Dynamic risk evaluation for proposed information technology projects

A user interface comprising a plurality of questions regarding a proposed information technology project may be generated. The user interface comprising the plurality of questions regarding the proposed information technology project may be communicated to a computing device. A plurality of responses input via the user interface may be received from the computing device. Each of the plurality of responses input via the user interface may correspond to one or more of the plurality of questions regarding the proposed information technology project. An initial risk assessment score for the proposed information technology project may be calculated based on the plurality of responses input via the user interface comprising the plurality of questions regarding the proposed information technology project. A determination may be made as to whether the initial risk assessment score for the proposed information technology project meets a predetermined threshold.

BACKGROUND

Information technology is playing an ever more prominent role in modern organizations. As new technology becomes available, organizations are continually evaluating proposals for new information technology projects. While these proposed information technology projects may present an organization with an opportunity to increase efficiency, offer a new product or service, or otherwise benefit on or more stakeholders, their implementation may also expose the organization to additional risks. Accordingly, a need exists for providing dynamic risk evaluation for proposed information technology projects.

SUMMARY

The following presents a simplified summary in order to provide a basic understanding of some aspects of the disclosure. This summary is not an extensive overview of the disclosure. It is neither intended to identify key or critical elements of the disclosure nor to delineate the scope of the disclosure. The following summary merely presents some concepts of the disclosure in a simplified form as a prelude to the description below.

In accordance with one or more embodiments, a user interface comprising a plurality of questions regarding a proposed information technology project may be generated. The user interface comprising the plurality of questions regarding the proposed information technology project may be communicated to a computing device. A plurality of responses input via the user interface comprising the plurality of questions regarding the proposed information technology project may be received from the computing device. Each of the plurality of responses input via the user interface comprising the plurality of questions regarding the proposed information technology project may correspond to one or more of the plurality of questions regarding the proposed information technology project. An initial risk assessment score for the proposed information technology project may be calculated based on the plurality of responses input via the user interface comprising the plurality of questions regarding the proposed information technology project. A determination may be made as to whether the initial risk assessment score for the proposed information technology project meets a predetermined threshold.

Responsive to determining that the initial risk assessment score for the proposed information technology project does not meet the predetermined threshold, a risk assessment summary report indicating that the initial risk assessment score for the proposed information technology project does not meet the predetermined threshold and comprising a summary of the responses input via the user interface comprising the plurality of questions regarding the proposed information technology project may be generated. The risk assessment summary reporting indicating that the initial risk assessment score for the proposed information technology project does not meet the predetermined threshold and comprising the summary of the responses input via the user interface comprising the plurality of questions regarding the proposed information technology project may be communicated to the computing device.

Responsive to determining that the initial risk assessment score for the proposed information technology project meets the predetermined threshold, a user interface comprising a plurality of question sets may be generated. Each question set of the plurality of question sets may comprise one or more questions relating to a question of the plurality of questions regarding the proposed information technology project. The user interface comprising the plurality of question sets may be communicated to a different computing device. A plurality of responses input via the user interface comprising the plurality of question sets may be received from the different computing device. Each of the plurality of responses input via the user interface comprising the plurality of question sets may correspond to a question of the plurality of question sets. An adjusted risk assessment score for the proposed information technology project may be calculated based on the plurality of responses input via the user interface comprising the plurality of question sets. Calculating the adjusted risk assessment score for the proposed information technology project may include adjusting the initial risk assessment score for the proposed information technology project based on the plurality of responses input via the user interface comprising the plurality of question sets.

In some embodiments, an adjusted risk assessment summary report comprising the initial risk assessment score for the proposed information technology project and the adjusted risk assessment score for the proposed information technology project may be generated. The adjusted risk assessment summary report comprising the initial risk assessment score for the proposed information technology project and the adjusted risk assessment score for the proposed information technology project may be communicated to the computing device and/or the different computing device.

In some embodiments, calculating the initial risk assessment score for the proposed information technology project may include selecting a plurality of risk values based on the plurality of responses input via the user interface comprising the plurality of questions regarding the proposed information technology project and summing the plurality of values. Each risk value of the plurality of risk values may correspond to a response of the plurality of responses input via the user interface comprising the plurality of questions regarding the proposed information technology project.

In some embodiments, adjusting the initial risk assessment score for the proposed information technology project based on the plurality of responses input via the user interface may include selecting a plurality of risk adjustment values based on the plurality of responses input via the user interface comprising the plurality of question sets and reducing the initial risk assessment score for the proposed information technology project by the plurality of risk adjustment values.

