# US 2021/0334386 A1 · Method and system for assessing effectiveness of cybersecurity controls in an ot environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0334386 A1 - Document ID: US20210334386A1 - Status: Published application - Kind: A1 - Application number: 16/859,632 - Filed: 2020-04-27 - Published: 2021-10-28 - Earliest claimed: 2020-04-27 - Assignees: Saudi Arabian Oil Company - Applicants: Saudi Arabian Oil Company - Inventors: Khalid Suliman AlGhamdi; Muhanad Abdulhamid Shahat - Web page: https://patentgrep.com/patent/US20210334386A1 ## CPC - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 9/542: {Event management; Broadcasting; Multicasting; Notifications} - G06F 21/554: {involving event detection and direct action} - G06N 5/04: Inference or reasoning models - G06Q 10/0635: Risk analysis of enterprise or organisation activities - H04L 63/1433: {Vulnerability analysis} - G06F 2221/034: Test or assess a computer or a system - G06N 20/00: Machine learning - G06Q 50/06: Energy or water supply - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A cybersecurity solution for monitoring and assessing an overall cybersecurity posture level of an operation technology environment to increase the level when it is determined to be below a setpoint value for the operation technology environment. The solution includes, among other things, receiving metrics data for a corresponding one of each of a plurality of cybersecurity posture indices for the operation technology environment, determining a cybersecurity posture index value for each of the plurality of cybersecurity posture indices based on the metrics data, applying a weight to each of the plurality cybersecurity posture index values to calculate a respective weighted cybersecurity posture index value, and determining an overall cybersecurity posture level of the operation technology environment based on a sum of each weighted cybersecurity posture index value. ## Claims ### Claim 1 A method for monitoring and assessing an overall cybersecurity posture level of an operation technology environment to increase said level when the level is determined to be below a setpoint value for the operation technology environment, the method comprising: receiving metrics data for a corresponding one of each of a plurality of cybersecurity posture indices (CPIi) for the operation technology environment; determining a cybersecurity posture index (CPIi) value for each of the plurality of cybersecurity posture indices (CPIi) based on the metrics data; applying a weight to each of the plurality cybersecurity posture index (CPIi) values to calculate a respective weighted cybersecurity posture index (wCPIi) value; determining an overall cybersecurity posture level of the operation technology environment based on a sum of each weighted cybersecurity posture index (wCPIi) value; generating a notification message, including image rendering data and commands; and sending the notification message to a computer resource asset to render an image of a snapshot cybersecurity posture level for at least one of the plurality of cybersecurity posture indices (CPIi). ### Claim 2 (depends on 1) The method in claim 1, further comprising: effectuating remediation based on the overall cybersecurity posture level of the operation technology environment. ### Claim 3 (depends on 1) The method in claim 1, further comprising: effectuating remediation based on the snapshot cybersecurity posture level. ### Claim 4 (depends on 1) The method in claim 1, wherein the snapshot cybersecurity posture level includes a near-real-time (NRT) snapshot cybersecurity posture level. ### Claim 5 (depends on 1) The method in claim 1, wherein the overall cybersecurity posture level of the operation technology environment includes a near-real-time (NRT) snapshot overall cybersecurity posture level. ### Claim 6 (depends on 1) The method in claim 1, wherein said snapshot cybersecurity posture level comprises a near-real-time (NRT) snapshot cybersecurity posture level for at least one of: a number of users authorized access to the operation technology environment; a network security level for the operation technology environment; a number cyber awareness sessions performed on the operation technology environment; a number of cyber drills performed on the operation technology environment; a number of cybersecurity incidents in the operation technology environment; a patch compliance ratio for computer resource assets in the operation technology environment; a backup availability ratio for computer resource assets in the operation technology environment; and an endpoint security compliance ratio for computer resource assets in the operation technology environment. ### Claim 7 (depends on 3) The method in claim 3, wherein effectuating remediation comprises fixing a vulnerability on a computer resource asset in the operation technology environment. ### Claim 8 (depends on 3) The method in claim 3, wherein effectuating remediation comprises guiding, on said computer resource asset, mitigation of a vulnerability on a different computer resource asset in the operation technology environment. ### Claim 9 A non-transitory computer readable storage medium having stored thereon instructions for monitoring and assessing an overall cybersecurity posture level of an operation technology environment that, when executed by a computing device, cause the computing device to perform operations comprising: receiving metrics data for a corresponding one of each of a plurality of cybersecurity posture indices (CPIi) for the operation technology