Information processing system, information processing method, and program

Abstract

To provide an information processing system or the like capable of efficiently acquiring information for evaluation.SOLUTION: According to an aspect of the present invention, there is provided an information processing system including at least one processor, wherein the processor is configured to execute the following steps by reading a program, and in an answer information registration step, an input form for receiving an input for each answer element from a service provider is displayed, and answer information including a plurality of input answer elements is registered as an answer to one question item in evaluation information regarding security of a service provided by the service provider, in the review reception step, a review for the registered answer information is received from a reviewer, and in the answer information registration step, a display form of the input form is changed according to a registration status or a review status of the answer information.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an information processing system, an information processing method, and a program. [Background technology]

[0002] Patent Document 1 describes a technique for collecting answers to a question by presenting answer choices to the respondent. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2005-4273 Summary of the Invention [Problem to be solved by the invention]

[0004] Here, there are cases where the respondent is asked to input more detailed information, such as when the collected answers are used as evaluation information for evaluation.

[0005] In view of the above circumstances, the present invention provides an information processing system and the like that can efficiently acquire evaluation information. [Means for solving the problem]

[0006] According to one aspect of the present invention, there is provided an information processing system comprising at least one processor, the processor being configured to execute each of the following steps by reading a program, wherein in an answer information registration step, an input form is displayed that accepts input for each answer element from a service provider, and answer information consisting of the entered multiple answer elements is registered as an answer to one question in evaluation information regarding the security of a service provided by the service provider, in a review reception step, reviews of the registered answer information are accepted from reviewers, and in the answer information registration step, the display format of the input form is changed depending on the registration status or review status of the answer information.

[0007] According to this aspect, the service provider (respondent) can input answer information for each item, which reduces the chance of missing an item. Also, the registration status or review status of the answer information is reflected in the input form, which reduces duplicate input, unintentional overwriting, etc. As a result, evaluation information can be obtained efficiently. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a configuration diagram illustrating an information processing system 1. FIG. [Figure 2] 2 is a block diagram showing the hardware configuration of the server device 10 and the provider terminal 20. FIG. [Figure 3] FIG. 2 is a block diagram showing the hardware configuration of a reviewer terminal 30 and a user terminal 40. [Figure 4] 1 is a block diagram showing functions realized by a server device 10 (control unit 11), a provider terminal 20 (control unit 21), a reviewer terminal 30 (control unit 31), and a user terminal 40 (control unit 41). [Figure 5] 10 is a diagram showing an example of an answer input screen AD that the answer information registration unit 112 causes the provider terminal 20 to display. FIG. [Figure 6] FIG. 10 is a diagram showing an example of an answer input screen AD in which an input form IF is expanded. [Figure 7] FIG. 10 is a diagram showing another example of the answer input screen AD in a state where the input form IF is expanded. [Figure 8] FIG. 10 is a diagram showing an example of an answer input screen AD in a state where an input form IF including a suggestion field PF is expanded. [Figure 9] 10 is a diagram showing an example of an answer input screen AD in a state where an input form IF including a suggestion field PF and an input form call button IB is displayed. FIG. [Figure 10] FIG. 10 is a diagram showing an example of a review screen RD displayed on the reviewer terminal 30. [Figure 11] 1 is an activity diagram showing an example of the flow of information processing (review result creation processing) executed by the information processing system 1. FIG. DETAILED DESCRIPTION OF THE INVENTION

[0009] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will be described below with reference to the accompanying drawings. Various features shown in the following embodiments can be combined with each other.

[0010] Incidentally, the program for realizing the software appearing in one embodiment may be provided as a non-transitory computer-readable medium, or may be provided so that it can be downloaded from an external server, or may be provided so that the program is started on an external computer and its functions are realized on a client terminal (so-called cloud computing).

[0011] Furthermore, various information processing according to an embodiment may realize input and output corresponding to the input. Here, the form of information referenced in such information processing (hereinafter referred to as reference information) is not limited as long as an output is obtained as a result of the input. The reference information may be, for example, rule-based information such as a database, a lookup table, or a predetermined function (including a decision formula such as a regression formula constructed using a statistical method), a trained model that has previously trained the correlation between input and output, or a large-scale language model that can output a desired result by inputting a prompt.

[0012] In one embodiment, a "unit" may include, for example, a combination of hardware resources implemented by a circuit in the broad sense and software information processing that can be specifically realized by these hardware resources. In one embodiment, various information is handled, and this information is represented, for example, by physical values ​​of signal values ​​representing voltage and current, high and low signal values ​​as a binary bit set consisting of 0 or 1, or quantum superposition (so-called quantum bits), and communication and calculations can be performed on a circuit in the broad sense.

[0013] Furthermore, a circuit in the broad sense is a circuit realized by at least an appropriate combination of a circuit, circuitry, processor, memory, etc. The processor may be a general-purpose processor or a dedicated circuit. That is, it includes an application specific integrated circuit (ASIC), a programmable logic device (e.g., a simple programmable logic device (SPLD), a complex programmable logic device (CPLD), and a field programmable gate array (FPGA)), etc.

[0014] 1. Hardware Configuration This section explains the hardware configuration.

[0015] <Information Processing System 1> 1 is a configuration diagram showing an information processing system 1. The information processing system 1 includes a communication line 2, a server device 10, a plurality of provider terminals 20, at least one reviewer terminal 30, and a plurality of user terminals 40. The server device 10, the provider terminal 20, the reviewer terminal 30, and the user terminal 40 are configured to be able to communicate with each other via the communication line 2. The connection between the server device 10, the provider terminal 20, the reviewer terminal 30, and the user terminal 40 may be wired or wireless.

[0016] The information processing system 1 constitutes, for example, at least a part of a security evaluation system for Internet services used by multiple service providers (a first service provider U1 and a second service provider U2), at least one reviewer U3, and multiple service users (a first service user U4 and a second service user U5). The information processing system 1 mainly evaluates the security of services provided by the service providers and provides security evaluations. In one embodiment, the information processing system 1 is composed of one or more devices or components. These components will be described below.

[0017] <Server device 10> Fig. 2 is a block diagram showing the hardware configuration of the server device 10 and the provider terminal 20. As shown in Fig. 2A, the server device 10 includes a control unit 11, a storage unit 12, a communication unit 13, and a communication bus 14. The control unit 11, the storage unit 12, and the communication unit 13 are electrically connected via the communication bus 14 inside the server device 10.

[0018] <Control unit 11> The control unit 11 processes and controls the overall operations related to the server device 10. The control unit 11 is, for example, a central processing unit (CPU). The control unit 11 realizes various functions related to the server device 10 by reading out predetermined programs stored in the storage unit 12. In other words, information processing by software stored in the storage unit 12 is specifically realized by the control unit 11, which is an example of hardware, and can be executed as each functional unit included in the control unit 11. These will be described in more detail in the next section. Note that the control unit 11 is not limited to being single, and multiple control units 11 may be provided for each function. A combination of these may also be used.

