Technical Cybersecurity Governance and Continuous Internal Audit Assurance in Public Administration: Introducing the Cybersecurity Continuous Assurance Graph (CCAG)

This research introduces the Cybersecurity Continuous Assurance Graph (CCAG), a graph-based, temporally aware and evidence-driven assurance architecture designed for public-sector cybersecurity governance and Internal Audit. The study addresses the fragmentation that commonly exists between regulatory requirements, cybersecurity controls, technical telemetry, risk management, incident response and independent assurance. CCAG connects these elements within a single traceable model linking requirements, risks, assets, threats, vulnerabilities, control objectives, implemented controls, evidence, audit tests, findings, corrective actions and residual risk. The framework places particular emphasis on: the distinction between control design and operating effectiveness; population completeness and cross-system reconciliation; evidence provenance, integrity and temporal validity; SIEM and logging assurance; vulnerability and patch-management assurance; incident-response and reporting assurance; access governance and privileged-access controls; third-party and supplier-risk assurance; control dependencies and graph-based assurance impact propagation; preservation of Internal Audit independence under the Three Lines Model; human-governed use of artificial intelligence in assurance workflows. The research follows a Design Science Research approach and includes a reproducible synthetic public-sector environment containing 500 assets, 1,200 users, 75 privileged accounts, 150 vulnerabilities, 20 incidents, 35 suppliers and 250 evidence objects. The first controlled experiment, EXP-001, evaluates deterministic assurance rules against explicitly defined ground truth. After methodological refinement of the synthetic baseline, the v0.2 controlled validation detected all 31 explicitly defined assurance conditions, producing Precision, Recall and F1 values of 1.000. These results are interpreted strictly as controlled deterministic validation and not as evidence of universal real-world detection accuracy. The paper further proposes a human-supervised AI architecture in which AI can assist with retrieval, classification, evidence analysis, reconciliation, anomaly detection and drafting, while final assurance conclusions, legal interpretations, risk acceptance and professional judgments remain under human auditor control. This publication is released as Version 1.0, establishing the foundational CCAG architecture, assurance ontology, evidence-provenance model, temporal assurance model, synthetic research dataset and initial experimental validation. Future versions are planned to extend noisy-data testing, checklist comparison, AI evaluation, regulatory-change propagation, expert review and operational validation.