Compliance as a service for an organization

The present disclosure relates to system(s) and method(s) to provide compliance as a service for one or more organization. The system further facilitates identifying one or more causes involved to provide compliance as a service by analyzing compliance documents. The system and method also provides conversion of clauses into appropriate controls. The system and method also assists in defining control that can perform a specific task on a system. The system and method further provides mapping of compliance using control.

CROSS-REFERENCE TO RELATED APPLICATIONS AND PRIORITY

The present application claims priority to Indian Patent Application No. 3245/MUM/2013, filed on Oct. 15, 2013, the entirety of which is hereby incorporated by reference.

TECHNICAL FIELD

The present disclosure in general relates to a field of compliance services. More particularly, the present invention relates to a system and method to provide automated compliance audit services for Information Technology (IT) enabled organizations dealing in one or more IT related services.

BACKGROUND

With the automation and strategic involvement of Information Technology (IT) in day to day operations, demand for IT compliance has increased marginally. While delivering services to clients, an organization is bound to meet several technical and legal obligations associated with the IT compliance. There are several compliance rules and regulations that need to be met by an organization. These rules and regulations may be imposed by government bodies and may also include requirements with respect to a customer's need and demand. These compliance rules and regulation are not only important and necessary, but they also affect overall operations of the organization. In order to comply with these compliance rules and regulations, organizations set their own internal policies in line with the rules and regulations set by the government.

Organizations have to enforce these compliances rules and regulations with stringent processes and at appropriate frequency generate compliance reports and evidences to justify its compliant business process and operations.

Also, the IT components that are people dependent are also under the compliance umbrella. Further, all the IT enabled sectors and organizations are bound to meet the standard compliance at each stages of a service life cycle such as Design, Build, Migrate, Operate, Improve, and Govern. Further, in order to meet the applicable standards, IT organizations need to individually analyze each and every compliance requirement. These requirements may vary from organization to organization based on the elements and profiles of the organization. As a result each compliance rule needs to be individually analysed and accordingly modelled to check the compliance of the IT organizations. The architecture of existing compliance auditors102is disclosed inFIG. 1. The organizations may provide different services to different IT organizations for instance organization A, organization B, organization C and organization D. As represented inFIG. 1, the compliance auditor102is bound to provide customized services X, Y, and Z to organization A, B, and C respectively since the each of these organizations is linked with a different set of IT systems. Further, the services may vary with the variation in a business vertical104and business process implementation106.

Hence, several challenges are faced by the current solutions due to diverse compliance requirements, frequent updates and complex interpretations. Also, there is lack of systematic approach to check correctness and completeness of compliance checking process.

SUMMARY

This summary is provided to introduce aspects related to systems and methods for determining compliance of an information technology organization and the aspects are further described below in the detailed description. This summary is not intended to identify essential features of the claimed subject matter nor is it intended for use in determining or limiting the scope of the claimed subject matter.

In one embodiment, a method to determine a compliance of a target system with respect to a set of rules and regulations stored in a compliance document is disclosed. Initially, the compliance document is parsed to determine a set of clauses present in the compliance document. In the next step, attributes associated with each clause from the compliance document are identified. Based on these attributes, a first set of controls is generated from the set of clauses. Each control is stored in the form of a standard template. Once the controls are generated, the target system is remotely analysed to identify a second set of controls from the first set of controls based on at least one element associated with the target system. In the next step, the second set of controls are calibrated based on a profiles associated with each element of the target system and a set of industrial standards applicable to the profile. In the next step, a configuration file of the target system is compared with the second set of controls so calibrated to determine the compliance of the target system with respect to the industrial standards associated with each clause.

In one embodiment, a system comprising a memory and a processor configured to determine a compliance of a target system with respect to a set of rules and regulations stored in a compliance document is disclosed. Initially, the compliance document is parsed to determine a set of clauses present in the compliance document. In the next step, attributes associated with each clause from the compliance document are identified. Based on these attributes, a first set of controls is generated from the set of clauses. Each control is stored in the form of a standard template. Once the controls are generated, the target system is remotely analysed to identify a second set of controls from the first set of controls based on at least one element associated with the target system. In the next step, the second set of controls are calibrated based on a profiles associated with each element of the target system and a set of industrial standards applicable to the profile. In the next step, a configuration file of the target system is compared with the second set of controls so calibrated to determine the compliance of the target system with respect to the industrial standards associated with each clause.