[0019] <Storage section 12> The memory unit 12 stores various pieces of information defined above. This can be implemented, for example, as a storage device such as a solid state drive (SSD) that stores various programs and the like related to the server device 10 executed by the control unit 11, or as a memory such as a random access memory (RAM) that stores temporarily required information (arguments, arrays, etc.) related to the program operations. The memory unit 12 stores various programs, variables, etc. related to the server device 10 executed by the control unit 11.

[0020] <Communications Department 13> The communication unit 13 is preferably a wired communication means such as USB, IEEE1394, Thunderbolt (registered trademark), or wired LAN network communication, but may also include wireless LAN network communication, mobile communication such as 3G / LTE / 5G, or BLUETOOTH (registered trademark) communication as needed. That is, it is more preferable to implement it as a collection of multiple communication means. That is, the server device 10 may communicate various information from the outside via the communication unit 13 and the network.

[0021] The server device 10 may be an on-premise server or a cloud server. The cloud server device 10 may provide the above-described functions and processes in the form of, for example, SaaS (Software as a Service) or cloud computing.

[0022] <Provider Terminal 20> 2B, the provider terminal 20 includes a control unit 21, a memory unit 22, a communication unit 23, an input unit 24, an output unit 25, and a communication bus 26. The control unit 21, the memory unit 22, the communication unit 23, the input unit 24, and the output unit 25 are electrically connected via the communication bus 26 inside the provider terminal 20. The provider terminal 20 is an information processing terminal used by a service provider that provides IT services. The explanation of the control unit 21, the memory unit 22, and the communication unit 23 is omitted because they are the same as the explanation of each unit in the server device 10.

[0023] <Input section 24> The input unit 24 accepts operation inputs made by the user. The operation inputs are transferred as command signals to the control unit 21 via the communication bus 26. The control unit 21 can execute predetermined control or calculations based on the transferred command signals as necessary. The input unit 24 may be included in the housing of the provider terminal 20 or may be externally attached. For example, the input unit 24 may be implemented as a touch panel integrated with the output unit 25. When the input unit 24 is implemented as a touch panel, the user can input tap operations, swipe operations, etc. to the input unit 24. Instead of a touch panel, a switch button, a mouse, a trackpad, a QWERTY keyboard, etc. can be used as the input unit 24.

[0024] <Output section 25> The output unit 25 displays a screen of a graphical user interface (GUI) that can be operated by the user. The output unit 25 may be included in the housing of the donor terminal 20 or may be attached externally. Specifically, the output unit 25 may be implemented as a display device such as a CRT display, a liquid crystal display, an organic EL display, or a plasma display. It is preferable that these display devices are implemented by selectively using them depending on the type of donor terminal 20.

[0025] <Reviewer terminal 30> 3 is a block diagram showing the hardware configuration of reviewer terminal 30 and user terminal 40. As shown in Fig. 3A, reviewer terminal 30 includes a control unit 31, a storage unit 32, a communication unit 33, an input unit 34, an output unit 35, and a communication bus 36. Control unit 31, storage unit 32, communication unit 33, input unit 34, and output unit 35 are electrically connected within reviewer terminal 30 via communication bus 36.

[0026] The reviewer terminal 30 is an information processing terminal used by a reviewer who reviews the response of the service provider. The reviewer is an organization such as a company that evaluates the service provided by the service provider (for example, a company that evaluates the security of cloud services, etc.) or a person in charge thereof, and can also be interpreted as an evaluator. The reviewer evaluates the service, for example, from the reviewer terminal 30 via the information processing system 1. The control unit 31, memory unit 32, communication unit 33, input unit 34, and output unit 35 of the reviewer terminal 30 will not be described here because they are the same as the description of each unit in the provider terminal 20.

[0027] <User terminal 40> 3B, the user terminal 40 includes a control unit 41, a memory unit 42, a communication unit 43, an input unit 44, an output unit 45, and a communication bus 46. The control unit 41, the memory unit 42, the communication unit 43, the input unit 44, and the output unit 45 are electrically connected via the communication bus 46 inside the user terminal 40. The user terminal 40 is an information processing terminal used by a user of the security evaluation service provided by the server device 10. The description of the control unit 41, the memory unit 42, the communication unit 43, the input unit 44, and the output unit 45 will be omitted as they are the same as the description of each unit in the provider terminal 20.

[0028] 2. Functional configuration This section describes the functional configuration of this embodiment. Information processing by software stored in the storage unit 12 is specifically realized by the control unit 11, which is an example of hardware, and can be executed as each functional unit included in the control unit 11 (at least one processor included in the information processing system 1).

[0029] FIG. 4 is a block diagram showing functions realized by the server device 10 (controller 11), the provider terminal 20 (controller 21), the reviewer terminal 30 (controller 31), and the user terminal 40 (controller 41).

[0030] As shown in FIG. 4A, the server device 10 (control unit 11) includes a basic display control unit 111, a response information registration unit 112, a review receiving unit 113, a report output unit 114, and an artificial intelligence unit 120. As shown in FIG. 4B, the provider terminal 20 (control unit 21) includes a display unit 211 and an operation acquisition unit 212. As shown in FIG. 4C, the reviewer terminal 30 (control unit 31) includes a display unit 311 and an operation acquisition unit 312. As shown in FIG. 4D, the user terminal 40 (control unit 41) includes a display unit 411 and an operation acquisition unit 412.

[0031] <Basic display control unit 111> The basic display control unit 111 is configured to display various information on the provider terminal 20, the reviewer terminal 30, and the user terminal 40. For example, the basic display control unit 111 displays an input form in which the service provider inputs an answer, answers registered by the service provider, review results by reviewers, etc. on the display unit 211 of the provider terminal 20, the display unit 311 of the reviewer terminal 30, or the display unit 411 of the user terminal 40.

[0032] <Answer information registration unit 112> The response information registration unit 112 is configured to register information relating to the security of the service provided by the service provider, in order to prepare a report or a report to be presented to the service user.

[0033] Specifically, the answer information registration unit 112 displays an input form on the provider terminal 20 that accepts input for each answer element from the service provider (provider terminal 20), and registers the answer information consisting of the multiple answer elements entered as an answer to one question in the evaluation information regarding the security of the service provided by the service provider.

[0034] The "services" provided by a service provider include services provided via the Internet, such as SaaS, IaaS (Infrastructure as a Service), PaaS (Platform as a Service), and cloud services. Furthermore, the "services" provided by a service provider may be services provided to business partners, customers, etc. The "questions" are questions to which the service provider is requested to respond, and may include, for example, questions regarding the security of the service provider itself and the security of the services provided by the service provider. The questions may include a so-called security checklist.

