Data security compliance risk assessment method and system for data flow business

Abstract

The application relates to a data security compliance risk assessment method and system for data flow business, which comprises the following steps: a risk rule library for scoring the data basic information according to security compliance is constructed in advance, the risk rule library is provided with multiple risk rules for scoring according to different evaluation dimensions, the evaluation dimensions include evaluation questionnaires, third-party evaluation, large models and project background records; data basic information of a data flow business to be audited is acquired; the data basic information is scored in stages, in the process of the staged scoring, different risk rules are selected for scoring in each stage, if the scoring result of the current stage is below a low risk scoring threshold, the next stage of scoring is carried out, otherwise, the scoring results of the current risk rules are weighted and summed to obtain an overall data security compliance risk assessment result of the data flow business to be audited. Compared with the prior art, the application realizes intelligent shunting of the business, and improves the data evaluation efficiency.

Description

Technical Field

[0001] This invention relates to the field of data risk assessment technology, and in particular to a method and system for assessing data security compliance risks for data circulation businesses. Background Technology

[0002] Currently, the mainstream technical solution for security and compliance audits of data circulation businesses in the industry is a serial, isolated offline approval process. Specifically, this manifests as follows: 1) Serial review process: After a business application is initiated, the application materials are sequentially circulated between different departments for approval via email or office system. Each department reviews the application independently, and the review comments are scattered across different emails or system messages, lacking centralized collaboration. The application can only be forwarded to the next department after the previous department has completed its review, resulting in an extremely long process cycle.

[0003] 2) Meeting Review Model: For complex business processes, collective reviews are conducted through offline or online meetings. This model requires coordinating the schedules of multiple experts, resulting in low meeting efficiency, difficulty in structured recording and traceability of the discussion process, reliance on meeting minutes for decision-making, and challenges in execution tracking.

[0004] 3) Lack of pre-assessment mechanism: Before the review process begins, there is a lack of automated preliminary assessment of project risks. All business transactions, regardless of risk level, enter the complete review process, making risk diversion impossible. This results in expert resources being consumed by a large number of low-risk transactions, leading to overall low review efficiency.

[0005] The existing solutions described above have the following problems: 1. Significant efficiency bottleneck: The serial approval process results in long business waiting times, with a single process often taking several weeks, which cannot meet the requirements of rapid decision-making and deployment in data business.

[0006] 2. High barriers to collaboration: The opinions of various departments are scattered, and there is a lack of a unified collaborative platform for real-time interaction and discussion. Information is not synchronized, communication costs are huge, and decision-making silos are easily formed.

[0007] 3. Unreasonable resource allocation: The lack of a pre-risk assessment mechanism results in a mix of high-risk and low-risk business, all of which require the expert team to invest a lot of energy in comprehensive review, leading to a serious waste of valuable expert resources and an inability to focus on truly complex and high-risk scenarios.

[0008] 4. The process is not visible or controllable: The progress of the review process is not transparent, it is difficult to quickly locate the bottleneck when problems occur, and managers cannot conduct effective overall monitoring and intervention.

[0009] Data circulation operations are characterized by urgency, difficulty, risk, complexity, and novelty. Traditional, sequential, and isolated review models cannot meet their urgent needs for efficiency, collaboration, and proactive risk awareness. Therefore, there is a pressing need for an innovative method that can break down departmental silos, achieve real-time information sharing, and intelligently allocate review resources based on risk, in order to support the rapid and secure operation of data services. Summary of the Invention

[0010] The purpose of this invention is to overcome the shortcomings of the existing technology, which has a traditional serial and isolated data audit mode that cannot meet the requirements of efficiency, collaboration and risk advance perception, and to provide a data security compliance risk assessment method and system for data circulation business.

[0011] The objective of this invention can be achieved through the following technical solutions: A data security compliance risk assessment method for data circulation businesses includes: A risk rule base is pre-built for scoring the security and compliance of basic data information. This risk rule base has multiple risk rules that score according to different assessment dimensions, including assessment questionnaires, third-party assessments, large models, and project background records. Obtain basic data information for data circulation businesses awaiting review; The basic information of the data is scored in stages. In the stage scoring process, different risk rules are selected for each stage. If the scoring result of the current stage is within the preset high-risk range, it is judged that there is a high risk and the next stage of scoring is carried out. Otherwise, the scoring results of each risk rule are weighted and summed to obtain the overall data security compliance risk assessment result of the data circulation business to be reviewed.

