Information security control self assessment
AssigneeBank of America Corporation
InventorBalaji Venketeshwar
Life of this patent
Estimating the term…
Abstract
Apparatuses, computer readable media, methods, and systems are described for identifying risk assessment queries for assessing risk of a process, providing the identified risk assessment queries to a client device for presentation, receiving response data from the client device comprising responses to the risk assessment queries, determining response values for at least some of the risk assessment queries based on the received response data, and calculating a process risk metric based on the determined response values.
Claims17
An apparatus comprising:
- at least one processor;
- a storage storing a plurality of risk assessment queries;
- and
- at least one memory storing computer executable instructions that, when executed by the at least one processor, cause the apparatus at least to:
- identify one or more risk assessment queries from the plurality of risk assessment queries for assessing risk of a process;
- provide the identified risk assessment queries to a device for presentation;
- receive response data from the device, the response data comprising responses to the identified risk assessment queries;
- determine response values for at least some of the identified risk assessment queries based on the received response data;
- calculate a process weighted average by taking a sum of a series of response values multiplied by a number of responses associated with each of the response values, and dividing the sum by a number of responses associated with a non-zero response value;
- and
- calculate a process risk metric for the process based on the determined response values by adding a process total severity value to the process weighted average.
A non-transitory computer-readable medium storing computer-executable instructions that, when executed, cause an apparatus at least to perform:
- identifying risk assessment queries for assessing risk of a process;
- providing the identified risk assessment queries to a client device;
- receiving response data from the client device, the response data comprising responses to the risk assessment queries;
- determining response values for at least some of the risk assessment queries;
- and
- calculating a process risk metric of the process by adding a process total severity value to a process weighted average.
A method comprising:
- identifying risk assessment queries for assessing risk of a process;
- providing the identified risk assessment queries to a client device for presentation;
- receiving response data from the client device, the response data comprising responses to the risk assessment queries;
- determining, by at least one processor, response values for at least some of the risk assessment queries based on the received response data;
- and
- calculating, by the at least one processor, a process risk metric based on the determined response values, wherein calculating the process risk metric comprises adding a process total severity value to a process weighted average.
Dependencies are inferred from the claim text.