[0035] "Evaluation information" consists of the service provider's responses to multiple questions regarding the security of the service, etc., and is information that a reviewer reviews (checks or evaluates the content). Evaluation information may be reviewed once or multiple times. That is, reviews may include initial reviews, mid-term reviews, final reviews, etc. Initial reviews and mid-term reviews are reviews in which another review (evaluation) is conducted after the previous review (evaluation). The other review may be conducted by the same reviewer or by a different reviewer. The final review is a review that creates an evaluation to be used in a report or report provided to the service user.

[0036] The evaluation information may include answers and questions corresponding to the answers. The reviewer's review of the evaluation information is used as part of a report or a written report, or as reference information. Note that the "service user" in the information processing system 1 includes not only individuals or organizations that use the service to be evaluated, but also individuals or organizations that request an evaluation of a specific service, such as a company that wants to evaluate the security of a cloud service or the like that it uses, or a company that wants to confirm that evaluation.

[0037] The evaluation information is registered, for example, in an answer database in the storage unit 12. The answers to each question included in the evaluation information are answer information entered by the service provider for each question and registered in the answer database. The answer information for one question includes multiple answer elements. The answer elements constitute hierarchical items (sub-items) for the answer information. In other words, the answer information is hierarchically organized by the answer elements.

[0038] "Registration of evaluation information" includes both registration in which answer information has been entered for all questions (full registration) and registration in which answer information has been entered for only some questions (a state in which some answer information has not been entered) (saving as a draft). Furthermore, "unassigned answer information" in a saved draft may also include answer information in which only some of the answer elements that make up the answer information have been entered (a state in which all answer elements have not been entered).

[0039] The questions include, for example, questions to confirm (and request answers from the service provider) security certification or evaluation, service level, scope of responsibility, security measures within the service provider, handling of data created by service users, and service development, maintenance, or operation policies (account management, etc.).

[0040] The answer information registration unit 112 may execute a first reception process in which a plurality of answer options for the question are presented and the service provider (provider terminal 20) selects at least one answer option; and a second reception process in which an input form associated with the answer option selected in the first reception process is displayed on the provider terminal 20 and the input form receives input from the provider terminal 20 for each answer element indicating the attributes of the answer option. This allows the service provider to select, for example, a categorical item for the question (e.g., the name of a security authentication obtained for the service) and then receive input of detailed attribute information (answer elements) (e.g., the time of authentication acquisition). As a result, the service provider can efficiently input answer information and prevent omission of attribute information. Furthermore, receiving input of answers for each answer element facilitates the aggregation and compilation of answer results and allows for efficient review of answers.

[0041] The attributes of the answer options may include at least one of an attribute related to a time or period, an attribute representing a range, and an attribute representing a rank. This clarifies the answer information to the questions, thereby improving the quality of the evaluation results of the service provider (e.g., security evaluation report) presented to the service user.

[0042] The answer options may represent security authentications that the service provider has obtained for the service. The answer information registration unit 112 may not display an input form in the first reception process. Furthermore, in the second reception process, the answer information registration unit 112 may display an input form for accepting input of answer elements as authentication attributes after selection of an answer option. This allows the provider terminal 20 to first present options for authentication names to the service provider, accept the selection of an authentication name, and then display an input form for accepting input of authentication attributes on the provider terminal 20. As a result, the service provider can accurately select an authentication name, and overlooking an authentication name is reduced.

[0043] 5 is a diagram showing an example of an answer input screen AD displayed on the provider terminal 20. The answer input screen AD displays a question QI, a plurality of answer options AC, and a proceed button B1. Note that, although one question QI is displayed on the answer input screen AD in FIG. 5, multiple questions QI may be displayed on the answer input screen AD, and the displayed questions QI may be switched by, for example, an operation such as scrolling.

[0044] In the example of FIG. 5, the question QI displays a question about security certification or evaluation, and the answer options AC of the question QI display a list of information representing security certifications (certification names). Each authentication name is associated with an input acceptance object, such as a check box, that allows multiple selections. The answer options AC may also include auxiliary options SC, such as an option indicating that the presented option (authentication name) is not an appropriate answer (corresponding to the option) or an option indicating that the service provider will not disclose authentication information (no answer). The auxiliary options SC are associated with an input acceptance object, such as a radio button, that allows exclusive selection. The auxiliary options SC may be associated with an input acceptance object different from the answer options AC so that they can be visually distinguished from the other answer options AC. The auxiliary options SC and the authentication names (answer options other than the auxiliary options SC) are in an exclusive selection relationship. In other words, if one of the auxiliary options SC is selected, it is not possible to select any of the authentication names at the same time. For example, if an auxiliary option SC is selected after an authentication name has been selected, the authentication name selection is canceled.

[0045] As shown in Figure 5, when none of the answer options AC is selected, the input field (input form IF described later) for inputting the attributes (detailed information) of the answer option AC is not displayed on the answer input screen AD. Note that the process of accepting the selection of the answer option AC as shown in Figure 5 corresponds to the "first acceptance process."

[0046] The progress button B1 is an input receiving object for storing the answer to the current question QI in, for example, the memory unit 12, and displaying the next question QI on the answer input screen AD. When the answer information to all questions QI included in the evaluation information has been stored, the answer information entered for each question QI on the answer input screen AD is registered as evaluation information. Evaluation information in which answer information has been stored for only some of the questions QI is saved in a draft state.

[0047] Fig. 6 is a diagram showing an example of the answer input screen AD with the input form IF expanded. As shown in Fig. 6, when one of the answer options AC ("SOC2" in the example of Fig. 6) is selected, the input form IF for the selected answer option AC is expanded and displayed.

[0048] The input form IF includes multiple answer input fields (in the example of FIG. 6, a first answer input field AF1, a second answer input field AF2, and a third answer input field AF3). Each answer input field accepts input of a different attribute (such as an attribute related to a time or period, an attribute indicating a range, etc.) for the authentication selected as the answer option AC.

[0049] In the example of Figure 6, the first answer input field AF1 accepts input of the year and month when the certification (SOC2) was obtained. The input format for the first answer input field AF1 is specified as "year / month", and input (registration of answer elements) in any other format is not accepted. The second answer input field AF2 accepts input of the type of certification obtained (in this case, the Type of SOC2 report). In the second answer input field AF2, the selectable types are displayed as multiple-choice options, associated with sets of radio buttons. The third answer input field AF3 accepts input of the scope of the certification obtained (coverage range). In the third answer input field AF3, the input format is not specified, and the service provider can write their answer in any format.

[0050] In this way, the input fields included in the input form IF are divided for each answer element that accepts input. The input form IF may also include a combination of a single-choice field, a multiple-choice field, an input field with a specified input format, and a free-form input field, each prepared for each answer element. This allows the service provider to associate an input format appropriate for the answer element (attribute) with the answer element and present it to the service provider, thereby preventing the service provider from forgetting to enter information into one or more answer elements and improving input accuracy and efficiency.