[0012] Furthermore, the security compliance score is used to assess the completeness of information disclosure, data security management risks, and cybersecurity risks; The data circulation business refers to the circulation of medical data, express logistics data, archaeological data, protein engineering data, steel surface quality assessment data, or drone data.

[0013] Furthermore, the risk rules in the risk rule base include: The DI rule is used to collect entity information, product information, and circulation information from the basic data information based on the assessment questionnaire. The circulation information includes the circulation volume and regional restriction information of the product. Based on the collected assessment questionnaire, the completeness of disclosure is assessed. For each item filled in the assessment questionnaire, data security management risk and cybersecurity risk are assessed. A corresponding risk value is assigned according to the importance of each item, and the risk values ​​of each item are combined to obtain the risk assessment value of the assessment questionnaire. The security compliance DI rule score is obtained by combining the assessment results of the completeness of disclosure and the risk assessment value. API rules are used to collect basic enterprise information of the corresponding enterprise through third-party interfaces based on the basic data information, thereby assessing the enterprise's risk of dishonesty and fraud, and obtaining a security and compliance API rule score. AI rules are used to set up intelligent question-and-answer pairs based on the basic information of the data. The intelligent question-and-answer pairs are input into the AI ​​big model, and the AI ​​big model processes the information based on publicly available information on the Internet to obtain a security and compliance AI rule score. The RI rule is used to extract subject information keywords from the basic information of the data. Based on the subject information keywords, positive bonus items and negative deduction items are searched in a pre-constructed high-quality dataset to obtain the security compliance RI rule score. The high-quality dataset stores the honors, achievements and notification and penalty records related to the enterprise subject.

[0014] Furthermore, during the assessment of security management risks and cybersecurity risks, the DI rules pre-mark the assessment questionnaires with risk items. If the information corresponding to the risk items in the collected assessment questionnaires indicates data security management risks or cybersecurity risks, then the lowest security compliance DI rule score is directly assigned.

[0015] Furthermore, the phased scoring process is set up with two scoring stages. In the first scoring stage, DI rules and API rules are selected for security compliance scoring. If the scoring results of DI rules and API rules are both below the corresponding low-risk scoring threshold or trigger medium-to-high-risk items, then the second scoring stage is carried out; otherwise, the scoring results of DI rules and API rules are weighted and summed to obtain the overall data security compliance risk assessment result. In the second scoring phase, AI rules and RI rules are selected for security compliance scoring; the scores of DI rules, API rules, AI rules and RI rules are weighted and summed to obtain the overall data security compliance risk assessment result.

[0016] Furthermore, the method also includes revising the overall data security compliance risk assessment results based on external factors. This revision process includes: By using an AI big data model to monitor publicly available information about the types of projects corresponding to the basic data information, dynamic project risk adjustment coefficients are set to correct the overall data security and compliance risk assessment results. The correction process also includes: Based on the internal data security incidents and risk notifications that occurred within the company where the basic data information is located, a dynamically updated company risk adjustment coefficient is set to correct the overall data security compliance risk assessment results.

[0017] Furthermore, the method also includes determining the risk level of the basic data information based on the overall data security compliance risk assessment results. If it is a low-risk project, a simplified procedure for notification and commitment is issued or the responsible person is directly notified for confirmation. If it is a medium-risk or high-risk project, multiple experts conduct a collaborative review process through a preset integrated collaborative review process.

[0018] Furthermore, the integrated collaborative review process includes: Based on the risk assessment dimensions indicated during the basic information assessment process, multiple audit tasks are created and pushed to the expert workbench of the security, compliance, legal and / or finance departments within the review company. A collaborative workspace is generated for each piece of basic information to be reviewed, allowing all experts to conduct simultaneous reviews, discussions, and questions. Aggregate the review opinions from all expert workbench, generate a decision conclusion, and trigger subsequent processing actions.

