Information processing system, information processing method, and program

Abstract

An information processing system, method, and program for identifying risks related to supply chain security are provided. [Solution] A method in an information processing system, in which in a transaction investigation request receiving step, a request as to whether or not a secondary transaction investigation is required for a trading partner organization with which a transaction is conducted is received from a source trading organization as first request information. A secondary transaction investigation is an investigation into the trading partner organization's transactions with another organization with which the trading partner is a trading partner. In a security investigation request receiving step, a request as to whether or not or the type of security investigation is required for a trading partner organization is received from a source trading organization as second request information. A security investigation is an investigation into the security of the trading partner organization. In a form sending step, a first response form for inputting a response to the secondary transaction investigation is sent to the trading partner organization in response to the first request information, and a second response form for inputting a response to the security investigation is sent to the trading partner organization in response to the second request information.

Description

[Technical field]

[0001] The present invention relates to an information processing system, an information processing method, and a program. [Background technology]

[0002] Patent Document 1 describes a technique for requesting answers to security questions and performing security checks. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 6969039 Summary of the Invention [Problem to be solved by the invention]

[0004] In the supply chain, it is necessary to understand the risks regarding supply chain security.

[0005] In view of the above circumstances, the present invention provides an information processing system and the like that can grasp risks relating to security in a supply chain. [Means for solving the problem]

[0006] According to one aspect of the present invention, there is provided an information processing system having at least one processor, the processor being configured to execute each of the following steps by reading a program, wherein in a transaction investigation request receiving step, a request for a secondary transaction investigation is received from a source organization as first request information regarding the need for a secondary transaction investigation of a trading partner organization with which a transaction is conducted, the secondary transaction investigation being an investigation into the trading partner organization's transactions with other organizations with which the trading partner organization is a trading partner; in a security investigation request receiving step, a request for a security investigation or the type of security investigation of a trading partner organization is received from a source organization as second request information, the security investigation being an investigation into the security of the trading partner organization; and in a form sending step, a first response form for inputting a response to the secondary transaction investigation is sent to the trading partner organization in response to the first request information, and a second response form for inputting a response to the security investigation is sent to the trading partner organization in response to the second request information.

[0007] According to this embodiment, the trading organization can collect information on the secondary trading partners and information on security from the trading partner organization, thereby making it possible to grasp the security risks in the supply chain. [Brief description of the drawings]

[0008] [Figure 1] 1 is a configuration diagram illustrating an information processing system 1. [Diagram 2] 2 is a block diagram showing the hardware configuration of a server device 10 and a transaction source organization terminal 20.

[0023] FIG. [Diagram 3] 2 is a block diagram showing the hardware configuration of an evaluator terminal 30 and a business partner organization terminal 40. FIG. [Figure 4] 2 is a block diagram showing functions realized by the server device 10 (control unit 11). [Diagram 5] 2 is a block diagram showing functions realized by a source organization terminal 20 (control unit 21), an evaluator terminal 30 (control unit 31), and a destination organization terminal 40 (control unit 41). FIG. [Figure 6]FIG. 13 is a diagram showing an example of a first investigation reception screen SD1 displayed on the transaction source organization terminal 20. [Figure 7] FIG. 13 is a diagram showing an example of a state in which a business partner organization is input into the first survey reception screen SD1. [Figure 8] 13 is a diagram showing an example of a second investigation reception screen SD2 displayed on the transaction source organization terminal 20. FIG. [Figure 9] FIG. 13 is a diagram showing an example of a third investigation reception screen SD3 displayed on the transaction source organization terminal 20. [Figure 10] FIG. 13 is a diagram showing an example of a first answer form display screen FD displayed on the business partner organization terminal 40. [Figure 11] 13 is a diagram showing an example of a hierarchical structure display screen HD displayed on the transaction source organization terminal 20. FIG. [Figure 12] FIG. 13 is a diagram showing another example of the transaction hierarchical structure HS displayed on the hierarchical structure display screen HD of FIG. [Figure 13] 13 is a diagram showing yet another example of the hierarchical structure display screen HD displayed on the transacting organization terminal 20. FIG. [Figure 14] FIG. 14 is a diagram showing a changed state of the hierarchical structure display screen HD in FIG. [Figure 15] 13 is a diagram showing an example of a progress display screen PD displayed on the transaction source organization terminal 20. FIG. [Figure 16] 13 is a diagram showing an example of an investigation list display screen LD displayed on the transacting organization terminal 20. FIG. [Figure 17] FIG. 13 is a diagram showing an example of a survey result display screen SRD displayed on the transaction source organization terminal 20. [Figure 18] 13 is a diagram showing another example of the investigation list display screen LD displayed on the transacting organization terminal 20. FIG. [Figure 19] 2 is an activity diagram showing an example of the flow of information processing (security investigation processing) executed by the information processing system 1. FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described with reference to the drawings. Various characteristic features shown in the following embodiments can be combined with each other.

[0010] Incidentally, a program for realizing the software appearing in one embodiment may be provided as a non-transitory computer-readable recording medium, or may be provided so as to be downloadable from an external server, or may be provided so that the program is launched on an external computer and its functions are realized on a client terminal (so-called cloud computing).