In one embodiment, a computer program product having embodied computer program to determine a compliance of a target system is disclosed. The computer program product comprising a program code for parsing a compliance document to determine a set of clauses present in the compliance document and a program code for identifying a plurality of attributes associated with each clause. The computer program product further comprises a program code for generating first set controls from the set of clauses based upon the plurality of attributes. Further, computer program product comprises a program code for remotely analysing the target system to identify a second set of controls applicable to the target system based on an element associated with the target system, wherein the second set of controls is a subset of the first set of controls. The computer program product further comprises a program code for calibrating the second set of controls based on a profile associated with the element and a set of industrial standards applicable to the profile. The computer program product further comprises a program code for comparing a configuration of the target system with the second set of controls so calibrated to determine the compliance of the target system.

DETAILED DESCRIPTION

The present subject matter discloses an effective and efficient compliance auditing system and method for determining whether a target system is compliant with the applicable rules and regulation. The compliance auditing system also determines whether the target system is compliant to a set of internal policies associated with the target system. To determine the compliance of the target system, initially, the rules and regulations set by a government are identified in the form of clauses by analysing compliance documents that store the compliance rules and regulations in text format. The clauses define a set of attributes that need to be checked in the target system. The clauses in the compliance documents also define the industrial standards that need to be mapped against the attributes to determine whether the target system is compliant as per the set industrial standards.

In one example, the identified clauses are parsed by the compliance auditing system in order to extract the attributes present in each clause. In the next step the attributes are stored in a standard template referred as control. The control is user as a basic unit of checking the compliance of the target system. Further, the target system is analysed to determine elements present in the target system. In the next step, the controls that are applicable to the elements of the target system are identified.

Subsequently, the profile of each element in the target system is identified by the compliance auditing system. The profile information is used to calibrate the controls to suit the environment of the target system. These calibrated controls are then compared with the configuration of the target system to determine whether the target system is compliant with the rules and regulation of the target system. The controls may be reused for multiple target systems by fine-tuning the controls based on the profiles associated with different elements at different target systems.

While aspects of described system and method for determining compliance of a target system, the described system and method may be implemented in any number of different computing systems, environments, and/or configurations, the embodiments are described in the context of the following exemplary system.

Referring now toFIG. 2, a network implementation200of a Compliance auditing system202to determine compliance of the target system208to the set of rules and regulations is illustrated, in accordance with an embodiment of the present subject matter. In one embodiment, the Compliance auditing system202enables extracting clauses from compliance documents, wherein the clauses define the compliance rules and regulations. In one example, the identified clauses are parsed to extract attributes, these attributes are then stored in a control. The control is a standard template that stores attributes specified by the corresponding clause.

Further, the target system208is analysed to determine elements present in the target system208. In the next step, the controls that are applicable to the elements of the target system208are also identified. Subsequently, the profile of each element in the target system208is identified. This profile information is used to calibrate the controls to suit the environment of the target system208. The controls are then compared with the configuration of the target system208to determine whether the target system208is compliant with the rules and regulation applicable to the target system208.

Although the present subject matter is explained considering that the Compliance auditing system202is implemented on a server, it may be understood that the Compliance auditing system202may also be implemented in a variety of computing systems, such as a laptop computer, a desktop computer, a notebook, a workstation, a mainframe computer, a server, a network server, and the like. In one implementation, the Compliance auditing system202may be implemented in a cloud-based environment. It will be understood that the Compliance auditing system202may be accessed by multiple users through one or more user devices204-1,204-2. . .204-N, collectively referred to as user devices204hereinafter, or applications residing on the user devices204. Examples of the user devices204may include, but are not limited to, a portable computer, a personal digital assistant, a handheld device, and a workstation. The user devices104are communicatively coupled to the Compliance auditing system202through a network206. Further the target system208may be connected to the compliance auditing system202through the network206.

Referring now toFIG. 3, the Compliance auditing system202is illustrated in accordance with an embodiment of the present subject matter. In one embodiment, the Compliance auditing system202may include at least one processor302, an input/output (I/O) interface304, and a memory306. The at least one processor302may be implemented as one or more microprocessors, microcomputers, microcontrollers, digital signal processors, central processing units, state machines, logic circuitries, and/or any devices that manipulate signals based on operational instructions. Among other capabilities, the at least one processor302is configured to fetch and execute computer-readable instructions stored in the memory306.

The I/O interface304may include a variety of software and hardware interfaces, for example, a web interface, a graphical user interface, and the like. The I/O interface304may allow the Compliance auditing system202to interact with a user directly or through the client devices204. Further, the I/O interface304may enable the Compliance auditing system202to communicate with other computing devices, such as web servers and external data servers (not shown). The I/O interface304can facilitate multiple communications within a wide variety of networks and protocol types, including wired networks, for example, LAN, cable, etc., and wireless networks, such as WLAN, cellular, or satellite. The I/O interface304may include one or more ports for connecting a number of devices to one another or to another server.