[0019] Furthermore, the expert workbench pushed to the security, compliance, legal, and / or finance departments within the review company includes: If it is a medium-risk project, the review task will be pushed to the expert workbench of the security and compliance department within the review company, and the risk points identified during the phased scoring process will be marked. For high-risk projects, the review task will be pushed to the expert workbench of the security, compliance, legal and finance departments within the review company, and the task will be given higher priority and marked as requiring key review. The integrated collaborative review process also includes: If the expert workbench within the review company's security, compliance, legal, and finance departments is unable to handle the task and a consensus is reached, the review task will be forwarded to a lawyer's or expert workbench outside the review company.

[0020] The present invention also provides a data security compliance risk assessment system for data circulation business, including a memory and a processor. The memory stores a computer program, and the processor calls the computer program to execute the steps of the method described above.

[0021] Compared with the prior art, the present invention has the following advantages: (1) This invention assesses the basic information of data for security compliance from multiple dimensions, including assessment questionnaires, third-party assessments, large models, and data quality, and conducts the assessment in stages. If the assessment result of the first stage is low risk or above, the next stage of security compliance assessment is carried out. Finally, the overall data security compliance risk assessment result is obtained by weighted summation of the scores of each risk rule. This process realizes intelligent diversion of business through an automated pre-assessment mechanism. Low-risk business is freed from complex audits, eliminating the need for subsequent complex processes and greatly improving overall efficiency. At the same time, it allows medium- and high-risk business to expose problems in advance, making subsequent collaborative audits more targeted.

[0022] (2) For medium- to high-risk projects, this invention uses an integrated collaborative review process to conduct reviews through multiple experts. This integrated collaborative review process changes the traditional serial workflow and enables parallel initiation of review tasks. The system can intelligently determine which departments need to participate based on the risk type and automatically and simultaneously push the task to all relevant experts, eliminating waiting time between departments and shortening the review cycle from the sum of the time taken by each department to the time taken by the slowest department.

[0023] (3) This invention constructs an online collaborative workspace that supports real-time interaction and opinion aggregation among multiple departments, providing a unified, context-sharing collaborative environment for each review project. It solves the pain points of scattered opinions and asynchronous information, reduces communication costs, and improves the decision-making quality and efficiency of cross-departmental reviews. All interaction processes are traceable, ensuring the standardization and traceability of the review process.

[0024] (4) The present invention also monitors the external public information of the project based on the AI ​​big model to form a dynamic project risk optimization coefficient and correct the overall data security compliance risk assessment results. This enables the project risk to be corrected according to the real-time external situation of the project and automatically and regularly dynamically adjusted. If there are serious and significant risk signals, a new supplementary assessment is triggered to avoid the error in enterprise risk assessment caused by not updating the latest dynamics of the enterprise within the assessment period. The seamless assessment through the AI ​​big model can also avoid disturbing the enterprise. Attached Figure Description

[0025] Figure 1 This is a flowchart illustrating a data security compliance risk assessment method for data circulation business provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the overall process framework of a data security compliance risk assessment method for data circulation business provided in an embodiment of the present invention; Figure 3This is a schematic diagram of an integrated collaborative review process provided in an embodiment of the present invention. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0027] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0028] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0029] Example 1 like Figure 1 and Figure 2 As shown in the figure, this embodiment provides a data security compliance risk assessment method for data circulation business, including: S1: A risk rule base is pre-built for scoring the security and compliance of basic data information. This risk rule base has multiple risk rules that are scored according to different assessment dimensions, including assessment questionnaires, third-party assessments, large models, and project background records. S2: Obtain basic data information for the data circulation business to be reviewed; S3: The basic information of the data is scored in stages. During the stage scoring process, different risk rules are selected for each stage. If the score result of the current stage is within the preset high-risk range, it is judged that there is a high risk and the next stage of scoring is carried out. Otherwise, the score results of each risk rule are weighted and summed to obtain the overall data security compliance risk assessment result of the data circulation business to be reviewed.

[0030] In this embodiment, the basic data information includes the name of the partner, the type of business, the scope of data, and the intended purpose.

[0031] The data circulation business includes the circulation of medical data, express logistics data, archaeological data, protein engineering data, steel surface quality assessment data, or drone data.

[0032] Upon receiving basic data information, the automated risk pre-assessment engine is immediately activated. Based on a pre-built risk rule base and model, this engine quickly scans the project and performs preliminary risk assessment, generating a risk level identifier (such as low risk, medium risk, or high risk) and key risk point alerts.