[0051] The answer information registration unit 112 officially registers the answer information only when all of the answer input fields AF1-AF3 that require input (items marked with "*" in the example of FIG. 6) have been filled in. Therefore, if there are any unfilled required answer input fields in the input form (for example, if only the acquisition date has been entered), the answer information registration unit 112 will not accept the official registration. However, even in this case, it is possible to register the answer information as a draft.

[0052] After accepting the input of an answer element in the input form IF, the answer information registration unit 112 may additionally display an auxiliary input field that is associated with the input answer element and further accepts input of attributes of the answer element. This allows input fields to be presented to the service provider in a stepwise and hierarchical manner, thereby improving the accuracy and efficiency of input of answer elements.

[0053] FIG. 7 is a diagram showing another example of the answer input screen AD in a state in which the input form IF is expanded. The fourth answer input field AF4 included in the input form IF in FIG. 7 accepts input of a specific authentication method as an attribute of the selected answer option, "Device Authentication." The example in FIG. 7 shows a state in which "Other (Details)" is selected, and an auxiliary input field SF for entering further details is displayed in the input form IF. The auxiliary input field SF is not displayed when no input has been made in the fourth answer input field AF4 or when an option other than the option to be displayed in the auxiliary input field SF ("Other (Details)") is selected, and is only expanded and displayed when the option to be displayed is selected (an answer element is entered).

[0054] <Switching input form display> The answer information registration unit 112 changes the display mode of the input form according to the registration status or review status of the answer information. Specifically, the answer information registration unit 112 changes the display mode of the input form according to at least one of the registration status or review status of the answer information. The answer information registration unit 112 may change the display mode of the input form according to both the registration status and review status of the answer information.

[0055] Here, the "registration status" of answer information means whether the answer information is registered as evaluation information (whether it is in a fully registered state, a saved draft state, or an unregistered state). Furthermore, the "review status" of answer information means whether at least one review by a reviewer has been completed. If the review is conducted in multiple stages, the review status means whether a review at any stage has been completed. A "review at any stage" is typically the first stage review (initial review). Note that, since reviews are not conducted for answer information in states other than fully registered (saved draft state or unregistered state), the review status of answer information in states other than fully registered state will necessarily be "unreviewed state."

[0056] For example, for a question for which no answer information is registered, the answer information registration unit 112 displays a first input form that includes only a blank answer input field with no text entered in the initial state, such as the input form IF shown in Figure 6.

[0057] Furthermore, when answer information for a question item for which input is accepted has already been registered (in a fully registered state or a draft saved state), the answer information registration unit 112 may display an input form including an input field for accepting input for each answer element of the answer information and a field for presenting the registered content of the answer information (i.e., a second input form in which a presentation field is added to the first input form). This allows the service provider to check the answer information that has already been entered and to re-enter answer elements by referring to answer information entered in the past. This improves the efficiency of the work of updating evaluation information.

[0058] The registered answer information that the answer information registration unit 112 presents in the presentation field of the input form is not limited to information entered from an input form that the answer information registration unit 112 displays on the provider terminal 20 and that accepts input for each answer element. That is, when answer information has been registered by inputting it into a subform other than the input form, the answer information registration unit 112 may display an input form including an input field and a presentation field. In this case, the presentation field displays the registered content of the answer information according to the input format of the subform in a state where it cannot be edited. This allows the service provider to reuse answer information that was previously entered even when the input form presented by the answer information registration unit 112 is updated (such as by changing the configuration of the input field).

[0059] "Subforms" include forms that were used in the past in the security evaluation service provided by the information processing system 1 (i.e., old forms that are no longer displayed as input forms) and input forms that are used in other services. Furthermore, when a "subform" is an old form that was used in the past, "input form" refers to the form that is currently being used, and "subform" may be read as "old form," and "input form" may be read as "new form" or "current form."

[0060] FIG. 8 is a diagram showing an example of an answer input screen AD in a state in which an input form IF including a suggestion field PF is expanded. In the input form IF of FIG. 8, the suggestion field PF is displayed below the input fields (first answer input field AF1, second answer input field AF2, and third answer input field AF3). The suggestion field PF displays the registered answer information targeted by the input form IF. In the example of FIG. 8, the suggestion field PF displays answer information entered in a subform in which the input fields are not divided for each answer element (i.e., one input field accepts input of multiple answer elements), in the input format of this subform (a format in which the answer elements are displayed in one frame without being divided). Note that, in the input form IF of FIG. 8 as in the input form IF of FIG. 6, the answer information registration unit 112 officially registers answer information only when all of the answer input fields requiring input among the multiple answer input fields AF1-AF3 have been filled in.

[0061] When answer information input for each answer element in the input form IF is registered instead of in a subform, the answer information may be displayed in the presentation field PF in a format divided for each answer element (for example, in a format displayed in individual frames), or may be displayed in a format not divided for each answer element, as in the example of Fig. 8. Furthermore, when answer information input for each answer element in the input form IF is divided for each answer element and displayed in the presentation field PF, the answer information registration unit 112 may accept edits to the registered answer information (answer elements) in the presentation field PF.

[0062] Furthermore, the input form IF for the question for which answer information has been registered is displayed in the initial state of the answer input screen AD. In other words, when displaying the question, the answer information registration unit 112 sets the answer options included in the registered answer information as selected, and displays the answer input screen AD in which the input form IF (including the presentation field PF) for the answer option is expanded. Note that the answer information registration unit 112 may also accept cancellation of the selection (registration) of a registered answer option, and the selection of an additional answer option other than the registered answer option.

[0063] When answer information for a question for which input is accepted has been reviewed, the answer information registration unit 112 may display an input form (i.e., a third input form different from the first input form and the second input form) including a presentation field for displaying the registered content of the reviewed answer information in an uneditable state, and an object for accepting input for displaying an input field for accepting input for each answer element of the answer information. This makes it easier for the service provider to understand that the question has already been reviewed, prevents the service provider from inputting answer information in duplicate, and reduces the burden on the service provider for inputting answers.

[0064] As described above, the reviewed answer information that the answer information registration unit 112 presents in the presentation field of the input form is not limited to information entered through an input form that the answer information registration unit 112 displays on the provider terminal 20 and accepts input for each answer element. That is, when answer information is registered by inputting into a subform other than the input form and has been reviewed, the answer information registration unit 112 may display an input form including a presentation field and an object. In this case, the presentation field displays the registered content of the answer information in accordance with the input format of the subform in a state where it cannot be edited. Furthermore, the input field displayed by inputting into the object is divided for each answer element that accepts input. This allows the service provider to check the already reviewed answer information in the input form even when the input form presented by the answer information registration unit 112 is updated (e.g., by changing the configuration of the input field). Furthermore, by displaying the input field using an object, the service provider can re-enter answer information for each answer element.

[0065] For example, if the answer input screen AD or input form IF for inputting answer information is revised or modified in whole or in part due to the addition or modification of questions, the service provider can easily input answer information on the new answer input screen or new input form while referring to the past answer information.

