Methods and systems of assessing and managing information security risks in a computer system

A computer system useful for assessing and managing information security risks in a computer system comprising:

• a processor;
• a memory containing instructions when executed on the processor, causes the processor to perform operations that:
• receive a customer security assessment, wherein the customer security assessment comprises a set of digitally answered questions answer by an information technology security expert in an entity, and wherein the set of digital answered questions comprises a set of MaxDiff or Choice-Based Conjoint questions;
• obtain a set of already-answered security assessment questions, wherein the set of already-answered security assessment questions comprises a set of security assessments from other vendors that have been answered in the past;
• determine a relative rank between a question in the customer security assessment and the set of already-answered security assessment questions;
• apply one or more machine learning methods to generate a strength of one or more similarities scores, wherein the one or more similarity scores map a set of already-answered security assessment questions with another set of questions in a customer security assessment;
• automatically populate one or more direct mappings between the set of already-answered security assessment questions with the other set of questions in a customer security assessment;
• use the strength of the one or more similarities scores to set a baseline for the score that can evolve over time via a set of overrides;
• set a baseline score for the one or more direct mappings to already-answered security assessment questions to a set of answered questions in the customer security assessment by using the strength of one or more similarities scores;
• rank the one or more direct mappings according to a set of baseline scores;
• and
• based on the ranking, automatically populate one or more non-direct mappings between the set of already-answered security assessment questions with the other set of questions in a customer security assessment.