In some embodiments, the user interface comprising the plurality of question sets may include at least one link to a policy document associated with one or more questions of a question set of the plurality of question sets. In such embodiments, responsive to the at least one link to the policy document associated with the one or more questions of the question set of the plurality of question sets being invoked, at least one of the one or more questions of the question set of the plurality of question sets and at least a portion of the policy document associated with the at least one of the one or more questions of the question set of the plurality of question sets may be contemporaneously displayed.

In some embodiments, the plurality of questions regarding the proposed information technology project may include at least one question regarding whether the proposed information technology project utilizes proprietary production data of a financial institution in an environment other than a production information technology environment of the financial institution, and the plurality of question sets may include at least one question set comprising questions regarding the environment other than the production information technology environment of the financial institution. Additionally or alternatively, the plurality of questions regarding the proposed information technology project may include at least one question regarding whether the proposed information technology project involves storing data with a third-party, transmitting data to a third-party, or processing data by a third-party, and the plurality of question sets may include at least one question set comprising questions regarding the third-party; the plurality of questions regarding the proposed information technology project may include at least one question regarding whether the proposed information technology project involves creating or altering an Internet-facing application, and the plurality of question sets may include at least one question set comprising questions regarding the Internet-facing application; the plurality of questions regarding the proposed information technology project may include at least one question regarding whether the proposed information technology project involves acquisition of new hardware or software infrastructure, and the plurality of question sets may include at least one question set comprising questions regarding the new hardware or software infrastructure; the plurality of questions regarding the proposed information technology project may include at least one question regarding whether the proposed information technology project involves an exception request to a data loss prevention policy, and the plurality of question sets may include at least one question set comprising questions regarding the exception request to the data loss prevention policy; and/or the plurality of questions regarding the proposed information technology project may include at least one question regarding whether the proposed information technology project is being initiated as a result of a legal or regulatory compliance audit, and the plurality of question sets may include at least one question set comprising questions regarding the legal or regulatory compliance audit.

Other details and features will be described in the sections that follow.

DETAILED DESCRIPTION

FIG. 1depicts an illustrative operating environment in which various aspects of the present disclosure may be implemented in accordance with one or more example embodiments. Referring toFIG. 1, computing system environment100may be used according to one or more illustrative embodiments. Computing system environment100is only one example of a suitable computing environment and is not intended to suggest any limitation as to the scope of use or functionality contained in the disclosure. Computing system environment100should not be interpreted as having any dependency or requirement relating to any one or combination of components shown in illustrative computing system environment100.

Computing system environment100may include computing device101having processor103for controlling overall operation of computing device101and its associated components, including random-access memory (RAM)105, read-only memory (ROM)107, communications module109, and memory115. Computing device101may include a variety of computer readable media. Computer readable media may be any available media that may be accessed by computing device101, may be non-transitory, and may include volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer-readable instructions, object code, data structures, program modules, or other data. Examples of computer readable media may include random access memory (RAM), read only memory (ROM), electronically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and that can be accessed by computing device101.

Software may be stored within memory115and/or storage to provide instructions to processor103for enabling computing device101to perform various functions. For example, memory115may store software used by computing device101, such as operating system117, application programs119, and associated database121. Also, some or all of the computer executable instructions for computing device101may be embodied in hardware or firmware. Although not shown, RAM105may include one or more applications representing the application data stored in RAM105while computing device101is on and corresponding software applications (e.g., software tasks), are running on computing device101.

Communications module109may include a microphone, keypad, touch screen, and/or stylus through which a user of computing device101may provide input, and may also include one or more of a speaker for providing audio output and a video display device for providing textual, audiovisual and/or graphical output. Computing system environment100may also include optical scanners (not shown). Exemplary usages include scanning and converting paper documents, e.g., correspondence, receipts, and the like, to digital files.

Computing device101may operate in a networked environment supporting connections to one or more remote computing devices, such as computing devices141,151, and161. Computing devices141,151, and161may be personal computing devices or servers that include any or all of the elements described above relative to computing device101. Computing device161may be a mobile device (e.g., smart phone) communicating over wireless carrier channel171.

The network connections depicted inFIG. 1may include local area network (LAN)125and wide area network (WAN)129, as well as other networks. When used in a LAN networking environment, computing device101may be connected to LAN125through a network interface or adapter in communications module109. When used in a WAN networking environment, computing device101may include a modem in communications module109or other means for establishing communications over WAN129, such as Internet131or other type of computer network. The network connections shown are illustrative and other means of establishing a communications link between the computing devices may be used. Various well-known protocols such as transmission control protocol/Internet protocol (TCP/IP), Ethernet, file transfer protocol (FTP), hypertext transfer protocol (HTTP) and the like may be used, and the system can be operated in a client-server configuration to permit a user to retrieve web pages from a web-based server. Any of various conventional web browsers can be used to display and manipulate data on web pages.

