An Approach for a Supporting Multi-LLM System for Automated Certification Based on the German IT-Grundschutz

The European Union's Network and Information Security Directive 2 (NIS2) has significantly expanded the number of organizations required to implement robust cybersecurity frameworks. In Germany, this has created a massive surge in demand for BSI IT-Grundschutz certifications. However, organizations face a critical shortage of qualified security specialists and high implementation costs, making the traditional, manual certification process increasingly unsustainable for many small and medium-sized enterprises (SMEs).

To address these challenges, the authors introduce a Multi-LLM System (MLS) designed to automate repetitive and time-consuming tasks within the nine-step IT-Grundschutz certification process. The architecture is built on a modular design featuring eight specialized LLM agents, including an orchestrator, task-specific experts, and knowledge experts.

A central component of this system is the use of HybridRAG, which combines vector-based retrieval (for semantic similarity) with graph-based retrieval (for relational context). By storing information in Knowledge Graphs (KGs), the system can navigate complex relationships between IT assets, security requirements, and organizational processes, which are often difficult for standard LLMs to parse accurately. This approach aims to reduce hallucinations and improve the precision of compliance checks.

By automating phases such as protection needs assessment, modeling, and measure consolidation, this architecture seeks to lower the barrier to entry for NIS2 compliance. It allows human certifiers to focus on high-level validation rather than manual documentation, potentially reducing the financial and operational burden on companies. Furthermore, the modular nature of the system allows it to be adapted to other regulatory frameworks beyond the German IT-Grundschutz, offering a scalable solution to the broader problem of regulatory compliance in cybersecurity.