[0066] 9 is a diagram showing an example of an answer input screen AD in a state where an input form IF including a suggestion field PF and an input form call button IB is expanded. In the input form IF of FIG. 9, the input form call button IB (an example of an object) is displayed below the suggestion field PF, and input fields for answer elements are not displayed. The suggestion field PF displays answer information that has been registered and reviewed and is the target of the input form IF. In the example of FIG. 9, the suggestion field PF displays answer information entered in a subform that does not have input fields divided for each answer element (i.e., accepts input of multiple answer elements in one input field) in the input format of this subform (a format in which answer elements are displayed in a single frame without being divided).

[0067] When answer information input for each answer element in the input form IF, rather than in a subform, is registered and reviewed (evaluated), the answer information may be displayed in the presentation field PF in a format divided for each answer element (for example, in a format displayed in individual frames), or may be displayed in a format not divided for each answer element, as in the example of Fig. 9. However, even in the case of answer information input for each answer element in the input form IF, the answer information registration unit 112 does not accept editing of the reviewed answer information (answer elements) in the presentation field PF.

[0068] Furthermore, even if the answer input screen AD or input form IF, etc., for inputting answer information is revised or modified in whole or in part due to the addition or modification of questions, if there is answer information that has already been registered and reviewed and that also corresponds to the new answer input screen AD, input form IF, etc., the answer information registration unit 112 does not necessarily require the answer information to be input into a new answer input screen or a new input form for that answer information.

[0069] When an input operation is performed on the input form call button IB, the answer information registration unit 112 displays, for example, a plurality of answer input fields AF1-AF3 as shown in FIG. 6 in the input form IF. The display positions of the answer input fields may be above or below the presentation field PF. The answer elements entered in the newly displayed answer input fields are newly registered (overwritten) as answer information. After checking the answer information in the presentation field PF, the service provider can determine whether or not the answer information needs to be corrected, edited, etc. Furthermore, the service provider can display the input form IF and enter answer information only when it is determined that correction, editing, etc. is necessary. This improves the visibility of the answer input screen AD and reduces the effort required of the service provider when answering.

[0070] Examples of cases in which reviewed answer information may be re-entered (questionnaires may be re-answered) include when the security status of the service changes and the service provider voluntarily modifies the evaluation information, when the service provider updates the evaluation information in response to a request for a report or paper from a new service user, when the items in the evaluation information (questionnaires) are updated and the service provider is required to re-answer the questions, etc. If questions are added, the service provider may answer only the additional questions that require answers, or may update the answers to the questions that have already been answered along with the answers to the additional questions.

[0071] Of the registered answer information, for answer information that has not been reviewed (waiting for review), an input form IF including answer input fields AF1-AF3 and a suggestion field PF is displayed, as shown in Figure 8. The same applies to answer information that has been saved as a draft and is not available for review.

[0072] <Review Reception Department 113> The review receiving unit 113 is configured to receive reviews from reviewers (reviewer terminals 30) on the answer information registered by the answer information registration unit 112. A "review" is an act of checking whether there are any deficiencies in the answer information, making comments on the content of the answer information, scoring the answer information, and the like.

[0073] For example, if the review is performed in two stages, the initial review involves checking for deficiencies and creating comments. Subsequently, the evaluation information after the initial review is evaluated as a final review, including scoring its content (answer information) and creating comments on the entire evaluation information, and a report or report (e.g., a security report) including the results is created. The report or report is created by a final reviewer (evaluator) or an evaluation unit included in the control unit 11. The evaluation unit is configured to generate a part or the whole of the report or report based on the input evaluation information. The review results of the evaluation information may be included in the report or report as part of the report or report or as reference information. The report or report is transmitted to the user terminal 40 of the service user who requested the report or report.

[0074] The review receiving unit 113 receives input of characters, sentences, etc. to be used in a review from the reviewer terminal 30. Typically, a review is performed for evaluation information in which all questions have been answered. Therefore, evaluation information with unanswered questions (questions for which answer information has not been registered) is not subject to review, and the review receiving unit 113 may not receive a review.

[0075] The review receiving unit 113 may compare the answer information with the comparison information for each answer element included in the answer information to be reviewed and display the comparison information on the reviewer terminal 30. This makes it easier to compare the answer information requested to be input for each answer element with the comparison information, improving the accuracy and efficiency of the reviewer's work of checking for deficiencies in the answer information and evaluation work.

[0076] The comparison information may be created based on publicly available information from the service, allowing the accuracy of the response information to be verified using an appropriate source. The comparison information may be created by the reviewer themselves or by someone other than the reviewer.

[0077] Furthermore, the comparison information may be created based on information obtained by crawling or scraping websites that contain information about the service and are accessible from the specified access information. This increases the efficiency of collecting comparison information, thereby improving reviewer work efficiency. The access information is information that indicates the location of the website on the network, and includes, for example, the website's URL and IP address. Examples of "websites containing information about the service" include websites related to service providers and websites that post information about services certified by certification bodies (e.g., service name, registration date, registration number, type, scope, etc.).

[0078] FIG. 10 is a diagram showing an example of a review screen RD displayed on the reviewer terminal 30. The review screen RD displays a question QI to be reviewed, registered answer information AI for the question QI, and comparison information CI. In the example of FIG. 10, the answer information AI is arranged on the left side, and the comparison information CI is arranged on the right side. The answer information AI includes a selected answer option RI1 selected by the service provider and multiple answer elements RI2 belonging to this selected answer option RI1. The multiple answer elements RI2 are displayed separated by, for example, a line break for each answer element RI2. If the service provider selects (inputs) multiple selected answer options RI1 for one question QI, the answer information AI displays multiple selected answer options RI1 and an answer element RI2 for each selected answer option RI1.

[0079] In the comparison information CI, for example, information acquired from public information is displayed for each item (attribute) corresponding to the selected answer option RI1 and answer element RI2 of the answer information AI. In the example of FIG. 10, "certification" in the comparison information CI corresponds to the selected answer option RI1, and "acquisition date" and "expiration date" correspond to the "initial registration date" and "expiration date" of each answer element RI2, respectively. Note that information of the answer element RI2 that cannot be acquired from public information (e.g., the scope of certification acquisition, etc.) may not be included in the comparison information CI. In other words, the comparison information CI does not necessarily have to include information corresponding to all answer elements RI2.

[0080] The reviewer compares the response information AI with the comparison information CI, and if there are any differences between the two, the reviewer takes action such as checking with the service provider or creating a report or comments for the report.

[0081] The review receiving unit 113 may compare each answer element included in the answer information with the comparison information to determine whether there are any inconsistencies. For example, if the registration date of the certification input as the answer element is different from the registration date of the certification included in the comparison information, the review receiving unit 113 may display an error indicating this on the reviewer terminal 30 or highlight the inconsistencies.

[0082] The review receiving unit 113 may present a template to be used for the review based on the content of each answer element. This can improve the efficiency of the reviewer in creating review information. In addition, the template is determined based on the content of each answer element, not the entire answer information, so the accuracy of template selection is improved. A "template" is a sentence that constitutes part of the review result, and is inserted into a report or report as a comment, for example, either as is or after being edited by the reviewer, etc.