The memory306may include any computer-readable medium known in the art including, for example, volatile memory, such as static random access memory (SRAM) and dynamic random access memory (DRAM), and/or non-volatile memory, such as read only memory (ROM), erasable programmable ROM, flash memories, hard disks, optical disks, and magnetic tapes. The memory306may include modules308and data310.

The modules308include routines, programs, objects, components, data structures, etc., which perform particular tasks, functions or implement particular abstract data types. In one implementation, the modules308may include a document analysis module312, a target system analysis module314, a control execution module316, and other modules318. The other modules318may include programs or coded instructions that supplement applications and functions of the compliance auditing system202.

The data310, amongst other things, serves as a repository for storing data processed, received, and generated by one or more of the modules308. The data310may also include compliance documents322, a system database324, a control repository326, and other data328. The other data328may include data generated as a result of the execution of one or more modules in the other module318.

In one implementation, at first, a user may use the client device204to access the Compliance auditing system202via the I/O interface304. The users may register themselves using the I/O interface304in order to use the Compliance auditing system202. The working of the Compliance auditing system202may be explained in detail inFIGS. 4 to 7explained below. The Compliance auditing system202may be used for dynamically determining compliance level of the target system208. In order to determine compliance level of the target system208, the Compliance auditing system202, at first, determines the rules and regulations applicable to the IT organization by analysing a plurality of compliance documents322. The compliance document may summarize well known compliance rules and regulations such as the Sarbanes-Oxley Act (SOX), the Health Insurance Portability and Accountability Act (HIPAA), BASEL III, and Payment Card Industry Data Security Standard (PCI-DSS) set by the government. The compliance documents322may also include internal policies set by the target system208as well as a plurality of other IT organizations for which the target system208provides different service. In one of the present implementation, the compliance documents322are analysed by a document analysis module312.

At block402, the compliance document322may be parsed to determine clauses present in the compliance document322. In one embodiment, the compliance documents322including PCI-DSS, HIPPA, and SOX as well as internal policies associate with the target system208.

At block404, a plurality of attributes associated with the clauses are identified, these attributes may include a compulsory pattern, a optional pattern, a citation, a control pre-requisite, a risk level, a control type and the profile applicability.

At block406, first set controls are generated from the clauses based upon the plurality of attributes that are associated with the clauses402. In one embodiment, the first set of controls may be stored in Excel or XML document format.

In one embodiment, the document analysis module312may perform the steps of blocks402,404and406. The working of the document analysis module312is further explained inFIG. 5.

At block408, the target system208is remotely analysed to identify the elements associated with the target system208. Based on the elements, a second set of controls are identified from the first set of controls. The second set of controls is a collection of controls that are applicable to elements associated with the target system208

At block410, the second set of controls is calibrated based on profiles associated with the element and a set of industrial standards applicable to the profiles associated with the elements.

In one embodiment, the target system analysis module314may be configured to perform the steps of blocks408and410. The working of the target system analysis module314is further explained inFIG. 6.

At block412, the configuration files of the target system208is compared with the second set of controls so calibrated to determine the compliance of each element of the target system208. In one embodiment, the compliance determination module316may be configured to perform the steps of block412. The working of the compliance determination module316is further explained inFIG. 7.

Document Analysis Module

Referring toFIG. 5, a flowchart representing detailed working of the document analysis module312along with the working of other components of the compliance auditing system202for converting the clauses into first set of controls is illustrated, in accordance with an embodiment of the present subject matter.

At step502, in one implementation, in order to extract clauses from the compliance documents322, the document analysis module312may, at first, perform natural language processing on the compliance documents322and extract all the clauses present in the compliance documents322. In one embodiment, the clauses may be classified as a simple clause, a complex clause, a citation specific clause, and a composite clause. A simple clause may define only a compulsory pattern to be checked to identify the compliance of the target system208. Further, the complex clause may define the compulsory pattern as well as an optional pattern to identify the compliance of the target system208. Further, the citation specific clause may define a specified pattern to be checked in specific citation for determining compliance of the target system208. Further the composite clause may define pre-requisites to be checked in the citation in order to determine compliance of the target system208.

At step504, once the clauses are identified, a parsing technique is used by the document analysis module312to identify attributes and associated conditions present in each clause. The attributes define a set of conditions that need to be followed in order to comply with the rules and regulation present in the compliance documents322. In one embodiment the attributes may include a compulsory pattern, an optional pattern, a citation, a control pre-requisite, a risk level, a control type, and the profile applicability.

