Patent ID: 11930032
Assignee: nan
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC H

Claim 2:
3. The method of claim 1, wherein step b) comprises:
a. identifying a universe of security best practices and technologies from government and industry regulations, best practice surveys, security control frameworks, intelligence agency security control rankings, and industry analyst guides;
b. using expert judgement to combine and rearrange said best practices and technologies to derive a universe of security controls based on activities, artefacts or properties whose security effectiveness can be quantified with, at minimum an ordinal scale, but preferably an interval or ratio scale;
c. pre-assigning each of said derived security controls to one of the following functional groups: “Governance”, “Endpoints”, “Network”, “Access”, “Data”, Dependencies” and “Awareness”;
d. pre-assigning each of said derived security controls to one of the following lifecycle groups: “Identify”, “Prevent”, “Limit”, Detect”, “Respond”, “Recover”;
e. pre-assigning each of said derived security controls to one of the following security control groups: “Plan”, “Policy”, “Procedure”, “Resource”, or “Technical”;
f. ensuring that every combination of said functional group and said lifecycle group has at least one security control;
g. pre-assigning a specific priority P1, P2, or P3 to each security control based on best practice surveys, customary norms, intelligence agency security control rankings, NIST Baselines, or Center for Internet Security Implementation Classes;
h. pre-assigning a set of declarative statements to each security control which describe basic, intermediate and advanced levels of functionality, wherein each higher level either subsumes or replaces and improves the functionality of the level(s) below it;
i. designating each of said derived security controls as a predominantly likelihood-reducing security control or impact-reducing security control;
j. pre-assigning a weighting factor wi for each likelihood-reducing security control i, which is an estimate of the fraction of all security incidents that the security control will block or contain, based on open source data breach statistics;
k. pre-assigning a weighting factor wi for each impact-reducing security control i, which is an estimate of the fraction by which the security control will reduce the impact of a security incident, based on open source cost of data breach statistics;
l. pre-calculating a maturity score for each possible level of each security control, selecting from said universe of security controls a set of security controls that the organization is expected to implement, prescribing the level of implementation required of said selected security controls to achieve reasonable and effective security based on its normalized total inherent risk, and calculating an expected maturity score for said selected security controls;
m. determining an actual maturity score for said selected security controls based on said pre-calculated maturity scores and a series of multiple choice questionnaires;
wherein the steps above are implemented using a computing device.