The disclosure is operational with numerous other general purpose or special purpose computing system environments or configurations. Examples of well-known computing systems, environments, and/or configurations that may be suitable for use with the disclosed embodiments include, but are not limited to, personal computers (PCs), server computers, hand-held or laptop devices, smart phones, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like.

FIG. 2depicts an illustrative block diagram of workstations and servers that may be used to implement the processes and functions of certain aspects of the present disclosure in accordance with one or more example embodiments. Referring toFIG. 2, illustrative system200may be used for implementing example embodiments according to the present disclosure. As illustrated, system200may include one or more workstation computers201. Workstation201may be, for example, a desktop computer, a smartphone, a wireless device, a tablet computer, a laptop computer, and the like. Workstations201may be local or remote, and may be connected by one of communications links202to computer network203that is linked via communications link205to server204. In system200, server204may be any suitable server, processor, computer, or data processing device, or combination of the same. Server204may be used to process the instructions received from, and the transactions entered into by, one or more participants.

Computer network203may be any suitable computer network including the Internet, an intranet, a wide-area network (WAN), a local-area network (LAN), a wireless network, a digital subscriber line (DSL) network, a frame relay network, an asynchronous transfer mode (ATM) network, a virtual private network (VPN), or any combination of any of the same. Communications links202and205may be any communications links suitable for communicating between workstations201and server204, such as network links, dial-up links, wireless links, hard-wired links, as well as network types developed in the future, and the like.

FIG. 3depicts an illustrative computing environment for providing dynamic risk evaluation for proposed information technology projects in accordance with one or more example embodiments. Referring toFIG. 3, computing environment300may include one or more computing devices associated with an organization (e.g., a financial institution). For example, computing environment300may include computing devices302,304,306, and308. Computing device302,304,306, and/or308may be any type of computing device capable of receiving a user interface, receiving input via the user interface, and communicating the received input to one or more other computing devices. For example, computing device302,304,306, and/or308may be a desktop computer, laptop computer, tablet computer, smart phone, or the like. Computing environment300may also include computing platform310and network312. Network312may interconnect one or more of computing devices302,304,306,308, and/or computing platform310. Network312may include one or more sub-networks (e.g., LANs, WANs, or the like).

Computing platform310may include one or more processor(s)314, memory316, communication interface318, and data bus320. Data bus320may interconnect processor(s)314, memory316, and/or communication interface318. Communication interface318may be a network interface configured to support communication between computing platform310and network312, or one or more sub-networks thereof. Memory316may include one or more program modules comprising instructions that when executed by processor(s)314cause computing platform310to perform one or more functions described herein. For example, memory316may include proposed information technology project risk assessment module322. As will be described in greater detail below, proposed information technology project risk assessment module322may comprise instructions that when executed by processor(s)314cause computing platform310to generate a user interface comprising a plurality of questions regarding a proposed information technology project. The instructions may further cause computing platform310to communicate the user interface comprising the plurality of questions regarding the proposed information technology project to a computing device (e.g., to computing device302via communication interface318). Computing platform310may receive a plurality of responses input via the user interface comprising the plurality of questions regarding the proposed information technology project from the computing device (e.g., from computing device302via communication interface318). Each of the plurality of responses input via the user interface comprising the plurality of questions regarding the proposed information technology project may correspond to one or more of the plurality of questions regarding the proposed information technology project. The instructions may cause computing platform310to calculate an initial risk assessment score for the proposed information technology project based on the plurality of responses input via the user interface comprising the plurality of questions regarding the proposed information technology project. The instructions may further cause computing platform310to make a determination as to whether the initial risk assessment score for the proposed information technology project meets a predetermined threshold.

Responsive to computing platform310determining that the initial risk assessment score for the proposed information technology project does not meet the predetermined threshold, the instructions may cause computing platform310to generate a risk assessment summary report indicating that the initial risk assessment score for the proposed information technology project does not meet the predetermined threshold. In some embodiments, the risk assessment summary report may include a summary of the responses input via the user interface comprising the plurality of questions regarding the proposed information technology project. Computing platform310may communicate the risk assessment summary reporting indicating that the initial risk assessment score for the proposed information technology project does not meet the predetermined threshold to the computing device (e.g., to computing device302via communication interface318). In some embodiments, computing platform310may communicate the risk assessment summary reporting indicating that the initial risk assessment score for the proposed information technology project does not meet the predetermined threshold to one or more other computing devices (e.g., to computing device306and/or308via communication interface318).