environment; determining a cybersecurity posture index (CPIi) value for each of the plurality of cybersecurity posture indices (CPIi) based on the metrics data; applying a weight to each of the plurality cybersecurity posture index (CPIi) values to calculate a respective weighted cybersecurity posture index (wCPIi) value; determining an overall cybersecurity posture level of the operation technology environment based on a sum of each weighted cybersecurity posture index (wCPIi) value; generating a notification message, including image rendering data and commands; and sending the notification message to a computer resource asset to render an image of a snapshot cybersecurity posture level for at least one of the plurality of cybersecurity posture indices (CPIi). ### Claim 10 (depends on 9) The non-transitory computer readable storage medium in claim 9, wherein the instructions, when executed by the computing device, cause the computing device to perform a further operation comprising: effectuating remediation based on the overall cybersecurity posture level of the operation technology environment. ### Claim 11 (depends on 9) The non-transitory computer readable storage medium in claim 9, wherein the instructions, when executed by the computing device, cause the computing device to perform a further operation comprising: effectuating remediation based on the snapshot cybersecurity posture level. ### Claim 12 (depends on 9) The non-transitory computer readable storage medium in claim 9, wherein the snapshot cybersecurity posture level includes a near-real-time (NRT) snapshot cybersecurity posture level. ### Claim 13 (depends on 9) The non-transitory computer readable storage medium in claim 9, wherein the overall cybersecurity posture level of the operation technology environment includes a near-real-time (NRT) snapshot overall cybersecurity posture level. ### Claim 14 (depends on 9) The non-transitory computer readable storage medium in claim 9, wherein said snapshot cybersecurity posture level comprises a near-real-time (NRT) snapshot cybersecurity posture level for at least one of: a number of users authorized access to the operation technology environment; a network security level for the operation technology environment; a number cyber awareness sessions performed on the operation technology environment; a number of cyber drills performed on the operation technology environment; a number of cybersecurity incidents in the operation technology environment; a patch compliance ratio for computer resource assets in the operation technology environment; a backup availability ratio for computer resource assets in the operation technology environment; and an endpoint security compliance ratio for computer resource assets in the operation technology environment. ### Claim 15 (depends on 11) The non-transitory computer readable storage medium in claim 11, wherein effectuating remediation comprises fixing a vulnerability on a computer resource asset in the operation technology environment. ### Claim 16 (depends on 11) The non-transitory computer readable storage medium in claim 11, wherein effectuating remediation comprises guiding, on said computer resource asset, mitigation of a vulnerability on a different computer resource asset in the operation technology environment. ### Claim 17 A system for monitoring and assessing an overall cybersecurity posture level of an operation technology environment to increase said level when the level is determined to be below a setpoint value, the system comprising: a cybersecurity posture assessment and remediation (CPAR) stack arranged to receive metrics data for a corresponding one of each of a plurality of cybersecurity posture indices (CPIi) for the operation technology environment, and determine a cybersecurity posture index (CPIi) value for each of the plurality of cybersecurity posture indices (CPIi) based on the metrics data; and a key performance index (KPI) determiner arranged to apply a weight to each of the plurality cybersecurity posture index (CPIi) values to calculate a respective weighted cybersecurity posture index (wCPIi) value, determine an overall cybersecurity posture level of the operation technology environment based on a sum of each weighted cybersecurity posture index (wCPIi) value, generate a notification message, including image rendering data and commands, and send the notification message to a computer resource asset to render an image of a snapshot cybersecurity posture level for at least one of the plurality of cybersecurity posture indices (CPIi). ### Claim 18 (depends on 17) The system in claim 17, wherein the cybersecurity assessment and remediation (CPAR) stack comprises at least one of: a cybersecurity incidence level metrics (CILM) unit; a backup Availability Ratio Metrics (BARM) unit; a Patch Compliance Ratio Metrics (PCRM) unit; an Endpoint Compliance Ratio Metrics (ECRM) unit; a Network Security Level Metrics (NSLM) unit; a Security Awareness Level Metrics (SALM) unit; and a Drill Compliance Level Metrics (DCLM) unit. ### Claim 19 (depends on 17) The system in claim 17, the system further comprising: an operation technology key performance index mitigation unit arranged to effectuate remediation of a vulnerability on a computer resource asset in the operation technology environment to increase said snapshot cybersecurity posture level for the at least one of the plurality of cybersecurity posture indices (CPIi). ### Claim 20 (depends on 19) The system in claim 19, wherein the effectuate remediation comprises guiding remediation of the vulnerability on the computer resource asset.