[0011] In addition, in various information processing according to an embodiment, an input and an output according to the input can be realized. Here, as long as an output is obtained as a result of the input, the form of information referenced in such information processing (hereinafter referred to as reference information) is not limited. The reference information may be, for example, rule-based information such as a database, a lookup table, or a predetermined function (including a judgment formula such as a regression formula constructed by a statistical method), or may be a trained model that has previously trained the correlation between the input and the output, or may be a large-scale language model that can output a desired result by inputting a prompt.

[0012] In one embodiment, the term "unit" may include, for example, a combination of hardware resources implemented by a circuit in the broad sense and software information processing that can be specifically realized by these hardware resources. In one embodiment, various information is handled, and this information is represented by, for example, physical values ​​of signal values ​​representing voltage and current, high and low signal values ​​as a binary bit collection consisting of 0 or 1, or quantum superposition (so-called quantum bits), and communication and calculation can be performed on the circuit in the broad sense.

[0013] Furthermore, a circuit in the broad sense is a circuit realized by at least appropriately combining a circuit, circuitry, a processor, and a memory. The processor may be a general-purpose processor or a dedicated circuit. In other words, it includes an application specific integrated circuit (ASIC), a programmable logic device (e.g., a simple programmable logic device (SPLD), a complex programmable logic device (CPLD), and a field programmable gate array (FPGA)), etc.

[0014] 1. Hardware Configuration This section describes the hardware configuration.

[0015] <Information Processing System 1> 1 is a configuration diagram showing an information processing system 1. The information processing system 1 includes a communication line 2, a server device 10, a plurality of trading organization terminals 20, at least one evaluator terminal 30, and a plurality of trading organization terminals 40. The server device 10, the trading organization terminal 20, the evaluator terminal 30, and the trading organization terminal 40 are configured to be able to communicate with each other through the communication line 2. The connection between the server device 10, the trading organization terminal 20, the evaluator terminal 30, and the trading organization terminal 40 may be wired or wireless.

[0016] The information processing system 1 constitutes at least a part of a security evaluation system used by, for example, multiple trading organizations (a first trading organization U1 and a second trading organization U2), at least one evaluator U3, and multiple trading partner organizations (a first trading partner organization U4 and a second trading partner organization U5). The information processing system 1 mainly performs security evaluation of trading partner organizations, supply chain information collection, etc. In one embodiment, the information processing system 1 is composed of one or more devices or components. These components will be described below.

[0017] <Server device 10> Fig. 2 is a block diagram showing the hardware configuration of server device 10 and source organization terminal 20. As shown in Fig. 2A, server device 10 includes a control unit 11, a storage unit 12, a communication unit 13, and a communication bus 14. Control unit 11, storage unit 12, and communication unit 13 are electrically connected inside server device 10 via communication bus 14.

[0018] <Control unit 11> The control unit 11 performs processing and control of the overall operation related to the server device 10. The control unit 11 is, for example, a central processing unit (CPU). The control unit 11 realizes various functions related to the server device 10 by reading out a predetermined program stored in the storage unit 12. That is, information processing by software stored in the storage unit 12 can be specifically realized by the control unit 11, which is an example of hardware, and executed as each functional unit included in the control unit 11. These will be described in more detail in the next section. Note that the control unit 11 is not limited to being single, and multiple control units 11 may be provided for each function. Furthermore, the control unit 11 may have a configuration that combines these.

[0019] <Storage section 12> The storage unit 12 stores various information defined by the above description. This can be implemented, for example, as a storage device such as a solid state drive (SSD) that stores various programs and the like related to the server device 10 executed by the control unit 11, or as a memory such as a random access memory (RAM) that stores temporarily required information (arguments, arrays, etc.) related to the program calculations. The storage unit 12 stores various programs, variables, etc. related to the server device 10 executed by the control unit 11.

[0020] <Communications Division 13> The communication unit 13 is preferably a wired communication means such as USB, IEEE1394, Thunderbolt (registered trademark), wired LAN network communication, etc., but may also include wireless LAN network communication, mobile communication such as 3G / LTE / 5G, BLUETOOTH (registered trademark) communication, etc. as necessary. In other words, it is more preferable to implement it as a collection of multiple communication means. In other words, the server device 10 may communicate various information from the outside via the communication unit 13 and the network.

[0021] The server device 10 may be in an on-premise form or in a cloud form. The server device 10 in a cloud form may provide the above-mentioned functions and processes in the form of, for example, SaaS (Software as a Service) or cloud computing.

[0022] <Transaction source organization terminal 20> The source organization terminal 20 is an information processing terminal used by the source organization (an organization that has a counterparty in a transaction) or its personnel. Transactions can include all types of transactions, such as the provision of commercial materials (goods and services) and outsourcing of business. In addition, the term "organization" includes profit-making corporations (e.g., companies, etc.), non-profit corporations (e.g., cooperatives, foundations, etc.), and public corporations (e.g., local governments, etc.).

