Method and system for risk measurement and modeling

A computer program product embodied on a non-transitory computer-readable medium, comprising code executable by a computer having a processor and a memory, to cause the computer to carry out a set of residual risk score generation steps comprising:

• maintaining, in association with at least one information system, a threat library comprising a plurality of threat likelihoods, each of the plurality of threat likelihoods derived from at least one of an external source or an internal source, wherein maintaining the threat library comprises automatically retrieving, from the external source, an updated threat likelihood;
• generating a composite risk model and storing the composite risk model in association with the at least one information system, wherein generating the composite risk model comprises, for each of a plurality of predetermined risk scenarios, performing steps of:
• selecting a model for identifying a quantitative implicit risk of a risk scenario and incorporating the model into the composite risk model, wherein the model comprises a plurality of inputs, the plurality of inputs comprising a threat likelihood of the risk scenario in the plurality of threat likelihoods, a business impact of the risk scenario in a plurality of business impacts, and a control effectiveness of the risk scenario in a plurality of control effectivenesses, the risk scenario comprising at least one threat type and a targetable system;
• collecting scope and expectation information for an entity associated with the at least one information system, and determining, with the processor, based on the scope and expectation information, whether the at least one information system is vulnerable to the at least one threat type;
• determining, with the processor, from a set of possible assessment activities, a plurality of assessment activities to apply, the determination of the plurality of assessment activities being based on at least a determination of whether at least one information system is vulnerable to the at least one threat type, and automatically applying the plurality of assessment activities determined by the processor to the at least one information system;
• determining, with the processor, from a set of possible assessment activities, a plurality of assessment activities to apply, the determination of the plurality of assessment activities based on a determined assessment need based on at least a determination of whether the at least one information system is vulnerable to the at least one threat type and an identification of already-available assessment data provided on the at least one information system comprising one or more assessments that have already been completed, wherein determining the plurality of assessment activities to apply comprises identifying, in an available list of assessment activities, a plurality of manual assessment activities and a plurality of automatic assessment activities, providing each of the plurality of manual assessment activities on a user interface, and automatically applying the plurality of automatic assessment activities determined by the processor to the at least one information system;
• determining, with the processor, the control effectiveness of the risk scenario, wherein determining the control effectiveness of the risk scenario comprises automatically executing, with the processor, at least one test on the at least one information system, selecting a control framework from a set of stored control frameworks, and mapping the plurality of assessment activities and a result of the automatically executed at least one test to the control framework via a plurality of pre-defined input fields associated with the control framework;
• and
• calculating, from the implicit risk score and the control effectiveness, a residual risk value, and adding the residual risk value to a set of residual risk values;
• wherein the computer is further configured to perform the steps of:
• generating, from the set of residual risk values, an overall residual risk score;
• determining, from the plurality of control effectivenesses and the set of residual risk values, a plurality of control gaps based on a contribution of each of the plurality of control effectivenesses to the overall residual risk score;
• providing a control effectiveness summary, the control effectiveness summary comprising the plurality of control gaps displayed in a ranked order;
• and
• triggering, upon identification of a trigger condition comprising at least one of a modification to the at least one information system stored in association with the composite risk model and a passage of a predetermined amount of time after generation of the composite risk model, automatic scheduling of a process for generating an updated composite risk model.