A Governance Framework for Aligning Artificial Intelligence–Driven Cybersecurity with NIST CSF 2.0 and IEC 62443 in Critical Infrastructure

Abstract: The increasing adoption of Artificial Intelligence (AI) has fundamentally transformed cybersecurity by enabling intelligent threat detection, predictive risk assessment, automated incident response, and adaptive cyber defence. As organizations operating critical infrastructure increasingly deploy AI-enabled cybersecurity solutions, ensuring that these technologies remain secure, trustworthy, transparent, and compliant with internationally recognized cybersecurity standards has become a major governance challenge. Although the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF 2.0) and the IEC 62443 series provide comprehensive guidance for cybersecurity risk management and industrial control system security, they offer limited implementation guidance for governing AI-driven cybersecurity throughout its lifecycle. This lack of structured alignment creates challenges related to model governance, explainability, accountability, regulatory compliance, and human oversight, particularly within Operational Technology (OT) and Industrial Control System (ICS) environments.

This study proposes a governance framework for aligning Artificial Intelligence–driven cybersecurity with the NIST Cybersecurity Framework 2.0 and IEC 62443 to support secure and trustworthy AI deployment in critical infrastructure. The framework was developed using a Design Science Research (DSR) methodology and integrates AI lifecycle management, cybersecurity governance, Explainable Artificial Intelligence (XAI), Security Information and Event Management (SIEM), Security Orchestration, Automation and Response (SOAR), continuous risk assessment, and standards-based compliance into a unified governance architecture. The proposed framework establishes explicit relationships between AI governance processes and the six core functions of NIST CSF 2.0—Govern, Identify, Protect, Detect, Respond, and Recover—while incorporating the defence-in-depth principles and security lifecycle requirements of IEC 62443.

The framework is validated through standards mapping, architectural analysis, and compliance assessment to evaluate its completeness, interoperability, governance coverage, and applicability within industrial environments. The validation demonstrates that systematic alignment between AI technologies and internationally recognized cybersecurity standards enhances organizational governance, strengthens cyber resilience, improves transparency and accountability, and facilitates regulatory compliance. Furthermore, the framework supports responsible AI adoption by integrating continuous model monitoring, human oversight, explainability, and lifecycle management into cybersecurity operations.

The study contributes to both cybersecurity governance research and industrial practice by providing a practical implementation roadmap that enables organizations to deploy AI-enabled cybersecurity solutions while maintaining alignment with established international standards. The proposed governance framework offers a scalable foundation for developing trustworthy, resilient, and standards-compliant AI-driven cybersecurity systems capable of protecting critical infrastructure against increasingly sophisticated cyber threats.