[0023] A trading organization is an organization that requests a transaction with a trading partner organization, and receives and uses the merchandise provided by the trading partner organization. For example, if the merchandise being traded is an object, the trading organization is the purchaser of the item (finished product or parts) manufactured by the trading partner organization. Also, for example, if the merchandise being traded is a service, the trading organization is the user of the service provided by the trading partner organization. Furthermore, for example, if the merchandise being traded is work (task), the trading organization is the requesting or outsourcing company for the work.

[0024] From the perspective of a trading partner organization, a trading organization may be a trading supplier, a requesting supplier, an ordering supplier, a buyer, a parent company, etc. Trading organizations include end users, intermediaries, etc. in a supply chain. End users include, for example, final product manufacturers, trading companies, and communication companies. Intermediaries include, for example, parts manufacturers, material manufacturers (intermediate manufacturers), processors, distributors, and intermediate wholesalers. A trading organization can also be a trading partner organization for another trading organization.

[0025] 2B, source organization terminal 20 includes control unit 21, memory unit 22, communication unit 23, input unit 24, output unit 25, and communication bus 26. Control unit 21, memory unit 22, communication unit 23, input unit 24, and output unit 25 are electrically connected via communication bus 26 inside source organization terminal 20. Description of control unit 21, memory unit 22, and communication unit 23 will be omitted since they are similar to the descriptions of the respective units in server device 10.

[0026] <Input section 24> The input unit 24 accepts an operation input made by a user. The operation input is transferred as a command signal to the control unit 21 via the communication bus 26. The control unit 21 may execute a predetermined control or calculation based on the transferred command signal as necessary. The input unit 24 may be included in the housing of the source organization terminal 20, or may be externally attached. For example, the input unit 24 may be implemented as a touch panel integrated with the output unit 25. When the input unit 24 is implemented as a touch panel, the user can input a tap operation, a swipe operation, or the like to the input unit 24. As the input unit 24, a switch button, a mouse, a track pad, a QWERTY keyboard, or the like can be adopted instead of a touch panel.

[0027] <Output section 25> Output unit 25 displays a screen of a graphical user interface (GUI) that can be operated by a user. Output unit 25 may be included in the housing of source organization terminal 20 or may be attached externally. Specifically, output unit 25 may be implemented as a display device such as a CRT display, a liquid crystal display, an organic EL display, a plasma display, or the like. It is preferable that these display devices are implemented by selectively using them according to the type of source organization terminal 20.

[0028] <Evaluator Terminal 30> The evaluator terminal 30 is an information processing terminal used by an evaluator who evaluates the response of a business partner organization. The evaluator is an organization such as a company that performs security evaluation (for example, a security evaluation company that performs security evaluation of services such as cloud services, software, etc.) or a person in charge thereof. The evaluator performs service evaluation from the evaluator terminal 30 via the information processing system 1, for example.

[0029] 3 is a block diagram showing the hardware configuration of the evaluator terminal 30 and the trading partner organization terminal 40. As shown in FIG. 3A, the evaluator terminal 30 includes a control unit 31, a storage unit 32, a communication unit 33, an input unit 34, an output unit 35, and a communication bus 36. The control unit 31, the storage unit 32, the communication unit 33, the input unit 34, and the output unit 35 are electrically connected inside the evaluator terminal 30 via the communication bus 36. The description of the control unit 31, the storage unit 32, the communication unit 33, the input unit 34, and the output unit 35 of the evaluator terminal 30 will be omitted because they are the same as the description of each unit in the trading partner organization terminal 20.

[0030] <Business partner organization terminal 40> The business partner organization terminal 40 is an information processing terminal used by a business partner organization (an organization that receives a transaction from another organization) or its personnel. Business partner organizations include first-order business partner organizations that receive a transaction directly from a source organization, and second-order business partner organizations that receive a second-order transaction from a first-order business partner organization. In other words, the business partner organization terminal 40 is a terminal used by a first-order business partner organization or an Nth-order business partner organization (N>1) from the source organization's perspective. The first-order business partner organization and the Nth-order business partner organization for one transaction target constitute a supply chain for that transaction target. The transaction target includes traded merchandise, commissioned work, etc. The business partner organization may also include an individual business owner that receives a transaction.

[0031] A trading partner organization is an organization that is downstream of a trading partner organization in a supply chain. From the perspective of a trading partner organization, the trading partner organization may be a trading partner, a subcontractor (including a subcontractor, a sub-subcontractor, etc.), a vendor, a supplier, a seller, a subsidiary, etc. A trading partner organization may include a business entity other than an end user in a supply chain.

[0032] 3B, the trading partner organization terminal 40 includes a control unit 41, a memory unit 42, a communication unit 43, an input unit 44, an output unit 45, and a communication bus 46. The control unit 41, the memory unit 42, the communication unit 43, the input unit 44, and the output unit 45 are electrically connected inside the trading partner organization terminal 40 via the communication bus 46. The explanation of the control unit 41, the memory unit 42, the communication unit 43, the input unit 44, and the output unit 45 of the trading partner organization terminal 40 will be omitted because they are the same as the explanation of each unit in the trading source organization terminal 20.