[0033] Risk pre-assessment: refers to the process of quickly scanning and initially judging the risk level of business projects through automation before the formal start of the manual review process.

[0034] The security compliance score is used to assess the completeness of information disclosure, data security management risks, and cybersecurity risks.

[0035] Specifically, the risk rule base includes DI rules, API rules, AI rules, and RI rules, which are weighted and averaged to form a comprehensive score.

[0036] The risk rule base is a collection of rule configurations for each business scenario within the system. Risk rules are the rule configurations for each business scenario.

[0037] The risk rule base itself undergoes dynamic optimization. Based on initial rules and production environment documents, the rule base is dynamically adjusted, such as through automatic scoring accuracy analysis combined with manual calibration deviation analysis, to achieve rule optimization.

[0038] Specifically, the DI rule is used to collect entity information, product information, and circulation information from the basic data information based on the assessment questionnaire. The circulation information includes the circulation volume and regional restriction information of the product. Based on the collected assessment questionnaire, the completeness of disclosure is assessed. For each item of information in the collected assessment questionnaire, data security management risk and cybersecurity risk are assessed. A corresponding risk value is assigned according to the importance of each item. The risk values ​​of each item are combined to obtain the risk assessment value of the assessment questionnaire. The security compliance DI rule score is obtained by combining the assessment results of the completeness of disclosure and the risk assessment value. Preferably, during the assessment of security management risks and cybersecurity risks, the DI rule pre-marks the assessment questionnaire with risk items. If the information corresponding to the risk items in the collected assessment questionnaires has data security management risks or cybersecurity risks, then the lowest security compliance DI rule score is directly assigned.

[0039] For each item of information except for the hazardous items, a positive, low-risk, and medium-risk assessment is conducted. Finally, based on the assessment results of the completeness of disclosure, as well as the number of low-risk and medium-risk items, a safety compliance DI rule score is obtained according to a preset weighting rule.

[0040] The completeness of disclosure can be assessed by determining whether information has been filled in for each item in the assessment questionnaire, and the final determination is based on the overall assessment results.

[0041] API rules are used to collect basic enterprise information of the corresponding enterprise through third-party interfaces based on the basic data information, thereby assessing the enterprise's risk of dishonesty and fraud, and obtaining a security and compliance API rule score. For example, by querying the basic information of the corresponding enterprise through Qichacha, the security and compliance API rule score can be determined based on its credit record and fraud risk level.

[0042] AI rules are used to set up intelligent question-and-answer pairs based on the basic information of the data. The intelligent question-and-answer pairs are input into the AI ​​big model, and the AI ​​big model processes the information based on publicly available information on the Internet to obtain a security and compliance AI rule score. The RI rule is used to extract subject information keywords from the basic information of the data. Based on the subject information keywords, positive bonus items and negative deduction items are searched in a pre-constructed high-quality dataset to obtain the security compliance RI rule score. The high-quality dataset stores the honors, achievements and notification and penalty records related to the enterprise subject.

[0043] The configuration process for each rule includes two steps: risk classification architecture and risk rule configuration. The first step is the risk classification architecture, which identifies and sets the dimensions of risk, including level one, level two, and level three, which can also be regarded as assessment labels.

[0044] The phased scoring process can logically be two-stage, three-stage, or configured as N stages. For example, using API-AI-DI for sequential scoring, if a risk item or a low score is found in the previous stage, a second, third, or Nth scoring will be triggered in sequence.

[0045] For example, the phased scoring process has two scoring phases. In the first scoring phase, DI rules and API rules are selected for security compliance scoring. If the scoring results of both DI rules and API rules are below the corresponding low-risk scoring threshold or trigger medium- or high-risk items, then the second scoring phase is carried out; otherwise, the scoring results of DI rules and API rules are weighted and summed to obtain the overall data security compliance risk assessment result. In the second scoring phase, AI rules and RI rules are selected for security compliance scoring; the scores of DI rules, API rules, AI rules and RI rules are weighted and summed to obtain the overall data security compliance risk assessment result.

[0046] The above can be set as a trigger sequence according to the model, or they can be combined into a group and set as a trigger sequence.

