Enhanced system, method and medium for certifying and accrediting requirements compliance utilizing robust risk assessment model

A system, comprising:

• at least one data repository configured to store at least one requirement category and information about potential vulnerabilities, the at least one data repository being further configured to store predetermined rules configured to be used in determining risk levels;
• a processor in communication with the at least one data repository, the processor configured to associate at least one first data element uniquely with the at least one requirement category, each first data element from the at least one first data element representing a potential of a vulnerability that could be used to exploit a target system, the processor being configured to associate at least one second data element uniquely with a degree of exposure of the target system to the a threat associated with the vulnerability of the target system, the processor being configured to compare the at least one first data element to the at least one second data element, the processor being configured to determine, based on predetermined rules, at least one composite data element for each requirement category from the at least one requirement category, the processor being further configured to determine a baseline risk level for each requirement category from the at least one requirement category, the baseline risk level for each requirement category being based on a level of risk of the composite data element associated with that requirement category.

A processor-readable medium comprising code representing instructions to cause a processor to:

• associate at least one first data element uniquely with at least one requirement category, each first data element from the at least one first data element representing a potential of a vulnerability that could be used to exploit a target system;
• associate at least one second data element uniquely with the vulnerability of the target system;
• compare the at least one first data element to the at least one second data element;
• determine, based on predetermined rules, at least one composite data element for each requirement category from the at least one requirement category;
• and
• determine a baseline risk level for each requirement category from the at least one requirement category, the baseline risk level for each requirement category being based on a level of risk of the composite data element associated with that requirement category.