Policy Gap Analysis System

This project analyzes organizational policy statements against standard NIST security rules using an offline, fully local AI pipeline. The system embeds policy clauses and NIST rules into semantic vectors using a pretrained MiniLM model from sentence-transformers and stores the NIST rule embeddings in a FAISS vector database for fast similarity search. For each policy clause, it finds the closest matching NIST rule by cosine similarity and classifies the clause as Adequate, Weak, or Missing based on the similarity score.