Organizations increasingly rely on recognized information security standards, such as ISO/IEC 27002:2022, to protect their systems and demonstrate compliance. In practice, assessing a company’s documents and policies against these standards is usually carried out manually by security experts to produce a Statement of Applicability. This process is time-consuming, expensive, and difficult to scale, especially when dealing with large, diverse, and sensitive corporate documentation. To address these challenges, this thesis proposes a control-centric AI framework for automating the applicability assessment of ISO 27002 controls using a Retrieval-Augmented Generation (RAG) approach. Instead of analyzing an entire document collection at once, the system processes each control individually.