Devices, systems, and methods for automating evidence collection for software compliance

A backend computer system configured to automate evidence collection for software compliance for an enterprise, the backend computer system comprising:

• a processor;
• and
• a memory configured to store a collection engine comprising a large language model (“LLM”) that has been fine-tuned using source code and related documentation specific to the enterprise and that, when executed by the processor, causes the backend computer system to:
• extract metadata from a software architecture diagram received from a user computer device that is in communication with the backend computer system via an electronic data network;
• extract metadata from repository information associated with at least one repository of a plurality of repositories, wherein the plurality of repositories are repositories of a source code management system storing source code for the enterprise;
• map the software architecture diagram to the at least one repository of the plurality of repositories based on the metadata extracted from software architecture and the metadata extracted from the at least one repository of the plurality of repositories;
• identify a template from a plurality of templates based on the mapping and at least one requirement for compliance;
• generate a prompt to retrieve evidence from the plurality of repositories based on the identified template by combining the identified template with the metadata extracted from the software architecture diagram and the repository information to form a repository-specific query identifying one or more repositories of the source code management system from which evidence is to be retrieved;
• and
• retrieve, via the LLM, evidence relevant to the at least one requirement from the plurality of repositories based on the prompt, wherein the evidence comprises relevant source code retrieved from the at least one repository;
• generate an output by compiling the evidence relevant to the at least one requirement into an output;
• and
• transmit, via the electronic data network, the output to the user computer device for display via a user interface associated with the user computer device.

A system configured to automate evidence collection for software compliance for an enterprise, the system comprising:

• a user computer device;
• a plurality of repositories;
• a backend computer system communicatively coupled to the user computer device and the plurality of repositories via an electronic data network, wherein the backend computer system comprises a processor, and a memory configured to store a collection engine comprising a large language model (“LLM”) that has been fine-tuned using source code and related documentation specific to the enterprise and that, when executed by the processor, causes the backend computer system to:
• extract metadata from a software architecture diagram received from the user computer device;
• extract metadata from repository information associated with at least one repository of the plurality of repositories, wherein the plurality of repositories are repositories of a source code management system storing source code for an enterprise;
• map the software architecture diagram to the at least one repository of the plurality of repositories based on the metadata extracted from software architecture and the metadata extracted from the at least one repository of the plurality of repositories;
• identify a template from a plurality of templates based on the mapping and at least one requirement for compliance;
• generate a prompt to retrieve evidence from the plurality of repositories based on the identified template;
• and
• retrieve, via the LLM, evidence relevant to the at least one requirement from the plurality of repositories based on the prompt;
• generate an output by compiling the evidence relevant to the at least one requirement into an output by combining the identified template with the metadata extracted from the software architecture diagram and the repository information to form a repository-specific query identifying one or more repositories of the source code management system from which evidence is to be retrieved;
• and
• transmit, via the electronic data network, the output to the user computer device for display via a user interface associated with the user computer device, wherein the output comprises relevant source code retrieved from the at least one repository.