) | **License:** code MIT, data/documents CC BY 4.0

A human-adjudicated semantic crosswalk of four U.S. critical-infrastructure cybersecurity frameworks -- TSA's pipeline cybersecurity requirements, CISA's Cross-Sector Cybersecurity Performance Goals (CPG), NIST's Cybersecurity Framework (CSF) 2.0, and NERC's Critical Infrastructure Protection (CIP) standards -- mapped onto CSF 2.0's 22 categories and adjudicated as Reinforcing, Partially aligned, a Gap, or a Conflict. Produces an open dataset, a reproducible pipeline, and a submittable manuscript targeting the *International Journal of Critical Infrastructure Protection*.

## What is here

```
AUTHORS.json          single source of author identity for every downstream document
code/
  01_fetch.py          materializes cited raw source records -> data/raw/*.json
  02_build.py          maps every requirement to a CSF 2.0 category -> data/processed/crosswalk.csv
  03_qa.py             adjudicates each category, cross-checks itself, writes qa_report.txt + stats.json
  04_figures.py        builds the 3 manuscript figures (dataviz-skill palette); --final removes the draft watermark
  05_manuscript.js     builds paper/manuscript_IJCIP*.docx entirely from paper/stats.json
  06_supplement.js     builds paper/supplement*.docx (full 22-row adjudication + 90-row crosswalk tables)
data/
  raw/                 PROVENANCE.txt + materialized source JSON, with every URL/access-date/limitation logged
  processed/           crosswalk.csv, adjudication.csv, qa_report.txt
docs/
  BUILD_SPEC.md  CODEBOOK.md  LIMITATIONS.md  VERIFY_CHECKLIST.md  NEXT_STEPS.md
paper/
  stats.json  adjudication.json  figures/  manuscript_IJCIP.docx  supplement.docx
```

## Run it

```
pip install matplotlib
python code/01_fetch.py
python code/02_build.py
python code/03_qa.py
python code/04_figures.py --final
node code/05_manuscript.js --final
node code/06_supplement.js --final
```

A stranger should be able to run these, top to bottom, from this README alone, and reproduce `data/processed/` and `paper/` exactly. (Omit `--final` to get draft-watermarked outputs for review.)

## Sources

| Source | Vintage | License | Accessed |
|---|---|---|---|
| NIST CSF 2.0 (NIST CSWP 29) | Feb 2024 | US Gov, public domain | 2026-09-18 |
| CISA CPG v1.0.1 (goal list) | 2023 release | US Gov, public domain | 2026-09-18 |
| CISA CPG 2.0 (structural changes only; primary PDF WAF-blocked) | Dec 11, 2025 | US Gov, public domain | 2026-09-18 |
| NERC CIP standards (CIP-002 to CIP-014, current versions) | current | Public standards | 2026-09-18 |
| TSA NPRM / sNPRM, "Enhancing Surface Cyber Risk Management" | 2022 / 2024 | US Gov, public domain | 2026-09-18 |
| GAO-25-107947 (public proxy for non-public TSA Security Directive content) | 2025 | US Gov, public domain | 2026-09-18 |

Full provenance, including every access limitation encountered, is in `data/raw/PROVENANCE.txt`.

## Headline numbers (from `paper/stats.json`)

Of NIST CSF 2.0's 22 categories, 2 show strong three-framework reinforcement, 10 show partial alignment, 9 are gaps, and 1 is a direct conflict: NERC CIP's 1-hour incident-notification clock, TSA's currently-effective 24-hour clock, and CPG's non-mandatory reporting goal point operators toward three different timers and destinations for what may be the same incident. These verdicts and counts were confirmed unchanged by the author's 2026-09-19 sign-off (see `docs/VERIFY_CHECKLIST.md`).

## Limitations

See `docs/LIMITATIONS.md` before using or citing anything here -- in particular, TSA content is sourced entirely from public proxies (the actual Security Directives are Sensitive Security Information), and CPG content uses the verified CPG 1.0.1 goal list annotated with known-but-unverified CPG 2.0 structural changes (CISA's primary CPG 2.0 PDF was WAF-blocked from automated retrieval; the 11 affected rows are explicitly labeled `UNRESOLVED_SOURCE_BLOCKED` and were reviewed and knowingly retained by the author rather than guessed at or omitted).

## Citation

See `CITATION.cff`. DOI: https://doi.org/10.5281/zenodo.22852102

## AI assistance

**AI assistance:** AI coding tools (Claude, Anthropic) were used for code scaffolding, test fixtures, and documentation drafting. The problem definition, methodology, classification rules, mappings, and analytic decisions are the author's own.