[0083] An example of a template is a message about security risks, describing the types of security risks that may occur and their causes. A template may be set based on one answer element or multiple answer elements. Furthermore, the review receiving unit 113 may set a template corresponding to one piece of answer information based on multiple answer elements included in the answer information.

[0084] Specifically, the review receiving unit 113 selects a template based on at least one answer element and the reference information, and displays it on the reviewer terminal 30. The reference information includes the correlation between the content of at least one answer element and a plurality of pre-prepared template sentences. The reference information is an estimator constructed so that it can output a template sentence using at least one answer element as input. The reference information may include, for example, a conditional expression, a table, a function, a simple algorithm, etc., that indicates the correlation between the feature (e.g., specific keyword, numerical value, vector data, etc.) extracted from the answer element and the template sentence.

[0085] The reference information may include a fixed phrase output model that has been trained to be able to output a fixed phrase by inputting at least one answer element. In this case, the review receiving unit 113 inputs at least one answer element to the fixed phrase output model of the artificial intelligence unit 120 and causes the fixed phrase output model to output a fixed phrase.

[0086] The fixed phrase output model is a learning model trained using a combination of answer elements (or a set of multiple answer elements) for learning and fixed phrases corresponding to the answer elements as training data. In the fixed phrase output model, parameters calculated, tuned, or the like through learning form correlations of reference information. The fixed phrase output model may also be a generative AI including a large-scale language model. In this case, the review receiving unit 113 inputs at least one answer element, inputs a prompt including an instruction to output a fixed phrase corresponding to the answer element to the fixed phrase output model, and causes the fixed phrase output model to output the fixed phrase. The review receiving unit 113 may generate a prompt that instructs the fixed phrase output model to set a fixed phrase based on the answer element, and input the prompt to the fixed phrase output model. The review receiving unit 113 may also input a prompt into the fixed phrase output model, in which, for example, one or more sample answer elements and one or more sample fixed phrases corresponding to the answer elements are inserted as input and output samples, in addition to the fixed phrase setting and output instructions and the answer element. The fixed sentence output model sets a fixed sentence based on an answer element in accordance with the input prompt.

[0087] Furthermore, the review receiving unit 113 may present sentences (free sentences) that are not fixed phrases to be used in reviews, based on the content of each answer element. This allows review information that is more in line with the content of each answer element to be created efficiently. In this case, the reference information may include a review sentence output model that has been trained to input at least one answer element and output sentences to be used in reviews. In this case, the review receiving unit 113 inputs at least one answer element to the review sentence output model of the artificial intelligence unit 120, and causes the review sentence output model to output review sentences that are not fixed phrases.

[0088] The review statement output model is a learning model trained using a combination of answer elements (or a set of multiple answer elements) for learning and review statements corresponding to the answer elements as training data. In the review statement output model, parameters calculated, tuned, or the like through learning form correlations of reference information. The review statement output model may also be a generative AI including a large-scale language model. In this case, the review receiving unit 113 receives at least one answer element as input, inputs a prompt including an instruction to output a review statement corresponding to the answer element to the review statement output model, and causes the review statement output model to output the review statement. The review receiving unit 113 may generate a prompt that instructs the review statement output model to set a review statement based on the answer element, and input the prompt to the review statement output model. The review receiving unit 113 may also input a prompt that inserts, for example, one or more sample answer elements and one or more sample review statements corresponding to the answer elements as input and output samples to the review statement output model in addition to the review statement generation / output instruction and the answer element. The review statement output model sets a review statement based on the answer element in accordance with the input prompt.

[0089] <Report output section 114> The report output unit 114 is configured to output a report or a report created based on the review received by the review receiving unit 113 to the user terminal 40. The report or the report includes at least all or part of the evaluation information input by the service provider and the review results by the reviewer (e.g., evaluation value, comments, etc.).

[0090] <Artificial Intelligence Department 120> The artificial intelligence unit 120 is configured to receive input from each functional unit and return the instructed output. The artificial intelligence used by the server device 10 in each functional unit may be a common one, or may be prepared individually for each functional unit.

[0091] The artificial intelligence unit 120 is an AI (Artificial Intelligence) equipped with learning models such as Transformers including GPT (Generative Pretrained Transformer, including GPT-1, GPT-2, GPT-3, and GPT-4), BERT (Bidirectional Encoder Representations from Transformers), BART (Bidirectional and Auto-regressive Transformer), etc., and language models such as Recurrent Neural Networks (RNNs), and may include generative AI.

[0092] The language model is an example of a learning model based on a machine learning algorithm. Specific examples of machine learning algorithms include nearest neighbor methods, naive Bayes methods, decision trees, support vector machines, and deep learning using neural networks. The artificial intelligence unit 120 can apply the above algorithms as appropriate.

[0093] The artificial intelligence unit 120 may have a trained model constructed by a learning method such as supervised learning, unsupervised learning, or self-supervised learning. In supervised learning, machine learning is performed using training data (training data). The training data consists of pairs of input data for learning and output data (correct answer data). Furthermore, the language model may not only be trained for a specific task, but also be a general-purpose model that can be used for a wide range of tasks.

[0094] The artificial intelligence unit 120 may be a general-purpose natural language processing learning model, such as a large-scale language model (LLM), trained on a huge amount of data. LLMs are learning models that have previously trained on a large amount of data, such as text data (e.g., (i) web content on the Internet, or (ii) data stored in a specified database). They can execute various language processing tasks when given tasks, and can perform a wide range of natural language processing tasks, such as grasping sentence patterns and contexts, answering questions, and generating sentences, according to given prompts. Such general-purpose learning models include language models that can handle various tasks without fine-tuning, such as through one-shot learning or few-shot learning. Furthermore, general-purpose learning models may also be configured to handle various tasks through zero-shot learning. The artificial intelligence used in each functional unit of the control unit 11 may be a separate learning model, or a common general-purpose learning model.

[0095] The learning model (fixed phrase output model) included in the artificial intelligence unit 120 can undergo additional learning as transfer learning or fine tuning. For example, each time new evaluation information, reports, or documents are registered, the artificial intelligence unit 120 may perform additional learning and fine tuning using these as new training data. This improves the accuracy of the information output from the learning model.

[0096] The learning model included in the artificial intelligence unit 120 may be a learning model (distilled model) obtained by knowledge distillation using an original learning model. In knowledge distillation, a trained model such as a large-scale language model is used as a teacher model, and the parameters of the student model are adjusted to reduce the output loss (Soft Target Loss) of the student model (distilled model) relative to the output (Soft Target) of the teacher model, thereby learning the student model, which becomes the distilled model. Alternatively, the student model may be learned to reduce the output loss (Hard Target Loss) of the student model relative to the correct label (Hard Target) of the teacher data (combination of input data and output data of the learning model). Compared to the original learning model (teacher model), the distilled model has a smaller number of parameters and a smaller processing load while maintaining performance similar to the learning model. Therefore, using a distilled model can reduce the cost of the information processing system 1.

