US 10,121,150 B2Granted

Compliance as a service for an organization

AssigneeTata Consultancy Services Limited

InventorsAnjali Sagar Gajendragadkar, Rahul Ramesh Kelkar, Prasaad Patil, Sandeep M, Azad Kalakoti, Harrick Vin, Amit Setia

Life of this patent

Estimating the term…

patentgrep

Loading patent…

Abstract

The present disclosure relates to system(s) and method(s) to provide compliance as a service for one or more organization. The system further facilitates identifying one or more causes involved to provide compliance as a service by analyzing compliance documents. The system and method also provides conversion of clauses into appropriate controls. The system and method also assists in defining control that can perform a specific task on a system. The system and method further provides mapping of compliance using control.

Claims15

Dependent claims

A method to determine a compliance of a target system, the method comprising:

parsing a compliance document to determine a set of clauses present in the compliance document, wherein the set of clauses are classified into:
a simple clause, wherein only a compulsory pattern is checked to identify the compliance of the target system with respect to the simple clause;
a complex clause, wherein the compulsory pattern and an optional pattern are checked to identify the compliance of the target system with respect to the complex clause;
a citation specific clause, wherein a specified pattern is checked in specific citation to identify the compliance of the target system with respect to the citation specific clause;
and
a composite clause, wherein pre-requisites are checked in a citation to check the compliance of the target system with respect the composite clause;
identifying a plurality of attributes associated with each clause, wherein the plurality of attributes comprises the compulsory pattern, the optional pattern, the citation, a control pre-requisite, a risk level, a control type and a profile applicability;
generating first set controls from the set of clauses based upon the plurality of attributes;
remotely analyzing the target system to identify a second set of controls applicable to the target system based on an element associated with the target system, wherein the second set of controls is a subset of the first set of controls;
calibrating the second set of controls based on a) a profile associated with the element, wherein the profile associated with the element comprise information associated with security, element management, logs, version, path management, authentication and authorization and b) a set of industrial standards applicable to the profile;
comparing a configuration of the target system with the second set of controls so calibrated to determine the compliance of the target system;
and
generating a compliance report of the target system based upon the comparison of the configuration of the target system with the second set of controls.

10 more elements

A system to determine a compliance of a target system, the system comprising:

a memory and a processor coupled to the memory, wherein the processor is configured to perform the steps of:
parsing a compliance document to determine a set of clauses present in the compliance document, wherein the set of clauses are classified into:
a simple clause, wherein only a compulsory pattern is checked to identify the compliance of the target system with respect to the simple clause;
a complex clause, wherein the compulsory pattern and an optional pattern are checked to identify the compliance of the target system with respect to the complex clause;
a citation specific clause, wherein a specified pattern is checked in specific citation to identify the compliance of the target system with respect to the citation specific clause;
and
a composite clause, wherein pre-requisites are checked in a citation to check the compliance of the target system with respect the composite clause;
identifying a plurality of attributes associated with each clause, wherein the plurality of attributes comprises the compulsory pattern, the optional pattern, the citation, a control pre-requisite, a risk level, a control type and a profile applicability;
generating first set controls from the set of clauses based upon the plurality of attributes;
remotely analyzing the target system to identify a second set of controls applicable to the target system based on an element associated with the target system, wherein the second set of controls is a subset of the first set of controls;
calibrating the second set of controls based on a) a profile associated with the element, wherein the profile associated with the element comprise information associated with security, element management, logs, version, path management, authentication and authorization and b) a set of industrial standards applicable to the profile;
comparing a configuration of the target system with the second set of controls so calibrated to determine the compliance of the target system;
and
generating a compliance report of the target system based upon the comparison of the configuration of the target system with the second set of controls.

11 more elements

A non-transitory computer readable medium embodying a program product having embodied thereon a computer program to determine executable in a computing device for determining a compliance of a target system, the computer program product comprising:

a program code for parsing a compliance document to determine a set of clauses present in the compliance document, wherein the set of clauses are classified into:
a simple clause, wherein only a compulsory pattern is checked to identify the compliance of the target system with respect to the simple clause;
a complex clause, wherein the compulsory pattern and an optional pattern are checked to identify the compliance of the target system with respect to the complex clause;
a citation specific clause, wherein a specified pattern is checked in specific citation to identify the compliance of the target system with respect to the citation specific clause;
and
a composite clause, wherein pre-requisites are checked in a citation to check the compliance of the target system with respect the composite clause;
a program code for identifying a plurality of attributes associated with each clause, wherein the plurality of attributes comprises the compulsory pattern, the optional pattern, the citation, a control pre-requisite, a risk level, a control type and a profile applicability;
a program code for generating first set controls from the set of clauses based upon the plurality of attributes;
a program code for remotely analyzing the target system to identify a second set of controls applicable to the target system based on an element associated with the target system, wherein the second set of controls is a subset of the first set of controls;
a program code for calibrating the second set of controls based on a) a profile associated with the element, wherein the profile associated with the element comprise information associated with security, element management, logs, version, path management, authentication and authorization and b) a set of industrial standards applicable to the profile;
a program code for comparing a configuration of the target system with the second set of controls so calibrated to determine the compliance of the target system;
and
a program code for generating a compliance report of the target system based upon the comparison of the configuration of the target system with the second set of controls.

10 more elements

Dependencies are inferred from the claim text.