[0047] Preferably, the method further includes revising the overall data security compliance risk assessment results based on external factors, the revision process including: By using AI big data models to monitor publicly available information about projects of the same type as the basic data information, dynamic project risk adjustment coefficients are set to correct the overall data security and compliance risk assessment results.

[0048] If we regularly monitor the risk index of publicly available information through large AI models such as Deepseek and Doubao, and find that there is an increase in recent regulatory penalties, judicial precedents, or security incidents, this information can be used as a basis for adjusting the project risk optimization coefficient. The base coefficient of 1.0 can be adjusted to 1.2, and the risk score can be multiplied by the project risk optimization coefficient to correct the model scoring system.

[0049] In a further preferred embodiment, the correction process also includes: Based on internal data security incidents and risk notifications that have occurred within the company where the basic data information is located, a dynamically updated company risk adjustment coefficient is set to correct the overall data security compliance risk assessment results.

[0050] For example, regularly collect information such as internal data security incidents, risk reports, and events, and adjust the company's risk optimization coefficient. For instance, adjust the company's risk optimization coefficient from the baseline coefficient of 1.0 to 1.4, and revise the model scoring system.

[0051] This enables the correction of project risks based on real-time external conditions and automatic, periodic, and dynamic adjustments. If there are serious and significant risk signals, a supplementary assessment will be triggered to avoid errors in enterprise risk assessment caused by failure to update the latest developments of the enterprise within the assessment period. The seamless assessment through AI big data models also avoids disturbing the enterprise.

[0052] Preferably, the method also includes determining the risk level of basic data information based on the overall data security compliance risk assessment results. If it is a low-risk project, a simplified procedure for issuing a notification commitment is issued or the responsible person is directly notified for confirmation. If it is a medium-risk or high-risk project, multiple experts collaborate to conduct the review through a pre-set integrated collaborative review process.

[0053] That is, for low-risk projects, simple procedures such as notification and commitment are automatically triggered, or the information is directly pushed to the business department head for quick confirmation, which greatly simplifies the process.

[0054] For medium-risk or high-risk projects, they will automatically enter the integrated collaborative review process.

[0055] like Figure 3 As shown, the integrated collaborative review process includes: Based on the risk assessment dimensions indicated during the basic data information assessment process, multiple audit tasks are created and pushed to the expert workbench of the security, compliance, legal and / or finance departments within the review company. A collaborative workspace is generated for each piece of basic information to be reviewed, allowing all experts to conduct simultaneous reviews, discussions, and questions. Aggregate the review opinions from all expert workbench, generate a decision conclusion, and trigger subsequent processing actions.

[0056] Integrated collaborative review: This refers to breaking down the barriers between departments that conduct sequential reviews and establishing a joint review mechanism that supports multiple reviewers working in parallel, sharing information in real time, and engaging in online interactive discussions.

[0057] Parallel dispatch: refers to the system sending review tasks to multiple different review roles or departments simultaneously according to rules, with no sequential dependency between the tasks.

[0058] Collaborative workspace: refers to an online virtual space created for a single review project, containing all relevant materials, discussion history, and review comments, for all participants to access and collaborate on centrally.

[0059] The specific process is as follows: Parallel task creation: Based on the risk dimensions suggested in the pre-assessment, the system automatically and in parallel creates multiple audit tasks and simultaneously pushes them to the expert workbench of relevant departments such as security, compliance, legal, and finance.

[0060] Collaborative Workspace: A unique collaborative workspace is generated for each project. All participating experts conduct simultaneous reviews within this space based on the same project materials and a shared pre-assessment report.

[0061] Real-time interaction and annotation: Experts can annotate documents online, @ colleagues to start discussions, and ask questions. All interaction records are updated in real time and are visible to everyone, completely breaking down communication barriers.

[0062] Opinion Aggregation and Decision-Making: The system aggregates review opinions from various departments in real time, such as "agree," "conditionally agree," and "reject." Conclusions can be automatically generated based on preset rules, or the project manager can make a comprehensive decision based on the discussion.

[0063] Audit conclusion execution and archiving: The final audit conclusion automatically triggers subsequent actions, such as generating agreements, granting permissions, or terminating cooperation, and all data, documents, discussion records, and operation logs throughout the process are structured and archived to form a complete audit trail chain.

