Patent ID: 8726393

Claim:
A method for determining a cyber-security risk profile key, comprising: determining, by an automated processing device tool, question key performance indicator values from values assigned to answers to each of a plurality of questions presented to personnel in an organization implementing an automated system, wherein the answers are chosen from a group of two or more possible answers presented to the personnel with each of the questions, and each of the answers for each of the questions is assigned a different answer point value, and wherein the questions are each relevant to and belong to one of a plurality of subset category areas of an overall procedures and protocol domain area of cyber-security; combining, by the automated processing device tool, the question key performance indicator values of the individual questions in each subset category area into separate composite question key performance indicator values for each of the subset category areas; combining, by the automated processing device tool, the separate composite question key performance indicator values into an overall composite procedures and protocol key performance indicator value for the automated system; collecting, by the automated processing device tool, group security policy data with respect to each of a plurality of individual computers in the automated system, wherein the collected security policy data comprises system-wide policy information and system settings of the automated system; processing, by the automated processing device tool, the collected security policy data to determine and select a predefined security policy statement for each of a plurality of different security policy attributes of the automated system as a function of compliance of the collected security policy data with a specific set of recommended security policy settings compatible with each of the individual computers in the automated system, wherein each selected security policy statement is chosen from a group of two or more possible statements determinable by the automated processing device tool for each of the different security policy attributes, and wherein each of the security policy statements is assigned a different policy point value; determining, via the automated processing device tool, security policy attribute key performance indicator values for each of the security policy attributes from the policy point values assigned to the selected statements for the security policy attributes; combining, by the automated processing device tool, the security policy attribute key performance indicator values into an overall composite security policy key performance indicator value for the automated system; and generating, by the automated processing device tool, a cyber security risk profile key diagram that displays a level of cyber security risk represented by the composite procedures and protocol key performance indicator value relative to a level of cyber security risk represented by the composite security policy key performance indicator value.