[0097] For example, the fixed phrase output model etc. may be a distilled model trained using a combination of input data and output data in a large-scale language model as training data. Furthermore, when the information processing system 1 is introduced, a large-scale language model may be used as the fixed phrase output model etc., and when training data from the large-scale language model is accumulated, a distilled model obtained by knowledge distillation using the training data may be used as the fixed phrase output model etc.

[0098] <Display> The display unit 211 of the provider terminal 20, the display unit 311 of the reviewer terminal 30, and the display unit 411 of the user terminal 40 each display a screen indicated by the screen data transmitted from the server device 10.

[0099] <Operation acquisition part> The operation acquisition unit 212 of the provider terminal 20 accepts operations by a service provider who uses the provider terminal 20. The operation acquisition unit 312 of the reviewer terminal 30 accepts operations by a reviewer who uses the reviewer terminal 30. The operation acquisition unit 412 of the user terminal 40 accepts operations by a service user who uses the user terminal 40.

[0100] 3. Information Processing Method This section describes an information processing method of the server device 10. This information processing method is executed by a computer, with each unit of the server device 10 acting as each step.

[0101] This information processing includes an answer information registration step and a review reception step. In the answer information registration step, an input form is displayed that receives input for each answer element from the service provider, and answer information consisting of the input multiple answer elements is registered as an answer to one question in evaluation information regarding the security of the service provided by the service provider. In the answer information registration step, the display format of the input form is changed depending on the registration status or review status of the answer information. In the review reception step, reviews of the registered answer information are received from reviewers.

[0102] 11 is an activity diagram showing an example of the flow of information processing (review result creation processing) executed by the information processing system 1. Below, the information processing will be described along with each activity in this activity diagram.

[0103] The process of creating a review result begins with a service provider's instruction to answer a security-related question. The service provider inputs the instruction to answer, for example, by selecting a service to which the answer is to be provided, on the provider terminal 20 (activity A101). The server device 10 receives the instruction to answer from the provider terminal 20 and outputs an input form to the provider terminal 20. Specifically, for questions for which no answer information has been registered, the server device 10 displays a first input form including only an answer input field for each answer element (activity A102). For questions for which answer information has been registered but not reviewed, the server device 10 displays a second input form including an answer input field and a presentation field for presenting the registered answer information (activity A103). For questions for which answer information has been reviewed, the server device 10 outputs a third input form including a presentation field for answer information and an object (button) for displaying the answer input field (activity A104).

[0104] When the server device 10 outputs any one of the first, second, or third input forms, one of these input forms is displayed on the provider terminal 20 (activity A105). The service provider inputs answer elements into the input form on the provider terminal 20 (activity A106). In the case of the third input form, the service provider operates an object (button) to display an input field, and then inputs the answer elements. The server device 10 registers the answer elements input into the input form on the provider terminal 20 as answer information (part of the evaluation information).

[0105] Next, the server device 10 requests the reviewer terminal 30 to review the evaluation information for which all response information has been registered (activity A108). The reviewer reviews the evaluation information for which a review has been requested, using the reviewer terminal 30 (activity A109). The server device 10 accepts the review entered at the reviewer terminal 30 and records the review result using the accepted review (activity A110). 4. Effect The operation of this embodiment can be summarized as follows. That is, since the service provider (respondent) can input answer information for each item, it is possible to prevent omission of input of an item. Furthermore, since the registration status or review status of the answer information is reflected in the input form, it is possible to prevent duplicate input, unintentional overwriting input, etc. As a result, it is possible to efficiently obtain evaluation information related to security.

[0106] Although the embodiment of the present invention has been described above, the present invention is not limited to this and can be modified as appropriate within the scope of the technical idea of ​​the invention.

[0107] 5.Other In the above embodiment, the server device 10 performs various storage and control functions. However, multiple external devices may be used instead of the server device 10. That is, various information and programs may be distributed and stored in multiple external devices using blockchain technology or the like. In particular, the artificial intelligence unit 120 may be an external component of the server device 10. In this case, the external artificial intelligence unit 120 may be provided, for example, by an artificial intelligence service server and configured to receive inputs from each functional unit of the server device 10, receive requests to execute artificial intelligence services, and return the instructed output as a processing result to the server device 10. The artificial intelligence service server may be a server that provides services using a language model as a learning model, or a server that executes language processing tasks using a language model. The artificial intelligence service server may be constructed using LLM. The artificial intelligence service server receives inputs of prompts such as text, images, and voice, and generates and responds to the prompts.

[0108] The answer information registration unit 112 may change the display format of the input form depending only on the registration status of the answer information. In other words, the answer information registration unit 112 does not necessarily have to change the display format of the input form depending on the review status.

[0109] The aspect of this embodiment is not limited to the information processing system 1, and may be an information processing method or a program. The search support method includes steps executed by the information processing system 1. The program causes a computer to execute the steps of the information processing system 1.

[0110] It may be provided in the following manner.

[0111] (1) An information processing system comprising at least one processor, the processor being configured to execute each of the following steps by reading a program: in an answer information registration step, an input form is displayed that accepts input for each answer element from a service provider, and answer information consisting of the input multiple answer elements is registered as an answer to one question in evaluation information regarding the security of a service provided by the service provider; in a review reception step, reviews of the registered answer information are accepted from reviewers; and in the answer information registration step, the display format of the input form is changed depending on the registration status or review status of the answer information.

[0112] (2) In the information processing system described in (1) above, in the answer information registration step, if the answer information has already been registered, the input form is displayed, which includes an input field for accepting input for each answer element of the answer information and a field for presenting the registered content of the answer information.

[0113] (3) In the information processing system described in (2) above, in the answer information registration step, if the answer information has already been registered by inputting into a subform other than the input form, the input form including the input field and the presentation field is displayed, the input field is divided into each answer element that accepts input, and the presentation field displays the registered content of the answer information in accordance with the input format of the subform in a state where it cannot be edited.

[0114] (4) In the information processing system described in any one of (1) to (3) above, in the answer information registration step, when the answer information has been reviewed, the input form is displayed, the input form including a presentation field that displays the registered content of the reviewed answer information in an uneditable state, and an object that accepts input for displaying an input field that accepts input for each answer element of the answer information.

[0115] (5) In the information processing system described in (4) above, in the answer information registration step, if the answer information is registered by input into a subform other than the input form and has been reviewed, the input form including the presentation field and the object is displayed, the presentation field displays the registered content of the answer information in accordance with the input format of the subform in a state where it cannot be edited, and the input field displayed by input into the object is divided into each answer element that accepts input.