[0064] In this embodiment, an example of the above-mentioned integrated collaborative review process is provided as follows: (1) Input: Receive the output results from the risk pre-assessment stage, including risk level and risk warning, such as personal information and short establishment time of the partner.

[0065] (2) Decision node: The system matches the pre-evaluation results with the pre-set assignment rule library.

[0066] (3) Execution of assignment rules: Rule A (Low Risk): If the risk level is low, the task will be automatically assigned to the fast track: the task will only be sent to the business manager for final confirmation, or a standard commitment letter will be automatically generated for the company to sign to complete the task.

[0067] Rule B (Medium Risk): If the risk level is medium, it will be automatically assigned to the standard collaborative process: based on the business type, it will be assigned in parallel to experts in both the security and compliance departments by default. At the same time, specific risk points identified in the pre-assessment will be highlighted for the corresponding experts.

[0068] Rule C (High Risk): If the risk level is high, it will be automatically assigned to the enhanced collaborative process: it will be assigned in parallel to experts in all relevant departments such as security, compliance, legal, and finance, and the priority of the task will be automatically increased, and all parties will be notified that it needs to be reviewed carefully.

[0069] Rule D (Specific Risk): In addition to general rules, specific scenario rules are also supported. For example, if the pre-assessment indicates that data is being exported, the system will force the task to be assigned to the "Data Export" expert group regardless of the overall risk level.

[0070] Output: Based on the matching rules, the system automatically generates a list of parallel review tasks and immediately pushes them to the corresponding experts' to-do lists, thereby achieving accurate, efficient and automated allocation of review resources.

[0071] Optionally, a feedback loop can be added after the audit conclusions of the integrated collaborative audit process are executed. The final conclusions of the manual audit are compared with the pre-assessment results, and the discrepancies are used to optimize the rules and parameters of the pre-assessment model, making it increasingly accurate.

[0072] Optionally, the integrated collaborative review process also includes: If the expert workbench within the review company's security, compliance, legal, and finance departments is unable to handle the task and a consensus is reached, the review task will be forwarded to a lawyer's or expert workbench outside the review company.

[0073] This embodiment provides a data security compliance risk assessment system for data circulation business, including a memory and a processor. The memory stores a computer program, and the processor calls the computer program to execute the steps of the data security compliance risk assessment method for data circulation business as described above.

[0074] The preferred embodiments of the present invention have been described in detail above. It should be understood that those skilled in the art can make numerous modifications and variations based on the concept of the present invention without creative effort. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning, or limited experimentation on the basis of existing technology should be within the scope of protection defined by the claims.

Claims

1. A data security compliance risk assessment method for data circulation businesses, characterized in that, include: A risk rule base is pre-built for scoring the security and compliance of basic data information. This risk rule base has multiple risk rules that score according to different assessment dimensions, including assessment questionnaires, third-party assessments, large models, and project background records. Obtain basic data information for data circulation businesses awaiting review; The basic information of the data is scored in stages. In the stage scoring process, different risk rules are selected for each stage. If the scoring result of the current stage is within the preset high-risk range, it is judged that there is a high risk and the next stage of scoring is carried out. Otherwise, the scoring results of each risk rule are weighted and summed to obtain the overall data security compliance risk assessment result of the data circulation business to be reviewed.

2. The data security compliance risk assessment method for data circulation business according to claim 1, characterized in that, The security compliance score is used to assess the completeness of information disclosure, data security management risks, and cybersecurity risks. The data circulation business refers to the circulation of medical data, express logistics data, archaeological data, protein engineering data, steel surface quality assessment data, or drone data.