Responsive to computing platform310determining that the initial risk assessment score for the proposed information technology project meets the predetermined threshold, the instructions may cause computing platform310to generate a user interface comprising a plurality of question sets. Each question set of the plurality of question sets may comprise one or more questions relating to a question of the plurality of questions regarding the proposed information technology project. Computing platform310may communicate the user interface comprising the plurality of question sets to a different computing device (e.g., to computing device306via communication interface318). Computing platform310may receive a plurality of responses input via the user interface comprising the plurality of question sets from the different computing device (e.g., from computing device306via communication interface318). Each of the plurality of responses input via the user interface comprising the plurality of question sets may correspond to a question of the plurality of question sets. The instructions may further cause computing platform310to calculate an adjusted risk assessment score for the proposed information technology project based on the plurality of responses input via the user interface comprising the plurality of question sets. For example, in some embodiments, the instructions may cause computing platform310to calculate the adjusted risk assessment score for the proposed information technology project by adjusting the initial risk assessment score for the proposed information technology project based on the plurality of responses input via the user interface comprising the plurality of question sets. In some embodiments, the instructions may cause computing platform310to generate an adjusted risk assessment summary report comprising the initial risk assessment score for the proposed information technology project and the adjusted risk assessment score for the proposed information technology project. Computing platform310may communicate the adjusted risk assessment summary report comprising the initial risk assessment score for the proposed information technology project and the adjusted risk assessment score for the proposed information technology project to the computing device (e.g., to computing device302via communication interface318) and/or the different computing device (e.g., to computing device306via communication interface318).

FIGS. 4A, 4B, 4C, and 4Ddepict an illustrative event sequence for providing dynamic risk evaluation for proposed information technology projects in accordance with one or more example embodiments. Referring toFIG. 4A, at step1, computing device302may communicate a request for a risk assessment for a proposed information technology project to computing platform310. For example, a user of computing device302may be a project manager of an organization associated with computing environment300(e.g., a financial institution) that is proposing or sponsoring a proposed information technology project and may desire and/or be required (e.g., pursuant a policy of the organization) to submit a risk assessment for the proposed information technology project. At step2, in response to receiving the request for the risk assessment for the proposed information technology project from computing device302, computing platform310may generate a user interface comprising a plurality of questions regarding the proposed information technology project. In some embodiments, the plurality of questions regarding the proposed information technology project may include at least one question regarding whether the proposed information technology project utilizes proprietary production data of a financial institution in an environment other than a production information technology environment of the financial institution. Additionally or alternatively, the plurality of questions regarding the proposed information technology project may include at least one question regarding whether the proposed information technology project involves storing data with a third-party, transmitting data to a third-party, or processing data by a third-party, whether the proposed information technology project involves creating or altering an Internet-facing application, whether the proposed information technology project involves acquisition of new hardware or software infrastructure, whether the proposed information technology project involves an exception request to a data loss prevention policy, and/or whether the proposed information technology project is being initiated as a result of a legal or regulatory compliance audit.

At step3, computing platform310may communicate the user interface comprising the plurality of questions regarding the proposed information technology project to computing device302. At step4, a user of computing device302may input or submit responses to one or more of the plurality of questions regarding the proposed information technology project via the user interface comprising the plurality of questions regarding the proposed information technology project. For example, the project manager of the organization that is proposing the information technology project may utilize computing device302to submit responses to one or more of the plurality of questions regarding the proposed information technology project via the user interface comprising the plurality of questions regarding the proposed information technology project (e.g., whether the proposed information technology project utilizes proprietary production data of a financial institution in an environment other than a production information technology environment of the financial institution, whether the proposed information technology project involves storing data with a third-party, transmitting data to a third-party, or processing data by a third-party, whether the proposed information technology project involves creating or altering an Internet-facing application, whether the proposed information technology project involves acquisition of new hardware or software infrastructure, whether the proposed information technology project involves an exception request to a data loss prevention policy, and/or whether the proposed information technology project is being initiated as a result of a legal or regulatory compliance audit). At step5, computing device302may communicate the submitted responses to computing platform310(e.g., via network312), which may receive them (e.g., via communication interface318).

