Patent ID: 11930032
Assignee: nan
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC H

Claim 0:
1. A method for identifying gaps in an organization's cyber defenses, and identifying and prioritizing remediations that are designed to eliminate those gaps, comprising:
a. using a multiple choice questionnaire, wherein each question corresponds to a risk factor and an inherent risk score is calculated for the question based on a weighting factor associated with the question and a risk rating associated with the answer, and wherein said inherent risk scores are used to calculate a normalized total inherent risk score for the organization;
b. predefining, prioritizing, weighting, and scoring a universe of security controls that can be implemented at different levels of functionality represented by declarative statements, preassigning each security control to distinct functional, lifecycle, and control groups, selecting from this universe a set of security controls and corresponding levels that the organization is expected to implement to achieve reasonable and effective security based on its normalized total inherent risk, calculating an expected maturity score for said selected security controls, and determining an actual maturity score for said selected security controls based on a series of multiple choice questionnaires;
c. aggregating and comparing said actual and expected maturity scores by said functional, lifecycle, and control groups, to identify and quantify gaps in the actual aggregated maturity scores of said groups which present unreasonable residual risk;
d. and recommending and prioritizing improvements to the security controls in said groups whose actual maturity score falls short of the expected maturity score, to raise the actual aggregated maturity score of said groups with said identified gaps to the expected level, thereby eliminating unreasonable residual risk;
wherein the steps above are implemented using a computing device;
in this manner the organization can identify a sequenced set of concrete steps it can take to achieve reasonable and effective security.