Patent ID: 11868480
Assignee: VALENTE SHERMAN, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G  H

Claim 14:
15. A non-transitory machine readable medium having instructions stored thereon for performing a method, the method comprising:
at a communications interface, receiving security practices information from a first computing system via a network, wherein the security practices information characterizes security measures in place at the first computing system;
at the communications interface, receiving computing services interaction information from a second computing system via the network, wherein the computing services interaction information characterizes data transmitted from the second computing system to the first computing system;
at a processor, determining a risk profile for the first computing system based on the security practice information, wherein determining the risk profile comprises analyzing third-party audit information documenting the result of an audit of the security measures, wherein the processor is configured to access security information associated with a plurality of vendors providing computing services and a plurality of clients accessing the computing services via the network, the first computing system being associated with a designated one of the vendors, the second computing system being associated with a designated one of the clients, wherein determining the risk profile comprises estimating a dimensional risk factor for each of a plurality of security dimensions based on the security practice information, the dimensional risk factor reflecting a reported security practice associated with the security dimension, the dimensional risk factor reflecting a level of assurance associated with the reported security practice, and wherein determining the risk profile comprises calculating a weighted average of the dimensional risk factors;
at the processor, determining, based on the risk profile and the computing services interaction information, an estimate of an information security risk associated with transmitting the data from the second computing system to the first computing system, wherein determining the estimate of the information security risk comprises determining a weighting value for each of the dimensional risk factors based on the computing services interaction information, the weighting reflecting a relative importance of the dimensional risk factor to the estimate of the information security risk; and
transmitting a risk assessment message to the second computing system, the risk assessment message including the estimate of the information security risk, where the risk assessment is client-specific to the second computing system and depends on the type of information to be transmitted to the first computing system.