Patent ID: 8478628

Claim:
A method implemented using a computer having a processor and a database to assess compliance risks associated with a set of policies and standards of an organization, the method comprising: a. receiving mapping of compliance data comprising References, Standards, Controls, and Assets, wherein Standards are mapped to References, Controls are mapped to Standards, and Assets are mapped to Controls; b. receiving a first set of weights associated with References, which are mapped to Standards, and a second set of weights associated with the Controls, which are mapped to Standards and Assets; c. receiving a third set of weights associated with the Standards to be assessed, wherein the Standards are the set of policies and standards of an organization to be assessed; d. the processor receiving and storing in the database assessment scores of the Standards to be assessed based on their actual status; e. the processor retrieving the stored assessment scores of the Standards from the database and calculating a set of risk-based indices associated with the retrieved assessment scores of the Standards; and f. the processor calculating a set of asset assessment indices associated with the assessment scores of the Standards, wherein the set of risk-based indices comprises a standard impact index and a query risk index, whereby for each assessed Standard, a. the standard impact index is calculated as the sum of the first set of weights mapped to the Standard plus the sum of the second set of weights mapped to the Standard, and b. the query risk index is calculated as the third weight associated with the Standard multiplied by the standard impact index of the Standard.