[0033] 2. Functional configuration In this section, the functional configuration of the present embodiment will be described. Information processing by software stored in the storage unit 12 is specifically realized by the control unit 11, which is an example of hardware, and can be executed as each functional unit included in the control unit 11 (at least one processor included in the information processing system 1).

[0034] Fig. 4 is a block diagram showing functions realized by the server device 10 (control unit 11). As shown in Fig. 4, the server device 10 (control unit 11) includes a basic display control unit 111, a transaction investigation request receiving unit 112A, a security investigation request receiving unit 112B, a form sending unit 113, a ticket management unit 114, a first answer receiving unit 115A, a second answer receiving unit 115B, an answer registration unit 116, a hierarchical structure display control unit 117, a progress display control unit 118, an investigation list display control unit 119, and an artificial intelligence unit 120.

[0035] Fig. 5 is a block diagram showing functions realized by the source organization terminal 20 (control unit 21), the evaluator terminal 30 (control unit 31), and the destination organization terminal 40 (control unit 41). As shown in Fig. 5A, the source organization terminal 20 (control unit 21) includes a display unit 211 and an operation acquisition unit 212. As shown in Fig. 5B, the evaluator terminal 30 (control unit 31) includes a display unit 311 and an operation acquisition unit 312. As shown in Fig. 5C, the destination organization terminal 40 (control unit 41) includes a display unit 411 and an operation acquisition unit 412.

[0036] <Basic display control unit 111> The basic display control unit 111 is configured to display various information on the trading source organization terminal 20, the evaluator terminal 30, and the trading partner organization terminal 40. For example, the basic display control unit 111 displays an input form in which the trading partner organization inputs its response, the response input by the trading partner organization, the evaluation result by the evaluator, etc. on the display unit 211 of the trading source organization terminal 20, the display unit 311 of the evaluator terminal 30, or the display unit 411 of the trading partner organization terminal 40.

[0037] <Transaction investigation request reception unit 112A> The transaction investigation request receiving unit 112A is configured to receive, as first request information, from a source organization, whether or not a second transaction investigation is necessary for a trading partner organization with which a transaction of a trading target is conducted. The second transaction investigation is an investigation of a trading partner organization's transaction with another organization of the trading partner. For example, the second transaction investigation is an investigation of the presence or absence of Nth-order trading partner organizations (N>1) from the source organization, such as a third-order trading partner organization that receives a third-order transaction from the second-order trading partner organization, in addition to a second-order trading partner organization that receives a second-order transaction directly from the first-order trading partner organization, and may be read as an "Nth-order transaction investigation." The second transaction investigation may also be called a "subcontractor investigation." In other words, the transaction investigation request receiving unit 112A receives a request from a first-order trading partner organization to provide information on an Nth-order trading partner organization (an Mth-order trading partner organization (M≧1) from the first-order trading partner organization's perspective). The second transaction investigation may be an investigation of the constituent organizations of a sub-supply chain formed by a trading partner organization with respect to the trading target.

[0038] When a trading source organization directly trades with multiple first-level trading partner organizations for one trading target, the trading investigation request receiving unit 112A receives the necessity of a second trading investigation for the multiple first-level trading partner organizations. In other words, the first request information may include the necessity of a second trading investigation for the multiple first-level trading partner organizations.

[0039] The transaction investigation request receiving unit 112A may further receive, as the first request information, whether or not a secondary transaction investigation is required for the secondary trading partner organization with which the secondary transaction of the transaction target is conducted. This allows the source organization to directly request a secondary transaction investigation for the secondary trading partner organization that the source organization knows. Note that the "secondary transaction investigation for the Nth trading partner organization" refers to an investigation of trading partners downstream of the Nth trading partner organization (i.e., the N+1th trading partner organization and onward).

[0040] The transaction investigation request receiving unit 112A receives input of the name of the trading partner organization and whether or not a secondary transaction investigation is required for the trading partner organization, for example, at the trading source organization terminal 20. The necessity of the secondary transaction investigation is input, for example, by selecting an option indicating the necessity. The trading partner organization name may be selected from those registered in advance.

[0041] The transaction investigation request receiving unit 112A may receive whether or not secondary transactions are prohibited for a trading partner organization. The transaction investigation request receiving unit 112A sets the secondary transaction investigation as "unnecessary" for a trading partner organization for which a prohibition of secondary transactions has been input in the trading source organization terminal 20 (a trading partner organization for which "prohibition of secondary transactions (re-entrustment)" is set as an attribute) (i.e., sets the initial value of the necessity of secondary transaction investigation as "unnecessary" or receives the first request information in which the necessity of secondary transaction investigation is set as "unnecessary"). On the other hand, for a trading partner organization for which secondary transactions are not prohibited (prohibition of secondary transactions has not been input), the transaction investigation request receiving unit 112A separately receives an input of the necessity of secondary transaction investigation. In other words, the transaction investigation request receiving unit 112A does not receive an input of the necessity of secondary transaction investigation for a trading partner organization for which secondary transactions are prohibited.