At step6, computing platform310may calculate an initial risk assessment score for the proposed information technology project based on the responses submitted via the user interface comprising the plurality of questions regarding the proposed information technology project. In some embodiments, calculating the initial risk assessment score for the proposed information technology project may include selecting a plurality of risk values based on the plurality of responses input via the user interface comprising the plurality of questions regarding the proposed information technology project and summing the plurality of values. Each risk value of the plurality of risk values may correspond to a response of the plurality of responses input via the user interface comprising the plurality of questions regarding the proposed information technology project. For example, if a response indicates that the proposed information technology project utilizes proprietary production data of a financial institution in an environment other than a production information technology environment of the financial institution, a higher risk value may be selected than if the response indicates that the proposed information technology project does not utilize proprietary production data of a financial institution in an environment other than a production information technology environment of the financial institution.

Similarly, if a response indicates the proposed information technology project involves storing data with a third-party, transmitting data to a third-party, or processing data by a third-party, a higher risk value may be selected than if the response indicates that the proposed information technology project does not involve storing data with a third-party, transmitting data to a third-party, or processing data by a third-party; if a response indicates that the proposed information technology project involves creating or altering an Internet-facing application, a higher risk value may be selected than if the response indicates that the proposed information technology project does not involve creating or altering an Internet-facing application; if a response indicates that the proposed information technology project involves acquisition of new hardware or software infrastructure, a higher risk value may be selected than if the response indicates that the proposed information technology project does not involve acquisition of new hardware or software infrastructure; if a response indicates that the proposed information technology project involves an exception request to a data loss prevention policy, a higher risk value may be selected than if the response indicates that the proposed information technology project does not involve an exception request to a data loss prevention policy; and/or if a response indicates that the proposed information technology project is being initiated as a result of a legal or regulatory compliance audit, a higher risk value may be selected than if the response indicates that the proposed information technology project is not being initiated as a result of a legal or regulatory compliance audit.

Referring toFIG. 4B, at step7, computing platform310may make a determination as to whether the initial risk assessment score for the proposed information technology project meets a predetermined threshold. For example, computing platform310may be configured with a predetermined threshold initial risk assessment score. Computing platform310may compare the calculated initial risk assessment score for the proposed information technology project to the predetermined threshold initial risk assessment score and determine that the calculated initial risk assessment score for the proposed information technology project does not meet the predetermined threshold initial risk assessment score. At step8, responsive to determining that the initial risk assessment score for the proposed information technology project does not meet the predetermined threshold, computing platform310may generate a risk assessment summary report indicating that the initial risk assessment score for the proposed information technology project does not meet the predetermined threshold. In some embodiments, the risk assessment summary report may include the initial risk assessment score. Additionally or alternatively, the risk assessment summary report may include a summary of the responses input via the user interface comprising the plurality of questions regarding the proposed information technology project (e.g., whether the proposed information technology project utilizes proprietary production data of a financial institution in an environment other than a production information technology environment of the financial institution, whether the proposed information technology project involves storing data with a third-party, transmitting data to a third-party, or processing data by a third-party, whether the proposed information technology project involves creating or altering an Internet-facing application, whether the proposed information technology project involves acquisition of new hardware or software infrastructure, whether the proposed information technology project involves an exception request to a data loss prevention policy, and/or whether the proposed information technology project is being initiated as a result of a legal or regulatory compliance audit).

At step9, computing platform310may communicate the risk assessment summary report indicating that the initial risk assessment score for the proposed information technology project does not meet the predetermined threshold to computing device302(e.g., to the project manager of the organization that is proposing the information technology project). At step10, computing platform310may communicate the risk assessment summary report indicating that the initial risk assessment score for the proposed information technology project does not meet the predetermined threshold to computing device306. For example, computing device306may be associated with a risk analyst responsible for assessing risk for the proposed information technology project, and computing platform310may identify computing device306as being associated with the risk analyst responsible for assessing risk for the proposed information technology project, and communicate the risk assessment summary report indicating that the initial risk assessment score for the proposed information technology project does not meet the predetermined threshold to computing device306.

