# US 10,121,150 B2 · Compliance as a service for an organization

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,121,150 B2
- Document ID: US10121150B2
- Status: Granted
- Kind: B2
- Application number: 14/514,581
- Filed: 2014-10-15
- Published: 2015-04-16
- Granted: 2018-11-06
- Earliest claimed: 2013-10-15
- Assignees: Tata Consultancy Services Limited
- Applicants: Tata Consultancy Services Limited
- Inventors: Anjali Sagar Gajendragadkar; Rahul Ramesh Kelkar; Prasaad Patil; Sandeep M; Azad Kalakoti; Harrick Vin; Amit Setia
- Web page: https://patentgrep.com/patent/US10121150B2

## CPC

- G06Q 30/018: Certifying business or products
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

The present disclosure relates to system(s) and method(s) to provide compliance as a service for one or more organization. The system further facilitates identifying one or more causes involved to provide compliance as a service by analyzing compliance documents. The system and method also provides conversion of clauses into appropriate controls. The system and method also assists in defining control that can perform a specific task on a system. The system and method further provides mapping of compliance using control.

## Claims

### Claim 1

A method to determine a compliance of a target system, the method comprising:
parsing a compliance document to determine a set of clauses present in the compliance document, wherein the set of clauses are classified into:
a simple clause, wherein only a compulsory pattern is checked to identify the compliance of the target system with respect to the simple clause;
a complex clause, wherein the compulsory pattern and an optional pattern are checked to identify the compliance of the target system with respect to the complex clause;
a citation specific clause, wherein a specified pattern is checked in specific citation to identify the compliance of the target system with respect to the citation specific clause; and
a composite clause, wherein pre-requisites are checked in a citation to check the compliance of the target system with respect the composite clause;
identifying a plurality of attributes associated with each clause, wherein the plurality of attributes comprises the compulsory pattern, the optional pattern, the citation, a control pre-requisite, a risk level, a control type and a profile applicability;
generating first set controls from the set of clauses based upon the plurality of attributes;
remotely analyzing the target system to identify a second set of controls applicable to the target system based on an element associated with the target system, wherein the second set of controls is a subset of the first set of controls;
calibrating the second set of controls based on a) a profile associated with the element, wherein the profile associated with the element comprise information associated with security, element management, logs, version, path management, authentication and authorization and b) a set of industrial standards applicable to the profile;
comparing a configuration of the target system with the second set of controls so calibrated to determine the compliance of the target system; and
generating a compliance report of the target system based upon the comparison of the configuration of the target system with the second set of controls.

### Claim 2 (depends on 1)

The method of claim 1, wherein the target system and the compliance document are associated with a domain of information technology.

### Claim 3 (depends on 1)

The method of claim 1, wherein the control is modelled as a standard template, wherein the standard template stores at least one attribute captures from the clause.

### Claim 4 (depends on 1)

The method of claim 1, wherein the set of industrial standards associated with the profile is identified from the compliance document.

### Claim 5 (depends on 1)

The method of claim 1, wherein the element is at least one of a network layer, an operating system, a database, a middleware's, and an applications layer.

### Claim 6 (depends on 1)

The method of claim 1, wherein the profile associated with the element is based on a role of the element performed in the target system.

### Claim 7 (depends on 1)

The method of claim 1, wherein the citation is further classified as a citation start and a citation end, wherein the citation start and the citation end define a boundary for checking the compulsory pattern and the optional pattern based upon the configuration of the target system.

### Claim 8

A system to determine a compliance of a target system, the system comprising:
a memory and a processor coupled to the memory, wherein the processor is configured to perform the steps of:
parsing a compliance document to determine a set of clauses present in the compliance document, wherein the set of clauses are classified into:
a simple clause, wherein only a compulsory pattern is checked to identify the compliance of the target system with respect to the simple clause;
a complex clause, wherein the compulsory pattern and an optional pattern are checked to identify the compliance of the target system with respect to the complex clause;
a citation specific clause, wherein a specified pattern is checked in specific citation to identify the compliance of the target system with respect to the citation specific clause; and
a composite clause, wherein pre-requisites are checked in a citation to check the compliance of the target system with respect the composite clause;
identifying a plurality of attributes associated with each clause, wherein the plurality of attributes comprises the compulsory pattern, the optional pattern, the citation, a control pre-requisite, a risk level, a control type and a profile applicability;
generating first set controls from the set of clauses based upon the plurality of attributes;
remotely analyzing the target system to identify a second set of controls applicable to the target system based on an element associated with the target system, wherein the second set of controls is a subset of the first set of controls;
calibrating the second set of controls based on a) a profile associated with the element, wherein the profile associated with the element comprise information associated with security, element management, logs, version, path management, authentication and authorization and b) a set of industrial standards applicable to the profile;
comparing a configuration of the target system with the second set of controls so calibrated to determine the compliance of the target system; and
generating a compliance report of the target system based upon the comparison of the configuration of the target system with the second set of controls.

### Claim 9 (depends on 8)

The system of claim 8, wherein the target system and the compliance document are associated with a domain of information technology.

### Claim 10 (depends on 8)

The system of claim 8, wherein the control is modelled as a standard template, wherein the standard template stores at least one attribute captures from the clause.

### Claim 11 (depends on 8)

The system of claim 8, wherein the set of industrial standards associated with the profile is identified from the compliance document.

### Claim 12 (depends on 8)

The system of claim 8, wherein the element is at least one of a network layer, an operating system, databases, a middleware's, and an applications layer.

### Claim 13 (depends on 8)

The system of claim 8, wherein the profile associated with the element is based on a role of the element performed in the target system.

### Claim 14 (depends on 8)

The system of claim 8, wherein the citation is further classified as a citation start and a citation end, wherein the citation start and the citation end define a boundary for checking the compulsory pattern and the optional pattern based upon the configuration of the target system.

### Claim 15

A non-transitory computer readable medium embodying a program product having embodied thereon a computer program to determine executable in a computing device for determining a compliance of a target system, the computer program product comprising:
a program code for parsing a compliance document to determine a set of clauses present in the compliance document, wherein the set of clauses are classified into:
a simple clause, wherein only a compulsory pattern is checked to identify the compliance of the target system with respect to the simple clause;
a complex clause, wherein the compulsory pattern and an optional pattern are checked to identify the compliance of the target system with respect to the complex clause;
a citation specific clause, wherein a specified pattern is checked in specific citation to identify the compliance of the target system with respect to the citation specific clause; and
a composite clause, wherein pre-requisites are checked in a citation to check the compliance of the target system with respect the composite clause;
a program code for identifying a plurality of attributes associated with each clause, wherein the plurality of attributes comprises the compulsory pattern, the optional pattern, the citation, a control pre-requisite, a risk level, a control type and a profile applicability;
a program code for generating first set controls from the set of clauses based upon the plurality of attributes;
a program code for remotely analyzing the target system to identify a second set of controls applicable to the target system based on an element associated with the target system, wherein the second set of controls is a subset of the first set of controls;
a program code for calibrating the second set of controls based on a) a profile associated with the element, wherein the profile associated with the element comprise information associated with security, element management, logs, version, path management, authentication and authorization and b) a set of industrial standards applicable to the profile;
a program code for comparing a configuration of the target system with the second set of controls so calibrated to determine the compliance of the target system; and
a program code for generating a compliance report of the target system based upon the comparison of the configuration of the target system with the second set of controls.