US 8,478,628 B1Granted

Component based risk system

AssigneeEMC Corporation

InventorSteven Gerard Schlarman

Life of this patent

Estimating the term…

Loading patent…

Abstract

System and method for risk assessment of compliance are disclosed. A database is provided, which contains mapped compliance data components related to regulations, requirements, policies and standards, controls, and assets. Users can specify the weighting of the data components based on the user's business requirements. Manual and automated assessments are used to measure and determine the state of compliance of assets, such as people, processes, and technology. In particular, assessments may be performed on the standards and controls related to people, processes, and technology. Various compliance and risk indices are computed based on the compliance status of the standards and controls. Reports and analysis using the compliance data components and the compliance and risk indices are provided to quantify compliance risks and to assess overall compliance.

Claims16

Dependent claims

A method implemented using a computer having a processor and a database to assess compliance risks associated with a set of policies and standards of an organization, the method comprising:

a. receiving mapping of compliance data comprising References, Standards, Controls, and Assets, wherein Standards are mapped to References, Controls are mapped to Standards, and Assets are mapped to Controls;
b. receiving a first set of weights associated with References, which are mapped to Standards, and a second set of weights associated with the Controls, which are mapped to Standards and Assets;
c. receiving a third set of weights associated with the Standards to be assessed, wherein the Standards are the set of policies and standards of an organization to be assessed;
d. the processor receiving and storing in the database assessment scores of the Standards to be assessed based on their actual status;
e. the processor retrieving the stored assessment scores of the Standards from the database and calculating a set of risk-based indices associated with the retrieved assessment scores of the Standards;
and
f. the processor calculating a set of asset assessment indices associated with the assessment scores of the Standards,
wherein the set of risk-based indices comprises a standard impact index and a query risk index, whereby for each assessed Standard,
a. the standard impact index is calculated as the sum of the first set of weights mapped to the Standard plus the sum of the second set of weights mapped to the Standard, and
b. the query risk index is calculated as the third weight associated with the Standard multiplied by the standard impact index of the Standard.

7 more elements

A method implemented using a computer to assess compliance risks associated with a set of business and internal controls of an organization, the computer including a processor and a database, the method comprising:

a. the processor receiving and storing in the database a mapping a compliance data, including data components for each of References, Standards, Controls, and Assets, wherein Standards data components are mapped in the database to References data components, Controls data components are mapped in the database to Standards data components, and Assets data components are mapped in the database to Controls data components;
b. receiving a first set of weights associated with References data components, which are mapped to Standards data components, and a second set of weights associated with the Controls data components, which are mapped to Standards data components;
c. receiving and storing in the database assessment scores of the Controls to be assessed, wherein the Controls are the set of business and internal controls of an organization;
d. calculating a set of risk-based indices based on the first set of weights and the second set of weights;
and
e. the processor retrieving the stored assessment scores from the database and calculating a set of assessment indices based on the assessment scores and the risk-based indices,
wherein the set of risk-based indices comprises a standard impact index and a control risk index, whereby
a. for each Standard, the standard impact index is calculated as the sum of the first set of weights mapped to the Standard plus the sum of the second set of weights mapped to the Standard, and
b. for each Control, the control risk index is calculated as the second weight associated with the Control multiplied by the sum of the standard impact indices of the Standards mapped to the Control.

6 more elements

A method performed by a computer for assessing compliance risks of an organization, the computer coupled to a user input device and to a database, the method comprising:

storing in the database a set of data elements relating to References, a set of data elements relating to Standards, a set of data elements relating to Controls, and a set of data elements relating to Assets;
displaying to a user a set of References stored in the database, a set of Standards stored in the database, and a set of Controls stored in the database;
receiving from the user a first selection associating at least one Standard from the displayed set of Standards with at least one Reference from the displayed set of References;
receiving from the user a second selection associating at least one Control from the displayed set of Controls with at least one Standard from the displayed set of Standards;
mapping, in the database in response to the first selection, at least one selected Reference with at least one associated selected Standard;
mapping, in the database in response to the second selection, at least one selected Standard with at least one associated selected Control;
receiving from the user a Reference Index (RI) designating a weight to be applied to at least one Reference;
receiving from the user a Query Index (QI) designating a weight to be applied to at least one mapped Reference-Standard pair;
receiving from the user a Control Index (CI) designating a weight to be applied to at least one mapped Standard-Control pair;
and
for at least one Standard, calculating a Query Risk Index (QRI), the QRI based upon a product of the QI associated with the Standard and a Standard Impact Index (SII), wherein the SII is calculated as the sum of the RIs of all References mapped to the Standard plus the sum of all QIs mapped to the Standard.

8 more elements

Dependencies are inferred from the claim text.