Patent ID: 11930032
Assignee: nan
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC H

Claim 3:
4. The method of claim 3, wherein step l) comprises:
a. pre-assigning a numerical value between 0 and 1 for each declarative statement for each security control i, representing an estimate of the degree of functionality (Degreei)L of the security control implemented at level L relative to its maximum functionality (implemented at the advanced level);
b. multiplying the weighting factor pre-assigned to each security control by said numerical value for each declarative statement to determine a precalculated maturity score for the security control for basic, intermediate, and advanced levels of functionality, as in the formula (CSi)L=wi*(Degreei)L, where L is the level of functionality (basic, intermediate, or advanced);
c. pre-calculating cumulative aggregated maturity scores AMρλ by adding together said precalculated maturity scores for each combination of priority ρ (P1, P2, and P3) and level λ (basic, intermediate, advanced), as in the formula AMρλ=AM(ρ−1)Advanced+Σi=1Nρ(CSi)λ, where Nρ is the number of security controls with priority ρ;
d. dividing said cumulative aggregated maturity scores by the maximum possible cumulative aggregated maturity score, obtained by implementing all security controls (P1, P2, and P3) at the advanced level, to yield a matrix of nine normalized total maturity scores, as in (MTotal)ρλ=AMρλ/Σi=1Nwi, where N is the total number of security controls;
e. selecting only P1 security controls if the normalized total inherent risk score RTotal is equal or less than said normalized total maturity score for P1 at the advanced level, (MTotal)P1Advanced;
f. selecting P1 and P2 security controls if the normalized total inherent risk score RTotal is greater than said normalized total maturity score for P1 at the advanced level, (MTotal)P1Advanced, but equal or less than said normalized total maturity score for P2 at the advanced level, (MTotal)P2Advanced;
g. selecting P1, P2 and P3 security controls if the normalized total inherent risk score RTotal is greater than said normalized total maturity score for P2 at the advanced level, (MTotal)P2Advanced, but equal or less than said normalized total maturity score for P3 at the advanced level, (MTotal)P3Advanced;
h. for each of said selected security controls, calculating the degree of functionality that the organization is expected to implement to achieve reasonable and effective security based on its normalized total inherent risk;
i. for each selected security control, calculating an expected maturity score by multiplying the expected degree of functionality for this security control by the weighting factor pre-assigned to this security control, as in the formula ESi=wi*EDPi;
wherein the steps above are implemented using a computing device.