[0042] <Security Investigation Request Reception Department 112B> The security investigation request receiving unit 112B is configured to receive the necessity or type of security investigation for the trading partner organization from the trading source organization as second request information. The security investigation is an investigation on the security of the trading partner organization. The security that is the target of the security investigation includes, for example, the security of the trading partner organization itself, the security of the transaction target (i.e., the products, business, etc. provided by the trading partner organization), etc.

[0043] The necessity and type of security investigation is selected depending on, for example, the type of transaction subject, the type of information handled (for example, whether specific information such as personal information is handled), the importance of the trading partner organization, the scope of responsibility borne by the primary trading partner organization and the trading source organization, the risk tolerance of the trading source organization, etc. Furthermore, the type of security investigation is determined, for example, by the number of questions, the types of questions, etc. For example, two types of security investigation may be provided: a "regular investigation" and a "simplified investigation" which asks fewer questions than a "regular investigation."

[0044] When a trading source organization directly trades with multiple first-level trading partner organizations for one trading object, the trading investigation request receiving unit 112A receives the necessity or type of security investigation for the multiple first-level trading partner organizations. In other words, the second request information may include the necessity or type of security investigation for the multiple first-level trading partner organizations.

[0045] The security investigation request receiving unit 112B may further receive the necessity or type of security investigation for the second-level business partner organization as second request information. This allows the source organization to directly request a security investigation from the second-level business partner organization that the source organization knows.

[0046] The security investigation request receiving unit 112B does not accept a request for a security investigation from the source organization terminal 20 for a trading partner organization for which a prohibition on secondary transactions is set. In other words, the source organization cannot select "security investigation is required" for a trading partner organization for which a prohibition on secondary transactions is set.

[0047] The security investigation request receiving unit 112B receives input of the name of the trading partner organization and the necessity or type of a security investigation for the trading partner organization, for example, from the trading source organization terminal 20. The necessity or type of security investigation is input, for example, by selecting an option indicating the necessity or type. The trading partner organization name may be selected from those registered in advance. The trading partner organization name may be received by both the transaction investigation request receiving unit 112A and the security investigation request receiving unit 112B from a single input field. In other words, a part of the input form for the first request information for the transaction investigation request receiving unit 112A and a part of the input form for the second request information for the security investigation request receiving unit 112B may be common.

[0048] The security investigation request receiving unit 112B may receive input of attributes of the trading partner organization from the trading source organization, and may present the trading source organization with options for selecting the necessity or type of security investigation, with initial values ​​set based on the attributes of the trading partner organization. This enables the trading source organization to manage the supply chain based on the attributes of the trading partner organization, and reduces the input burden on the trading source organization regarding the security investigation request.

[0049] The attributes of the trading partner organization include attributes related to the organization, attributes related to the transaction target, etc. Examples of the attributes related to the organization include the location or nationality (region, country, etc.) of the organization, the type of business, the business format, the size (number of employees, etc.), whether the organization is a corporation or an individual, etc. Examples of the attributes related to the transaction target include the type of transaction target, the business scale, the distribution channel, and consignment information. The attributes of the trading partner organization may also include important attributes that indicate that the trading partner organization is important to the trading source organization (for example, a trading partner organization with no alternatives, etc.). The attributes of the trading partner organization are input, for example, by selecting an input object such as a check box indicating an attribute displayed on the trading source organization terminal 20. An initial value of the attribute may also be assigned to the trading partner organization, for example, by referring to an organization database.

[0050] The security investigation request receiving unit 112B may receive, as an attribute of the business partner organization, an input of an information deposit attribute indicating that the business partner organization is to receive the deposit of specific information from the business partner organization. The "specific information" includes, for example, highly important information such as personal information, confidential information, and information for which the use should be limited.

[0051] The security investigation request receiving unit 112B sets an initial value for the necessity or type of security investigation (hereinafter, "investigation initial value") based on the attributes set for the business partner organization and the reference information. The reference information includes a correlation between the attributes and the investigation initial value, and is stored, for example, in the storage unit 12. The reference information includes, for example, a table, an algorithm, or the like that defines an attribute or a combination of multiple attributes and the corresponding investigation initial value.

[0052] For example, the security investigation request receiving unit 112B sets the investigation initial value as "security investigation with simple investigation" based on the reference information for a business partner organization to which the information deposit attribute is not set (for example, does not accept the deposit of personal information). Also, for example, the security investigation request receiving unit 112B may set the investigation initial value as "security investigation with normal investigation" for a business partner organization to which the information deposit attribute is set (for example, handles important information) or to which the attribute "important contractor" is set.

[0053] Also, for example, the security investigation request receiving unit 112B may set the investigation initial value to "no security investigation" depending on the business of the business partner organization.

[0054] The security investigation request receiving unit 112B displays a field on the source organization terminal 20 for selecting the necessity or type of security investigation, with, for example, an investigation default value (e.g., "Do not investigate") initially selected and the source organization being able to modify the selection.

