Date: 2026-09-04 Status: published Domain: Kuwait and GCC Frameworks
A Kuwaiti financial entity is subject to both the national cybersecurity baseline and the Central Bank resilience framework, and no public mapping between them exists. This note publishes a method for proposing one, validates the method against mappings a person already made, and releases 215 candidate pairs that are explicitly unreviewed. The contribution is the validated method and the honest labelling, not the mapping itself.
Kuwait’s national baseline carries 44 controls under NCSC Decision No. 2 of
Building that mapping by hand means reading 44 controls against 874, which is 38,456 comparisons. That is why it has not been done.
Automating it invites a worse failure. A machine generated mapping presented as authoritative would be used for compliance decisions it cannot support, and the errors would be invisible because nobody would know which pairs were guessed. The problem is not generating candidates. The problem is publishing them without overstating what they are.
Candidates are generated by TF-IDF cosine similarity over control text, taking the top five matches for each national control and discarding scores below 0.10.
Two choices matter more than the algorithm.
Only official text is compared. The national corpus separates text quoted from the Annex from analysis this centre added. Only the official title and requirement enter the comparison, so the mapping reflects the regulator’s wording rather than this centre’s summary of it. Including the editorial material would have raised scores while measuring the wrong thing.
A domain stopword list is applied. Terms appearing in nearly every control,
such as shall, entity, requirement and security, carry no information
about which control a passage is. Left in, they dominate every comparison and
make unrelated controls look similar.
An unvalidated similarity score is an opinion with a decimal point. The national baseline already carries human made mappings to NIST CSF 2.0 subcategories, and those provide a ground truth the method never sees.
The test: if the metric captures real semantic relatedness, then national controls that share a CSF subcategory should score higher against each other than controls that share none.
| Measure | Value |
|---|---|
| Pairs sharing a CSF subcategory | 101 |
| Pairs sharing none | 845 |
| Mean similarity, sharing | 0.0790 |
| Mean similarity, not sharing | 0.0412 |
| Ratio | 1.91x |
| Cohen’s d | 0.881 |
An effect size of 0.881 is large. Controls a human grouped together score nearly twice as high under a metric that has no access to that grouping.
The build refuses to emit candidates if this figure falls below 0.2, so a future change that quietly degrades the metric stops the release rather than shipping worse candidates under the same confidence labels.
1. All 44 national controls received at least one candidate, and 215 pairs were generated in total. Confidence is banded by score: 8 strong, 77 moderate, 130 weak.
2. Only 8 pairs of 215 reach strong confidence. That number is the finding. A method with a large validated effect size still produces mostly weak candidates against this corpus, which means anyone expecting an automated crosswalk to be usable without review has misread what the technique can do.
3. Inspection of the strong band supports the ranking and shows its limit. RC-2, on testing and continuous improvement, matched a Central Bank control requiring lessons from recovery testing to feed continuous improvement. CLD-6, on service level agreements, matched controls specifying recovery and availability objectives in supplier agreements. Both are correct.
CLD-8, on cloud asset inventory, matched a control requiring an inventory of sensitive data assets. Both concern inventories and the wording overlaps heavily, but an asset inventory and a data inventory are different obligations discharged by different evidence. The pair scores 0.308 and is wrong.
A wrong pair inside the highest confidence band, in a method with a validated large effect, is the strongest available argument for why the release is marked unreviewed.
4. The release enforces its own honesty. Every pair carries status:
proposed, a null reviewer and a null decision. The validator fails the build if
a pair claims a reviewed status without a named reviewer, if a decision is
recorded while a pair is still proposed, or if the headline count of reviewed
pairs disagrees with the file. The dataset cannot come to overstate its standing
through gradual edits.
Nothing here is a compliance mapping. No pair has been reviewed by a person, and the file says so in both languages. Using it to justify a control decision would be a misuse the file explicitly warns against.
Lexical similarity cannot see two controls that impose the same obligation in different vocabulary. Recall is therefore unknown and probably poor. The absence of a candidate is not evidence that no relationship exists, which makes this method useful for finding overlaps and useless for proving their absence.
The validation borrows its ground truth from CSF mappings within a single corpus. That establishes the metric detects relatedness among national controls. It does not prove the metric transfers cleanly to a second corpus with different drafting conventions, and the drop to 8 strong candidates may partly reflect that transfer cost rather than genuine absence of overlap.
The Central Bank corpus is English only, and two of its 876 official controls are unaccounted for in the extraction.
Nothing in this note is legal advice.
python3 scripts/build_crosswalk.py --validate validation only
python3 scripts/build_crosswalk.py validate, then build
python3 scripts/validate_corpus.py provenance and review gates
Kuwait National Basic Cybersecurity Controls, NCSC Decision No. 2 of 2026,
published in Kuwait Al Youm issue 1785. Corpus at corpus/kw-nbcc.
Central Bank of Kuwait Cyber and Operational Resilience Framework v1.0, issued
2025-12-03. Corpus at corpus/kw-corf.
Candidate crosswalk at corpus/kw-crosswalk/nbcc-corf.json.