At step11, computing device304may communicate a request for a risk assessment for a proposed information technology project to computing platform310. For example, a user of computing device304may be a project manager of an organization associated with computing environment300(e.g., a financial institution) that is proposing or sponsoring a proposed information technology project and may desire and/or be required (e.g., pursuant a policy of the organization) to submit a risk assessment for the proposed information technology project. At step12, in response to receiving the request for the risk assessment for the proposed information technology project from computing device304, computing platform310may generate a user interface comprising a plurality of questions regarding the proposed information technology project. Referring toFIG. 4C, at step13, computing platform310may communicate the user interface comprising the plurality of questions regarding the proposed information technology project to computing device304. At step14, a user of computing device304may input or submit responses to one or more of the plurality of questions regarding the proposed information technology project via the user interface comprising the plurality of questions regarding the proposed information technology project. For example, the project manager of the organization that is proposing the information technology project may utilize computing device304to submit responses to one or more of the plurality of questions regarding the proposed information technology project via the user interface comprising the plurality of questions regarding the proposed information technology project.

As indicated above, the plurality of questions regarding the proposed information technology project may include one or more questions regarding whether the proposed information technology project utilizes proprietary production data of a financial institution in an environment other than a production information technology environment of the financial institution, whether the proposed information technology project involves storing data with a third-party, transmitting data to a third-party, or processing data by a third-party, whether the proposed information technology project involves creating or altering an Internet-facing application, whether the proposed information technology project involves acquisition of new hardware or software infrastructure, whether the proposed information technology project involves an exception request to a data loss prevention policy, and/or whether the proposed information technology project is being initiated as a result of a legal or regulatory compliance audit. Similarly, the responses submitted via the user interface may indicate whether the proposed information technology project utilizes proprietary production data of a financial institution in an environment other than a production information technology environment of the financial institution, whether the proposed information technology project involves storing data with a third-party, transmitting data to a third-party, or processing data by a third-party, whether the proposed information technology project involves creating or altering an Internet-facing application, whether the proposed information technology project involves acquisition of new hardware or software infrastructure, whether the proposed information technology project involves an exception request to a data loss prevention policy, and/or whether the proposed information technology project is being initiated as a result of a legal or regulatory compliance audit.

At step15, computing device304may communicate the submitted responses to computing platform310(e.g., via network312), which may receive them (e.g., via communication interface318). At step16, computing platform310may calculate an initial risk assessment score for the proposed information technology project based on the responses submitted via the user interface comprising the plurality of questions regarding the proposed information technology project. At step17, computing platform310may make a determination as to whether the initial risk assessment score for the proposed information technology project meets a predetermined threshold. For example, as indicated above, computing platform310may be configured with a predetermined threshold initial risk assessment score. Computing platform310may compare the calculated initial risk assessment score for the proposed information technology project to the predetermined threshold initial risk assessment score and determine that the calculated initial risk assessment score for the proposed information technology project meets the predetermined threshold initial risk assessment score. At step18, responsive to determining that the initial risk assessment score for the proposed information technology project meets the predetermined threshold, computing platform310may generate a user interface comprising a plurality of question sets. Each question set of the plurality of question sets may comprise one or more questions relating to a question of the plurality of questions regarding the proposed information technology project. For example, if one or more of the responses received from computing device304indicates that the proposed information technology project utilizes proprietary production data of a financial institution in an environment other than a production information technology environment of the financial institution, the plurality of question sets may include at least one question set comprising questions regarding the environment other than the production information technology environment of the financial institution (e.g., whether the proprietary production data of the financial institution will be obfuscated in the environment other than the production information technology environment of the financial institution, whether the environment other than the production information technology environment of the financial institution is hosted by the financial institution or an external supplier of the financial institution, and/or whether proprietary production data of the financial institution is already utilized in the environment other than the production information technology environment of the financial institution).

Similarly, if one or more of the responses received from computing device304indicates that the proposed information technology project involves storing data with a third-party, transmitting data to a third-party, or processing data by a third-party, the plurality of question sets may include at least one question set comprising questions regarding the third-party (e.g., whether the third-party is an existing or new supplier, whether vendor management is involved in procurement of products or services from the third-party, whether an assessment of the third-party has been performed, whether there are any outstanding assessment findings for the third-party, whether the third-party will leverage one or more suppliers to transmit, store, or process confidential data associated with the proposed information technology project, and/or whether a contract exists with the supplier that contains up-to-date security language); if one or more of the responses received from computing device304indicates that the proposed information technology project involves creating or altering an Internet-facing application, the plurality of question sets may include at least one question set comprising questions regarding the Internet-facing application (e.g., whether the Internet-facing application is an existing Internet-facing application or whether the Internet-facing application will be developed as part of the proposed information technology project, whether the Internet-facing application meets requirements of an application development standard of the organization, whether the Internet-facing application was developed in-house or by an external supplier, what data elements will the Internet-facing application store, transmit, or process, and/or whether the Internet-facing application is a mobile application); if one or more of the responses received from computing device304indicates that the proposed information technology project involves acquisition of new hardware or software infrastructure, the plurality of question sets may include at least one question set comprising questions regarding the new hardware or software infrastructure (e.g., whether the new hardware or software has been previously classified by the organization, whether the new hardware or software is classified as declining or emerging, whether the new hardware or software is classified as not permitted within the organization, and/or whether the new hardware or software is classified as exempt from one or more risk assessment policies of the organization); if one or more of the responses received from computing device304indicates that the proposed information technology project involves an exception request to a data loss prevention policy, the plurality of question sets may include at least one question set comprising questions regarding the exception request to the data loss prevention policy; and/or if one or more of the responses received from computing device304indicates that the proposed information technology project is being initiated as a result of a legal or regulatory compliance audit, the plurality of question sets may include at least one question set comprising questions regarding the legal or regulatory compliance audit.