[0055] If there is no need to change the investigation initial value, the transacting organization, with the investigation initial value selected, confirms the request for security investigation in the transacting organization terminal 20. On the other hand, if there is a need to change the investigation initial value, the transacting organization selects an option other than the investigation initial value in the transacting organization terminal 20, and then confirms the request for security investigation.

[0056] The request for the security investigation may be made before the request for the second transaction investigation, or may be made after the response to the second transaction investigation (the response to the second response form). In other words, the security investigation request receiving unit 112B may receive a request for a security investigation for a business partner organization included in the response to the second transaction investigation (a business partner organization newly added to the supply chain).

[0057] <Investigation request reception screen> Fig. 6 is a diagram showing an example of the first investigation reception screen SD1 displayed on the trading organization terminal 20. Fig. 7 is a diagram showing an example of the first investigation reception screen SD1 in which a trading partner organization has been entered. The first investigation reception screen SD1 includes a case input field CF, a trading partner input field BF, and a Create button B11. The case input field CF accepts input of the case name (name of trading partner), case summary (summary of the outsourced work in the examples of Figs. 6 and 7), etc.

[0058] The business partner input field BF accepts input of business partner organization information, investigation request details, etc. The business partner input field BF includes an organization registration field OF and an information input field IF. The organization registration field OF accepts input of the business partner organization's name and the business partner organization's hierarchy in the supply chain (information indicating the level of the business partner). Specifically, the organization registration field OF displays an organization name input frame NF, a move object MO, an edit object EO, a detail display object SO, an add organization object AO, and an import object IO.

[0059] The organization name input frame NF accepts input of the name of the outsourced organization. A number indicating the tier of the business partner is displayed at the beginning of the organization name input frame NF. Moving objects MO are assigned to the organization name input frames NF one by one, and accept the operation of moving the corresponding organization name input frame NF up and down. Specifically, by selecting a moving object MO and dragging it, the displayed row of the organization name input frame NF will change.

[0060] The editing objects EO are assigned to the organization name input frames NF one by one, and accept changes and deletions to the hierarchical level of the corresponding organization name input frame NF. Specifically, when an input operation is performed on the left arrow included in the editing object EO, the corresponding organization name input frame NF moves to the next higher hierarchical level. Also, when an input operation is performed on the right arrow included in the editing object EO, the corresponding organization name input frame NF moves to the next lower hierarchical level. As shown in FIG. 7, the left and right display positions of the organization name input frames NF are determined according to the hierarchical level. Specifically, the lower the hierarchical level of an organization, the further to the right it is displayed. Also, when an input operation is performed on the cross included in the editing object EO, the corresponding organization name input frame NF is deleted.

[0061] A detail display object SO is assigned to each organization name input frame NF, and displays detailed information (request setting items) of the business partner organization in the corresponding organization name input frame NF in the information input field IF. The organization addition object AO accepts input for adding the organization name input frame NF to the organization registration field OF. The import object IO accepts input for importing business partner organization information, supply chain information, etc.

[0062] The information input field IF accepts input of detailed information, attributes, and the necessity or type of security investigation of the business partner organization. Specifically, the information input field IF displays an organization information input area OA, an attribute input area AA, and an investigation input area SA. The organization information input area OA is an area for displaying and accepting input of the company name, corporate number, address, contact information (person in charge), etc. of the business partner organization selected in the organization registration field OF. The information of the business partner organization may be automatically acquired from, for example, an organization database (master information).

[0063] The attribute input area AA is an area for receiving input of attributes of the business partner organization selected in the organization registration field OF, and for example, attribute options are displayed together with selection reception objects such as check boxes. The investigation input area SA is an area for receiving input of the necessity or type of security investigation for the business partner organization selected in the organization registration field OF, and for example, options indicating the necessity or type of security investigation are displayed together with multiple-choice selection reception objects such as radio buttons.

[0064] When an input operation is performed on the Create button B11, the information of the business partner organization input in the business partner input field BF, the necessity or type of security investigation, etc. are registered in a supply chain database in the storage unit 12, for example.

[0065] Fig. 8 is a diagram showing an example of the second investigation reception screen SD2 displayed on the trading organization terminal 20. The second investigation reception screen SD2 is a screen for requesting a second transaction investigation from a trading partner organization. The second investigation reception screen SD2 is called up by an instruction to request a transaction investigation from the trading organization terminal 20 (for example, input of a transaction target that causes the second investigation reception screen SD2 to be displayed) after, for example, information on the trading partner organization is registered on the first investigation reception screen SD1 in Fig. 7.

[0066] The second investigation reception screen SD2 includes a request destination selection area RA1 and a request button B21. In the request destination selection area RA1, at least one trading partner organization PO entered in the first investigation reception screen SD1 is displayed as a choice along with the supply chain hierarchy (information indicating which level of trading partner). Each trading partner organization PO is assigned a selection reception object, such as a check box. The trading organization selects the trading partner organization PO for which to request a second transaction investigation by inputting information into the selection reception object on the trading partner organization terminal 20.

