US 2022/0101221 A1 · ENTERPRISE INFORMATION SECURITY MANAGEMENT SYSTEM

Abstract

A computer-implemented method is disclosed. The method includes: receiving user input of identifying information for an information technology system of a business, the identifying information indicating at least an industry, a type of the business, and one or more computer networks associated with the business; ascertaining, based on the identifying information, at least one regulatory instrument with which the business must comply; scanning the one or more computer networks associated with the business to identify information technology assets of the business; identifying at least one of the information technology assets that are relevant to compliance with the at least one regulatory instrument; conducting a gap analysis based on scanning the at least one of the information technology assets to identify conditions indicative of non-compliance with one or more aspects of the at least one regulatory instrument; identifying, based on the gap analysis, one or more computing tasks that are required to bring the business into compliance with the at least one regulatory instrument; and communicating with a remote ticketing system to generate work tickets corresponding to the one or more computing tasks required to bring the business into compliance with the at least one regulatory instrument.

Claims20

Dependent claims

A computer-implemented method, comprising:

receiving user input of identifying information for an information technology system of a business, the identifying information indicating at least an industry, a type of the business, and one or more computer networks associated with the business;
scanning the one or more computer networks associated with the business to identify information technology assets of the business;
assigning at least one of a criticality value or a sensitivity value to one or more of the information technology assets of the business, the assigning of values including:
retrieving, from a database storing data relating to pre-categorized information technology assets, criticality values and sensitivity values for those pre-categorized information technology assets in the database that correspond to the one or more information technology assets of the business;
and
obtaining adjusted criticality values and adjusted sensitivity values for the one or more information technology assets of the business by adjusting the retrieved criticality values and sensitivity values based on the industry and type of the business;
and
generating, based on the adjusted criticality values and adjusted sensitivity values for the one or more information technology assets of the business, a security threat model for identifying potential security threats to the one or more computer networks of the business.

5 more elements

A computer-implemented method comprising:

receiving user input of identifying information for an information technology system of a business, the identifying information indicating at least an industry, a type of the business, and one or more computer networks associated with the business;
ascertaining, based on the identifying information, at least one regulatory instrument with which the business must comply;
scanning the one or more computer networks associated with the business to identify information technology assets of the business;
identifying at least one of the information technology assets that are relevant to compliance with the at least one regulatory instrument;
conducting a gap analysis based on scanning the at least one of the information technology assets to identify conditions indicative of non-compliance with one or more aspects of the at least one regulatory instrument;
identifying, based on the gap analysis, one or more computing tasks that are required to bring the business into compliance with the at least one regulatory instrument;
and
communicating with a remote ticketing system to generate work tickets corresponding to the one or more computing tasks required to bring the business into compliance with the at least one regulatory instrument.

5 more elements

Dependencies are inferred from the claim text.

Enterprise information security management system

Life of this patent

Enterprise information security management system

Life of this patent

Abstract

Claims20