Control assessment systems, methods and program products

A system:

• a control assessment system configured to:
• receive, for a node of a network graph of a plurality of nodes:
• a risk and requirement design (RRD) rating,
• a scope of coverage (SoC) rating,
• a process and control design (PCD) rating, and
• a definition weight (Def Weight) corresponding to the RRD, a scope weight (Scope Weight) corresponding to the SoC rating, and a design weight (Design Weight) corresponding to the PCD rating;
• determine a leveling factor according to a maximum possible score of the RRD rating, the SoC rating, and the PCD rating;
• calculate a design and implementation (DIS) score for at least one of the plurality of nodes according to a formula that includes the RRD rating, the Def Weight, the SoC rating, the Scope Weight, the PCD rating, the Design Weight, and the Leveling Factor;
• and
• cause a risk mitigation process to be performed based, in part, on the DIS score.

A non-transitory computer-readable medium having stored thereon sequences of instructions, the sequences of instructions including instructions which when executed by one or more processors causes the at least one or more processors to perform:

• receiving, for a node of a plurality of nodes of a network graph:
• a risk and requirement design (RRD) rating corresponding to how well a set of controls within the node covers at least one risk for the respective node;
• a scope of coverage (SoC) rating corresponding to how well the set of controls within the node covers an intended scope of the node;
• a process and control design (PCD) rating corresponding to how well the set of controls within the node is designed;
• a definition weight (Def Weight) corresponding to the RRD, a scope weight (Scope Weight) corresponding to the SoC rating, and a design weight (Design Weight) corresponding to the PCD rating;
• determining a leveling factor according to a maximum possible score of the RRD rating, the SoC rating, and the PCD rating;
• calculating a design and implementation (DIS) score for the node based on a formula that includes the RRD rating, the Def Weight, the SoC rating, the Scope Weight, the PCD rating, the Design Weight, and the Leveling Factor;
• and
• causing a risk mitigation process to be performed based on the DIS score.