3. The data security compliance risk assessment method for data circulation business according to claim 1, characterized in that, The risk rules in the risk rule base include: The DI rule is used to collect entity information, product information, and circulation information from the basic data information based on the assessment questionnaire. The circulation information includes the circulation volume and regional restriction information of the product. Based on the collected assessment questionnaire, the completeness of disclosure is assessed. For each item filled in the assessment questionnaire, data security management risk and cybersecurity risk are assessed. A corresponding risk value is assigned according to the importance of each item, and the risk values ​​of each item are combined to obtain the risk assessment value of the assessment questionnaire. The security compliance DI rule score is obtained by combining the assessment results of the completeness of disclosure and the risk assessment value. API rules are used to collect basic enterprise information of the corresponding enterprise through third-party interfaces based on the basic data information, thereby assessing the enterprise's risk of dishonesty and fraud, and obtaining a security and compliance API rule score. AI rules are used to set up intelligent question-and-answer pairs based on the basic information of the data. The intelligent question-and-answer pairs are input into the AI ​​big model, and the AI ​​big model processes the information based on publicly available information on the Internet to obtain a security and compliance AI rule score. The RI rule is used to extract subject information keywords from the basic information of the data. Based on the subject information keywords, positive bonus items and negative deduction items are searched in a pre-constructed high-quality dataset to obtain the security compliance RI rule score. The high-quality dataset stores the honors, achievements and notification and penalty records related to the enterprise subject.

4. The data security compliance risk assessment method for data circulation business according to claim 3, characterized in that, In the process of assessing security management risks and cybersecurity risks, the DI rules pre-mark the assessment questionnaires with hazard items. If the information corresponding to the hazard items in the collected assessment questionnaires has data security management risks or cybersecurity risks, then the lowest security compliance DI rule score is directly assigned.

5. The data security compliance risk assessment method for data circulation business according to claim 3, characterized in that, The phased scoring process has two scoring stages. In the first scoring stage, DI rules and API rules are selected for security compliance scoring. If the scoring results of both DI rules and API rules are below the corresponding low-risk scoring threshold or trigger medium- or high-risk items, then the second scoring stage is carried out; otherwise, the scoring results of DI rules and API rules are weighted and summed to obtain the overall data security compliance risk assessment result. In the second scoring phase, AI rules and RI rules are selected for security compliance scoring; the scores of DI rules, API rules, AI rules and RI rules are weighted and summed to obtain the overall data security compliance risk assessment result.

6. The data security compliance risk assessment method for data circulation business according to claim 1, characterized in that, The method also includes revising the overall data security compliance risk assessment results based on external factors. This revision process includes: By using an AI big data model to monitor publicly available information about the types of projects corresponding to the basic data information, dynamic project risk adjustment coefficients are set to correct the overall data security and compliance risk assessment results. The correction process also includes: Based on the internal data security incidents and risk notifications that occurred within the company where the basic data information is located, a dynamically updated company risk adjustment coefficient is set to correct the overall data security compliance risk assessment results.

7. The data security compliance risk assessment method for data circulation business according to claim 1, characterized in that, The method also includes determining the risk level of the basic data information based on the overall data security compliance risk assessment results. If it is a low-risk project, a simplified procedure for issuing a notification commitment is issued or the responsible person is directly notified for confirmation. For medium-risk or high-risk projects, multiple experts will conduct the review simultaneously through a pre-set integrated collaborative review process.

8. The data security compliance risk assessment method for data circulation business according to claim 7, characterized in that, The integrated collaborative review process includes: Based on the risk assessment dimensions indicated during the basic information assessment process, multiple audit tasks are created and pushed to the expert workbench of the security, compliance, legal and / or finance departments within the review company. A collaborative workspace is generated for each piece of basic information to be reviewed, allowing all experts to conduct simultaneous reviews, discussions, and questions. Aggregate the review opinions from all expert workbench, generate a decision conclusion, and trigger subsequent processing actions.

9. A data security compliance risk assessment method for data circulation business according to claim 8, characterized in that, The expert workbench pushed to the security, compliance, legal, and / or finance departments within the review company includes: If it is a medium-risk project, the review task will be pushed to the expert workbench of the security and compliance department within the review company, and the risk points identified during the phased scoring process will be marked. For high-risk projects, the review task will be pushed to the expert workbench of the security, compliance, legal and finance departments within the review company, and the task will be given higher priority and marked as requiring key review. The integrated collaborative review process also includes: If the expert workbench within the review company's security, compliance, legal, and finance departments is unable to handle the task and a consensus is reached, the review task will be forwarded to a lawyer's or expert workbench outside the review company.

10. A data security compliance risk assessment system for data circulation businesses, characterized in that, It includes a memory and a processor, the memory storing a computer program, the processor invoking the computer program to perform the steps of the method as described in any one of claims 1 to 9.

Images