Methods and apparatus for data-driven vendor risk assessment

A computer system comprising one or more processors in communication with a computer-readable storage media storing instructions that, when executed by the one or more processors, cause the one or more processors to:

• generate a display for a graphical user interface comprising a plurality of monitored elements of an organizational entity, wherein the plurality of monitored elements correspond to predefined or user-specified security objectives;
• accept user input from the user interacting with the graphical user interface, the input assigning at least two software application components to each of the plurality of monitored elements of the organizational entity, wherein each of the at least two software application components performs a different operation;
• obtain security status information from the at least two software application components, the at least two software application components being used by an organizational entity, wherein, for each of the at least two software application components, the security status includes data points associated with operation of the software application component;
• map the data points of the security status information, for each of the at least two software application components, to relevant one or more of the plurality of monitored elements of the organizational entity based on stored mapping information;
• determine, for each of the plurality of monitored elements, a score based on the mapping of the data points to the plurality of monitored elements;
• determine a security status of the organizational entity by determining a weighted measure based on the score and first weighting information associated with each of the plurality of monitored elements;
• transmit, to the graphical user interface for display:
• the score for each of the plurality of monitored elements;
• and
• the security status;
• and
• generate and transmit, to the graphical user interface for display, an alert upon determining a change in a value of the security status of the organizational entity.