Patent ID: 8255881

Claim:
A computer-implemented method for certifying software based on composite risk, the method comprising: receiving information for a plurality of risk factors associated with the software, wherein the information includes a timeline for each risk factor, the timeline including a plurality of discrete time points, and the plurality of risk factors include two or more of a software development life-cycle risk factor, an operating system release risk factor, a hardware change risk factor, and an infrastructure change risk factor; determining risk values indicative of risk levels of each risk factor associated with the plurality of discrete time points; calculating, using at least one computer processor, a composite risk based on the plurality of risk factors and using the determined risk values and a relationship between the composite risk and the plurality of risk factors, wherein the composite risk includes a plurality of composite risk values associated with the plurality of discrete time points; and identifying a recommended software certification time, the recommended software certification time corresponding to a lowest value of the calculated composite risk.