Patent ID: 8196207

Claim:
A control automation method for assisting an organization comprising one or more users with managing one or more controls for mitigating one or more risks or threats and managing one or more metrics corresponding to the one or more controls, the one or more metrics for providing quantitative and repeatable processes for use in determining an effectiveness of the one or more controls, the control automation method comprising: using a computer processor to execute computer program code instructions stored in a non-transitory computer-readable medium, wherein the computer program code instructions are structured to cause the computer processor to: receive, from the user, and store one or more control profiles each comprising a plurality of parameters defining the one or more controls, wherein at least one of said plurality of parameters is selected from a group consisting of correlated control information, correlated metric information, security level information, effectiveness calculation algorithm information, effectiveness calculation results information, and effectiveness calculation criteria information; receive, from the user, and store one or more metric profiles each comprising a plurality of parameters defining the one or more metrics, wherein at least one of said plurality of parameters is selected from a group consisting of a unit of measure, a frequency of reporting, a type of metric, a relevance of the metric to one or more controls, and a threshold level for evaluating progress toward a goal of the metric; receive user input choosing one or more of the metrics for association with the one or more controls; map the metrics chosen by the user to the one or more controls, such that the metrics chosen by the user become associated with the one or more controls and can provide quantitative and repeatable process data for use in determining the effectiveness of the one or more controls; receive and store one or more metric values corresponding to the one or more metrics; and provide information corresponding to the one or more metric values to the user for assisting the user in determining the effectiveness of the one or more controls.