[0116] (6) In the information processing system described in any one of (1) to (5) above, the answer information registration step executes a first reception process of presenting a plurality of answer options to the question and accepting selection of at least one of the answer options from the service provider, and a second reception process of displaying the input form corresponding to the answer option selected in the first reception process and accepting input in the input form for each answer element indicating the attributes of the answer option.

[0117] (7) In the information processing system described in (6) above, the attributes include at least one of an attribute relating to a time or period, an attribute representing a range, and an attribute representing a rank.

[0118] (8) In the information processing system described in (6) or (7) above, the answer options represent security certifications that the service provider has obtained for the service, and in the first reception process, the input form is not displayed, and in the second reception process, after the answer option is selected, the input form that accepts input of the answer element as an attribute of the certification is displayed.

[0119] (9) In the information processing system described in any one of (1) to (8) above, in the answer information registration step, after accepting input of the answer element in the input form, an auxiliary input field is additionally displayed to further accept input of attributes of the answer element associated with the entered answer element.

[0120] (10) In the information processing system described in any one of (1) to (9) above, the input form includes a combination of a single-choice field, a multiple-choice field, an input field with a specified input format, and a free-form input field, which are prepared for each answer element.

[0121] (11) In the information processing system described in any one of (1) to (10) above, in the review receiving step, the answer information is displayed in comparison with comparison information for each answer element.

[0122] (12) In the information processing system described in (11) above, the comparison information is information created based on public information of the service.

[0123] (13) In the information processing system described in (12) above, the comparison information is created based on information obtained by crawling or scraping a website that contains information about the service and is accessible from specified access information.

[0124] (14) In the information processing system described in any one of (1) to (13) above, in the review receiving step, a standard phrase to be used for the review is presented based on the content of each answer element.

[0125] (15) An information processing method, comprising steps executed by the information processing system according to any one of (1) to (14) above.

[0126] (16) A program for causing a computer to execute each step of the information processing system described in any one of (1) to (14) above. Of course, this is not the case.

[0127] Finally, while various embodiments of the present disclosure have been described, they are presented as examples and are not intended to limit the scope of the invention. The novel embodiments may be embodied in various other forms, and various omissions, substitutions, and modifications may be made without departing from the spirit of the invention. Such embodiments and modifications are intended to be included within the scope and spirit of the invention, as well as within the scope of the inventions and their equivalents as defined in the claims. [Explanation of symbols]

[0128] 1: Information processing system 2: Communication line 10: Server device 11: Control section 12: Storage section 13: Communications Department 14: Communication bus 20: Provider terminal 21: Control unit 22: Storage section 23: Communications Department 24: Input section 25: Output section 26: Communication bus 30: Reviewer device 31: Control unit 32: Storage section 33: Communications Department 34: Input section 35: Output section 36: Communication bus 40: User terminal 41: Control unit 42: Storage section 43: Communications Department 44: Input section 45: Output section 46: Communication bus 111: Basic display control section 112: Response information registration section 113: Review Reception Department 114: Report output section 120: Artificial Intelligence Department 211:Display section 212: Operation acquisition section 311: Display section 312: Operation acquisition section 411: Display section 412: Operation acquisition section AC: Answer options AD: Answer input screen AF1: First answer input field AF2: Second answer input field AF3: Third answer input field AF4: 4th answer input field AI: Answer information B1: Progress button CI: Comparison information IB: Input form call button PF: Presentation field QI: Questions RD: Review screen RI1: Selected Answer Options RI2: Answer element SC: Suboptions SF: Auxiliary input field U1: First service provider U2: Secondary service provider U3: Reviewer U4: First service user U5: Second service user

Claims

1. An information processing system, at least one processor; The processor is configured to execute the following steps by reading the program: In the answer information registration step, an input form is displayed for receiving input for each answer element from the service provider, and answer information consisting of the input multiple answer elements is registered as an answer to one question in evaluation information regarding the security of the service provided by the service provider; In the review receiving step, a review on the registered answer information is received from a reviewer; In the answer information registration step, the display form of the input form is changed depending on the registration status or review status of the answer information.

2. 2. The information processing system according to claim 1, In the answer information registration step, if the answer information has already been registered, the information processing system displays the input form including an input field for accepting input for each answer element of the answer information and a field for presenting the registered content of the answer information.

3. 3. The information processing system according to claim 2, In the answer information registration step, when the answer information has already been registered by inputting it into a subform other than the input form, the input form including the input field and the presentation field is displayed; The input field is divided into answer elements for accepting input, The presentation field displays the registered content of the answer information in accordance with the input format of the subform in an uneditable state.

4. 2. The information processing system according to claim 1, In the answer information registration step, if the answer information has been reviewed, the information processing system displays the input form, which includes a presentation field that displays the registered content of the reviewed answer information in an uneditable state, and an object that accepts input to display an input field that accepts input for each answer element of the answer information.

5. 5. The information processing system according to claim 4, In the answer information registration step, when the answer information is registered by inputting into a subform other than the input form and has been reviewed, the input form including the suggestion field and the object is displayed; the presentation field displays the registered content of the answer information in an uneditable state according to the input format of the subform; An information processing system, wherein the input field displayed by input to the object is divided into answer elements that accept input.

6. 2. The information processing system according to claim 1, In the answer information registration step, a first reception process of presenting a plurality of answer options to the question and receiving a selection of at least one of the answer options from the service provider; a second reception process of displaying the input form associated with the answer option selected in the first reception process and receiving input for each answer element indicating an attribute of the answer option in the input form; An information processing system that executes the above.

7. 7. The information processing system according to claim 6, The attributes include at least one of an attribute relating to a time or period, an attribute representing a range, and an attribute representing a rank.

8. 7. The information processing system according to claim 6, the answer options represent security certifications that the service provider has obtained for the service; In the first reception process, the input form is not displayed, In the second reception process, after the answer option is selected, the input form for receiving input of the answer element as an attribute of the authentication is displayed.

9. 2. The information processing system according to claim 1, In the answer information registration step, after accepting input of the answer element in the input form, an information processing system additionally displays an auxiliary input field that further accepts input of attributes of the answer element associated with the entered answer element.

10. 2. The information processing system according to claim 1, An information processing system in which the input form includes a combination of a single-choice field, a multiple-choice field, an input field with a specified input format, and a free input field, each prepared for each answer element.

11. 2. The information processing system according to claim 1, In the review receiving step, the information processing system displays the answer information in comparison with comparison information for each answer element.

12. 12. The information processing system according to claim 11, An information processing system, wherein the comparison information is information created based on public information of the service.

13. 13. The information processing system according to claim 12, An information processing system in which the comparison information is created based on information obtained by crawling or scraping a website that contains information about the service and is accessible from specified access information.

14. 2. The information processing system according to claim 1, In the review receiving step, a template to be used for the review is presented based on the content of each of the answer elements.

15. An information processing method, comprising: An information processing method comprising the steps executed by the information processing system according to any one of claims 1 to 14.

16. A program, A program for causing a computer to execute each step of the information processing system according to any one of claims 1 to 14.

Images