[0067] In the request destination selection area RA1, an additional information frame AF of a business partner organization PO is displayed in response to selection of the business partner organization PO (e.g., clicking, tapping, hovering the pointer over the business partner organization PO, etc.). In the additional information frame AF, a display field or an input acceptance field for the person in charge of the business partner organization PO, a label indicating the attributes assigned to the business partner organization PO, etc. are displayed.

[0068] When at least one business partner organization PO is selected as a request recipient for the second business investigation, if an input operation is performed on the Request button B21, a first reply form, which will be described later, is sent to the selected business partner organization PO.

[0069] 9 is a diagram showing an example of the third investigation reception screen SD3 displayed on the trading organization terminal 20. The third investigation reception screen SD3 is a screen for requesting a security investigation from a trading partner organization. The third investigation reception screen SD3 is called up by an instruction to request a security investigation from the trading partner organization terminal 20 (for example, input of a trading target that causes the third investigation reception screen SD3 to be displayed) after, for example, information on the trading partner organization is registered on the first investigation reception screen SD1 in FIG. 7.

[0070] The third investigation reception screen SD3 includes a request content input area CA, a request recipient selection area RA2, and a request button B31. The request content input area CA accepts input of, for example, the name of the organization requesting the investigation (the name of the transaction recipient organization), the case name (the name of the transaction recipient), the request background, remarks, priority, etc. At least a part of the information entered in the request content input area CA is sent to the organization to which the security investigation is requested together with the second answer form described below or as a part of the second answer form.

[0071] The request destination selection area RA2 displays the number of tickets TN, a filter selection object FO, and at least one request setting area RF. The number of tickets TN is the remaining number of security investigation tickets of the trading organization, which will be described later. The filter selection object FO is an object for inputting or selecting a filter that narrows down the trading partner organizations for which the request setting area RF is displayed, among the trading partner organizations registered in the supply chain database by the first investigation reception screen SD1 or the like.

[0072] One request setting area RF is displayed for each business partner organization. In the request setting area RF, there are displayed an object (check box in the example of FIG. 9) for accepting the selection of the business partner organization's attributes, an object (check box in the example of FIG. 9) for accepting the selection of whether or not a security investigation is required, an object (check box in the example of FIG. 9) for accepting the selection of the type of security investigation, and an input field for accepting the input of the destination of the security investigation request. For example, in the first investigation reception screen SD1, when the business partner organization's attributes, whether or not a security investigation is required, or the type of security investigation have already been entered (i.e., when this information has already been registered in the supply chain database), the request setting area RF displays the option of "Already entered" (already registered) as the initial value for the attributes, whether or not a security investigation is required, or the type of security investigation.

[0073] Note that reselection (modification of the initial value) of at least one of the attributes of the business partner organization, the need for a security investigation, and the type of security investigation may not necessarily be accepted in the request setting area RF. Furthermore, of the attributes of the business partner organization, the need for a security investigation, and the type of security investigation, only the type of security investigation may be editable. Also, if neither "simple investigation" nor "do not investigate" is selected, a normal investigation is selected as the type of security investigation.

[0074] In the request destination selection area RA2, the multiple request setting areas RF are displayed in a form showing the supply chain entered in the first investigation reception screen SD1. That is, the multiple request setting areas RF are connected by lines showing the flow of the transaction object, and are displayed at positions showing the respective hierarchical levels.

[0075] When an input operation is performed on the request button B31 when a security investigation is required in at least one request setting area RF, a second response form, described below, corresponding to the selected type of security investigation is sent to the business partner organization for which a security investigation is required.

[0076] <Form sending section 113> The form sending unit 113 is configured to send a first answer form for inputting a response to the secondary transaction investigation to the trading partner organization in response to the first request information received by the transaction investigation request receiving unit 112A, and to send a second answer form for inputting a response to the security investigation to the trading partner organization in response to the second request information received by the security investigation request receiving unit 112B.

[0077] The form sending unit 113 may send a first answer form to the second business partner organization in response to the first request information, and may send a second answer form to the second business partner organization in response to the second request information. That is, if the first request information accepted by the transaction investigation request accepting unit 112A includes a request for a second transaction investigation for the second business partner organization, the form sending unit 113 also sends the first answer form to the second business partner organization. In addition, if the second request information accepted by the security investigation request accepting unit 112B includes a request for a security investigation for the second business partner organization, the form sending unit 113 also sends the second answer form to the second business partner organization.

[0078] The first answer form and the second answer form are created and sent for each transaction target, respectively. The order in which the first answer form and the second answer form are sent does not matter, and the first answer form may be sent before the second answer form, or the second answer form may be sent before the first form, for the same transaction target organization.

[0079] The form sending unit 113 sends the first answer form to trading partner organizations (first-level trading partner organizations and N-level trading partner organizations) for which a second transaction investigation is required. In addition, the form sending unit 113 sends a second answer form corresponding to the selected type of security investigation to trading partner organizations for which a security investigation is required. For example, a second answer form with a large number of questions (e.g., about 120 items) is sent to trading partner organizations for which "regular investigation" is selected as the type of security investigation, and a second answer form with fewer questions than a "regular investigation" (e.g., about 30 items) is sent to trading partner organizations for which "simple investigation" is selected as the type of security investigation.

