A control-maturity instrument for organizations introducing LLM-enabled systems.

The central question is structural, not technical.

Assuming an organization possesses mature corporate governance — aligned with ISO 37004 — are its existing organizational and technical information security controls (aligned with ISO 27002:2022) objectively mature enough to govern the introduction of LLM-enabled systems? The framework isolates control maturity from governance maturity, then tests each applicable control against four deployment archetypes and eight risk domains. Scoring uses an adapted C2M2 instrument; aggregation produces an objective Priority Quota and a qualitative gap typology.

1009 LTD — a simulated, fully documented SME baseline.

To evaluate control sufficiency under a realistic but reproducible profile, the framework uses 1009 LTD — a simulated small and medium-sized enterprise modelled as 40 employees across four divisions, with twelve documented internal policies spanning Information Security, Risk Management, Business Continuity, Identity Management, and Physical Security. Anchoring the analysis to a published profile solves two problems at once: it bypasses confidentiality constraints that limit empirical AI security work, and it gives the methodology a reproducible reference scenario.

Each stage of the framework is a standalone page.

Documents follow the analytical flow from research design through risk scenarios, controls, maturity, procedure, and gap typology. A critical evaluation is provided as a separate page.

Eight LLM threat domains, each as a full kill-chain taxonomy.

Every risk domain identified in the framework is documented as a standardized event lifecycle: phase taxonomy (Reconnaissance, Weaponization, Exploitation, C2, Actions on Objectives), TTP mapping against MITRE ATLAS / ATT&CK, preventive/detective/corrective control intersections, the telemetry needed for audit-grade evidence, and the auditor's CCCE perspective (Criteria · Condition · Cause · Effect · Recommendation). Each file is a plain-text master context document used as the methodological backbone for Step 2 of the gap analysis.

Four ways an SME adopts LLMs — each with its own threat surface.

Each archetype is published as a downloadable master context file used to contextualize every ISO 27002 control during Step 2 of the gap analysis. The files capture the organizational baseline (1009 LTD as CASP), the operational modality, primary threat vectors, and the applicable governance criteria policy-by-policy. They are the input the framework feeds into the C2M2-adapted maturity instrument when scoring control sufficiency.

What the updated scoring instrument actually returned.

The v4 (atnaujintas) workbook defines a nominal 71-control Organizational + Technological scope and actively scores 70 controls against the 32 cross-mapped risk scenarios (8 domains × 4 archetypes). For each control the instrument computes Direct / Indirect mapping counts, a priority score (Urgency × applicability), an adapted C2M2 maturity rating across four criteria (Coverage, Specificity, Operationalizability, Adaptability), the resulting capability gap against the LLM-specific target maturity, and a final Priority Quota — bucketed into Critical / High / Medium bands for management triage.

Excerpt from the GAP Analysis v4 (atnaujintas) workbook · 6 Critical + 5 of 31 High-band controls shown. The full Step 1 / Step 2 / Step 3 / Heatmap workbook is the analytical artifact behind these numbers.

How risk domains map to control families.

Each of the eight LLM risk domains is initially mapped against ten generic control domains (D1–D10), which group ISO 27002:2022 clauses by functional purpose. The dot indicates the primary functional mapping; secondary and indirect mappings are evaluated separately in the gap analysis procedure.

● Primary functional mapping. Indirect mappings are evaluated in Stage 2 of the procedure; full applicability under each archetype is decided in Stage 3 (see Gap analysis procedure).