In some embodiments, the user interface comprising the plurality of question sets may include at least one link to a policy document associated with one or more questions of a question set of the plurality of question sets. For example, if one or more of the responses received from computing device304indicates that the proposed information technology project involves creating or altering an Internet-facing application, the user interface comprising the plurality of question sets may include at least one link to a policy document associated with an application development standard of the organization.

Referring toFIG. 4D, at step19, computing platform310may communicate the user interface comprising the plurality of question sets to computing device308. For example, computing device308may be associated with a risk analyst responsible for assessing risk for the proposed information technology project, and computing platform310may identify computing device308as being associated with the risk analyst responsible for assessing risk for the proposed information technology project, and communicate the user interface comprising the plurality of question sets to computing device308. At step20, a user of computing device308may input or submit responses to one or more questions of the plurality of question sets via the user interface comprising the plurality of question sets. For example, the risk analyst responsible for assessing risk for the proposed information technology project may utilize computing device308to submit responses to one or more questions of the plurality of question sets via the user interface comprising the plurality of question sets (e.g., if the question sets include a question set comprising questions regarding the Internet-facing application, whether the Internet-facing application is an existing Internet-facing application or whether the Internet-facing application will be developed as part of the proposed information technology project, whether the Internet-facing application meets requirements of an application development standard of the organization, whether the Internet-facing application was developed in-house or by an external supplier, what data elements will the Internet-facing application store, transmit, or process, and/or whether the Internet-facing application is a mobile application).

As indicated above, in some embodiments, the user interface comprising the plurality of question sets may include at least one link to a policy document associated with one or more questions of a question set of the plurality of question sets. For example, if one or more of the responses received from computing device304indicates that the proposed information technology project involves creating or altering an Internet-facing application, the user interface comprising the plurality of question sets may include at least one link to a policy document associated with an application development standard of the organization. In such embodiments, responsive to the at least one link to the policy document associated with the one or more questions of the question set of the plurality of question sets being invoked, at least one of the one or more questions of the question set of the plurality of question sets and at least a portion of the policy document associated with the at least one of the one or more questions of the question set of the plurality of question sets may be contemporaneously displayed. For example, if a user of computing device308(e.g., the risk analyst responsible for assessing risk for the proposed information technology project) invokes the at least one link to the policy document associated with the application development standard of the organization, computing device308may contemporaneously display at least a portion of the policy document associated with the application development standard of the organization and at least one of the one or more questions of the question set of the plurality of question sets (e.g., whether the Internet-facing application meets requirements of the application development standard of the organization).

At step21, computing device308may communicate the submitted responses to computing platform310(e.g., via network312), which may receive them (e.g., via communication interface318). At step22, computing platform310may calculate an adjusted risk assessment score for the proposed information technology project based on the plurality of responses input via the user interface comprising the plurality of question sets (e.g., the responses received from computing device308). Computing device308may calculate the adjusted risk assessment score for the proposed information technology project by adjusting the initial risk assessment score for the proposed information technology project based on the plurality of responses input via the user interface comprising the plurality of question sets. In some embodiments, adjusting the initial risk assessment score for the proposed information technology project based on the plurality of responses input via the user interface comprising the plurality of question sets may include selecting a plurality of risk adjustment values based on the plurality of responses input via the user interface comprising the plurality of question sets and reducing the initial risk assessment score for the proposed information technology project by the plurality of risk adjustment values. For example, each potential response to a question of a question set of the plurality of question sets may be associated with a risk adjustment value, which may be selected based on the response selected for the question (e.g., by the risk analyst responsible for assessing risk for the proposed information technology project). The initial risk assessment score for the proposed information technology project may then be reduced by the selected risk adjustment values.

