From Security Standards to Adversary Emulation: An AI-Assisted Framework for ICS Security Assessment

Security assessments are essential to ensure that Industrial Control Systems (ICS) comply with cybersecurity standards and remain resilient to evolving cyber threats. While standards such as IEC 62443 and NIST provide structured guidance for securing industrial systems, translating these highlevel requirements into concrete and executable security tests remains a largely manual process. In practice, analysts must interpret heterogeneous standards, derive security controls, identify relevant adversarial behaviors, and design testing procedures for the target environment. This limits the repeatability and scalability of security assessments across industrial contexts. This paper presents a standards-driven approach that transforms cybersecurity requirements into executable adversary emulation procedures for ICS security assessment. The proposed framework extracts security controls from standards, aligns them with adversarial behaviors described in the MITRE ATT&CK knowledge base for ICS, and generates environment-aware test actions executable through the MITRE CALDERA adversary emulation platform. An AIassisted pipeline supports the interpretation of requirements and the generation of test procedures while preserving human oversight and process traceability. By leveraging CALDERA as the execution layer, the approach decouples the assessment methodology from the target system, enabling the same adversary procedures to be applied across different environments such as virtual testbeds, digital twins, and operational systems. The approach is validated through two industrial case studies, demonstrating how standards-driven adversary emulation supports repeatable security assessments in heterogeneous ICS environments.