Method, system and computer program product for assessing information security

A computer implemented method for assessing information security for a plurality of domains within an enterprise, comprising:

• (1) Querying an administrator to identify an enterprise type;
• (2) Querying the administrator to define domains within the enterprise;
• (3) Querying the administrator to identify users and user areas of expertise;
• (4) Tailoring user questions according to the enterprise type, the domains within the enterprise, and the user areas of expertise;
• (5) Querying the administrator regarding roll-up options for generating enterprise-wide reports;
• (6) interviewing a first user group regarding a first domain of an enterprise;
• (7) assessing, in a first computer, information security for the first domain based upon user responses to step (6);
• (8) interviewing a second user group regarding a second domain of the enterprise;
• (9) assessing, in a second computer, information security for the second domain based upon user responses to step (8);
• and
• (10) assessing information security for the enterprise in a third computer based on administrator selected options.

A computer program product comprising a computer readable medium having computer readable logic stored thereon that causes a computer system to assess information security for a plurality of domains within an enterprise, said computer readable logic comprising:

• an administrator query function that causes the computer system to query an administrator to identify an enterprise type, to define domains within the enterprise, to identify users and user areas of expertise, and to select roll-up options for generating enterprise-wide reports;
• a question tailoring function that causes the computer system to tailor user questions according to the enterprise type, the domains within the enterprise, and the user areas of expertise;
• a user querying function that causes the computer system to interview the users according to the questions tailored for the enterprise type, the domains within the enterprise, and the user areas of expertise;
• and
• an assessment function that causes the computer system to assess information security for the domains based upon corresponding user responses, and that causes the computer system to assess information security for the enterprise based upon the administrator selected roll-up options.