At step23, computing platform310may generate an adjusted risk assessment summary report. The adjusted risk assessment summary report may include the initial risk assessment score for the proposed information technology project and the adjusted risk assessment score for the proposed information technology project. At step24, computing platform310may communicate the adjusted risk assessment summary report to computing device304(e.g., to the project manager of the organization that is proposing the information technology project). At step25, computing platform310may communicate the adjusted risk assessment summary report to computing device308(e.g., the risk analyst responsible for assessing risk for the proposed information technology project).

FIG. 5depicts an illustrative method for providing dynamic risk evaluation for proposed information technology projects in accordance with one or more example embodiments. Referring toFIG. 5, at step502, a user interface comprising a plurality of questions regarding a proposed information technology project may be generated. For example, computing platform310may generate a user interface comprising a plurality of questions regarding an information technology project proposed by the project manager utilizing computing device302. At step504, the user interface comprising the plurality of questions regarding the proposed information technology project may be communicated to a computing device. For example, computing platform310may communicate the user interface comprising the plurality of questions regarding the information technology project proposed by the project manager utilizing computing device302to computing device302. At step506, a plurality of responses input via the user interface comprising the plurality of questions regarding the proposed information technology project may be received from the computing device. For example, computing platform310may receive a plurality of responses input via the user interface comprising the plurality of questions regarding the information technology project proposed by the project manager utilizing computing device302from computing device302. At step508, an initial risk assessment score for the proposed information technology project may be calculated based on the plurality of responses input via the user interface comprising the plurality of questions regarding the proposed information technology project. For example, computing platform310may calculate an initial risk assessment score for the information technology project proposed by the project manager utilizing computing device302based on the plurality of responses received from computing device302.

At step510, a determination may be made as to whether the initial risk assessment score for the proposed information technology project meets a predetermined threshold. For example, computing platform310may determine that the initial risk assessment score for the information technology project proposed by the project manager utilizing computing device302does not meet the predetermined threshold. At step512, responsive to determining that the initial risk assessment score for the proposed information technology project does not meet the predetermined threshold, a risk assessment summary report indicating that the initial risk assessment score for the proposed information technology project does not meet the predetermined threshold and comprising a summary of the responses input via the user interface comprising the plurality of questions regarding the proposed information technology project may be generated. For example, responsive to determining that the initial risk assessment score for the information technology project proposed by the project manager utilizing computing device302does not meet the predetermined threshold, computing platform310may generate a risk assessment summary report indicating that the initial risk assessment score for the information technology project proposed by the project manager utilizing computing device302does not meet the predetermined threshold. The risk assessment summary report may include a summary of the plurality of responses received from computing device302. At step514, the risk assessment summary reporting indicating that the initial risk assessment score for the proposed information technology project does not meet the predetermined threshold and comprising the summary of the responses input via the user interface comprising the plurality of questions regarding the proposed information technology project may be communicated to the computing device. For example, computing platform310may communicate the risk assessment summary report indicating that the initial risk assessment score for the information technology project proposed by the project manager utilizing computing device302does not meet the predetermined threshold to computing device302.

Returning to step510, responsive to determining that the initial risk assessment score for the proposed information technology project meets the predetermined threshold, at step516, a user interface comprising a plurality of question sets may be generated. For example, computing platform310may determine that the initial risk assessment score for the information technology project proposed by the project manager utilizing computing device304meets the predetermined threshold, and, responsive to determining that the initial risk assessment score for the information technology project proposed by the project manager utilizing computing device304meets the predetermined threshold, computing platform310may generate a user interface comprising a plurality of question sets. At step518, the user interface comprising the plurality of question sets may be communicated to a different computing device. For example, computing platform310may communicate the user interface comprising the plurality of question sets to computing device308. At step520, a plurality of responses input via the user interface comprising the plurality of question sets may be received from the different computing device. For example, computing platform310may receive a plurality of responses input via the user interface comprising the plurality of question sets (e.g., by the risk analyst responsible for assessing risk for the information technology project proposed by the project manager utilizing computing device304) from computing device308. At step522, an adjusted risk assessment score for the proposed information technology project may be calculated based on the plurality of responses input via the user interface comprising the plurality of question sets. For example, computing platform310may calculate an adjusted risk assessment score for the information technology project proposed by the project manager utilizing computing device304based on the plurality of responses received from computing device308.

As described herein, the various methods and acts may be operative across one or more computing servers and one or more networks. The functionality may be distributed in any manner, or may be located in a single computing device (e.g., a server, a client computer, and the like).