At step506, for each clause, a control is generated by the document analysis module312. The control is a standard template storing all the attributes associated with the corresponding clause. All the controls associated with the clauses are then stored in the control repository326in the form of a first set of controls. The first set of controls represents all the clauses that are present in the compliance documents322.

However, all the first set of controls may not be applicable to the target system208whose compliance level is to be determined. The target system analysis module314determines controls form the first set of controls, applicable to the target system208. These applicable control are identified by the target system analysis module314based on the elements that are present in the target system208.

Target System Analysis Module

FIG. 6illustrates a flowchart representing detailed working of the target system analysis module314along with the working of other components of the compliance auditing system202for identifying controls from the first set of controls that are applicable to the target system208based on the elements associated with the target system208. The controls that are applicable to the target system208are hereafter referred to as second set of controls.

At step602, in order to identify the second set of controls, the target system analysis module314identifies the elements that are associated with the target system208. The elements that are associated with the target system208may include a network layer, an applications layer, an operating system, a database, and middleware. Additionally the elements may also include a data centre, a cloud environment, applications, communication protocols, load balancers, virtual machines, a storage space, firewalls, a Network Attached Storage (NAS), a Storage Attached Networks (SAN), a server, and network devices. In one embodiment, based on the requirement of the compliance coverage to be provided, a single element associated with the target system208may be identified for compliance level checking.

At step604, the target system analysis module314traverses through each control from the first set controls and determines whether the control is applicable to at least one element of the target system208. All the controls that are identified as applicable to the elements of the target system208are stored in the control repository as second set of controls.

At step606, profiles associated with elements are also identified from the target system analysis module314. The profiles associated with the elements may include security, element management, monitor and logs, version and path management, as well as authentication and authorization. The identified profiles are used to calibrate the second set of controls, before testing the target system208for determining compliance level of the target system208.

The process of checking the compliance level of the target system208using the second set of controls so calibrated is performed by the compliance determination module316. The working of the compliance determination module is explained with respect toFIG. 7.

Compliance Determination Module

FIG. 7, illustrates a flowchart representing detailed working of the compliance determination module316along with the working of other components of the compliance auditing system202for checking the compliance level of the target system208using the second set of controls so calibrated.

At step702, in one embodiment, the compliance determination module316extracts configuration files from the target system208. The configurations files store critical information of all the elements present in the target system208.

At step704, the compliance determination module316compares the configuration files with the second set of controls so calibrated to identify whether the configuration of each element in the configuration file is as per the configuration specified by the corresponding control from the second set of controls. In one embodiment, a control from the second set of controls may be checked for a particular citation in the configuration file of the target system208, the control may specify a citation start and a citation end in between which the control needs to be checked. The citation start and the citation end define a boundary for checking a compulsory pattern based upon the configuration of the target system208.

In one embodiment, the results of the comparison are then processed by a compliance report generator. The compliance report generator generates detailed compliance reports summarizing the details of the elements that are compliant and non-compliant to the rules and regulations specified by the compliance documents322.

Working Example

One of the clause in the compliance document states that “At the network layer the LAN manager authentication level must be set to:

1. Send NTLMv2 response only if the server is acting as operating system server

2. Send NTLMv2 response only and refuse LM & NTLM if the server is acting as a Domain Controller.

3. Other than send LM & NTLM responses use NTLMv2 session security if negotiated, if the server is acting as a web server.”

The clause is converted into a control A

Initially the compliance auditing system identifies a server as the elements associated with the target system. In the next step, the profile of the server is identified as member server. Based on the profile of the server, the compliance auditing system calibrates the control A as “If (the LAN manager authentication level==Other than Send LM & NTLM responses use NTLMv2 session security) pass, else fail”

The Exemplary embodiments discussed above may provide certain advantages. Though not required to practice aspects of the disclosure, these advantages may include those provided by the following features.

Some embodiments enable a system and a method to provide a systematic approach to check correctness and completeness of compliance checking process for the target system.

Some embodiments enable the system and the method that can cover compliance rules and regulations applicable to different elements of the target system using a single standard template.

Some embodiments enable the system and the method for updating the compliance auditing system with new rules and regulations.

Some embodiments enable the system and the method for meeting diverse compliance requirements across different business verticals.

Although implementations for methods and systems to determine compliance level of a target system have been described in language specific to structural features and/or methods, it is to be understood that the appended claims are not necessarily limited to the specific features or methods described. Rather, the specific features and methods are disclosed as examples of implementations for determination of compliance level of the target system.