[0080] <Ticket Management Department 114> The ticket management unit 114 is configured to manage security investigation tickets required for a source organization to send a second answer form. Specifically, the ticket management unit 114 consumes security investigation tickets granted to the source organization according to the number of second answer forms sent to the source organization and the second-order source organization. This makes it possible to suppress requests for security investigations to organizations that do not require security investigations.

[0081] When the form sending unit 113 sends the second answer form to the third-level business partner and onwards, the security investigation tickets may be consumed according to the number of second answer forms sent. In other words, the ticket management unit 114 may consume the security investigation tickets given to the business partner organization according to the number of second answer forms sent to the first-level business partner organization and the Nth-level business partner organization (N>1).

[0082] The ticket management unit 114 increases the stock of security investigation tickets in response to the purchase of security investigation tickets by the source organization. Furthermore, security investigation tickets may be given to the source organization free of charge as a special gift or the like.

[0083] <First reply receiving section 115A> The first answer receiving unit 115A is configured to receive answers to the first answer form from trading partner organizations (first-order trading partner organizations and N-th order trading partner organizations). The first answer form includes, for example, an input field for information (organization name, person in charge, attributes, etc.) of the N-th order trading partner organization that is an N-th order trading partner (N>1) from the trading source organization.

[0084] The information of the trading partner organization entered in the first answer form is the same as the information of the trading partner organization entered by the trading source organization in the transaction investigation request receiving unit 112A. That is, the answer to the first answer form may include the attribute of the second-level trading partner organization. The answer to the first answer form may also include the presence or absence of the information deposit attribute of the second-level trading partner organization.

[0085] The answer received by the first answer receiving unit 115A is registered in the supply chain database. Note that, unlike the second answer form, the answer to the first answer form is not evaluated by an evaluator.

[0086] FIG. 10 is a diagram showing an example of the first answer form display screen FD displayed on the business partner organization terminal 40. The first answer form display screen FD includes requester information CI, a transaction information field DF, a business partner input field BF, and a send button B41, which constitute the first answer form. The requester information CI includes information indicating the requester (business partner organization). The transaction information field DF displays the requestee (business partner organization), the subject of the transaction, and the handling of specific information such as personal information, or accepts input of these. The business partner input field BF is the same as the business partner input field BF in the first survey reception screen SD1. However, in the business partner input field BF in the first answer form, the survey input area SA is not displayed in the information input field IF.

[0087] When an input operation is performed on the send button B41, the answer (information of the Nth-order trading partner organization) entered in the first answer form is sent to the server device 10. Furthermore, sub-supply chain information based on the answer entered in the first answer form is sent from the server device 10 to the trading organization terminal 20.

[0088] <Second reply receiving section 115B> The second answer receiving unit 115B is configured to receive answers to the second answer form from business partner organizations (first-order business partner organizations and N-order business partner organizations). The second answer form includes a plurality of questions regarding security at the business partner organizations. The questions included in the second answer form may include a so-called security checklist.

[0089] The answers to the questions are obtained as evaluation information for the evaluator to prepare a report or report on the security of the trading organization. The evaluation information may be evaluated only once or multiple times. That is, the evaluation of the evaluation information may include an initial evaluation (so-called review), an interim evaluation, a final evaluation, etc. The initial evaluation and the interim evaluation are evaluations in which a further evaluation is performed after the evaluation. The multiple evaluations may be performed by the same evaluator or by different evaluators (so-called reviewers, etc.). The final evaluation creates an evaluation to be used in a report or report to be provided to the trading organization.

[0090] The evaluation information is registered, for example, in a response database in the storage unit 12. The response to each question included in the evaluation information is the response entered by the trading organization for each question presented in the input form, and registered in the response database. The response to one question may be hierarchical.

[0091] The questions in the second response form may include, for example, questions regarding security certification or evaluation, service levels, scope of responsibility, security measures within the source organization, handling of data created by the counterpart organization, and service development, maintenance, or operation policies (e.g., account management) (requesting responses from the source organization).

[0092] The second answer form may include transaction-related questions about the transaction target, and organization-related questions about the transaction target organization itself, which is independent of the transaction target. "Transaction-related questions" are questions to confirm, for example, the security measures for the products and services provided by the transaction target organization. "Organization-related questions" are questions to confirm, for example, the information management system and security policy of the transaction target organization.

[0093] The second answer receiving unit 115B may receive an answer to a second answer form in which an already-entered answer to an answered question has been entered in advance, for a question that is the same as or similar to an already-entered question registered by the answer registration unit 116 described below. This eliminates the need to enter an answer to a question that has already been answered in the past, and therefore reduces the amount of work required for a business partner organization to enter an answer into the second answer form.

[0094] The similarity of two questions is determined, for example, by comparing vector data obtained by vectorizing the content of the answered question with vector data obtained by vectorizing the content of the question in the second answer form. The similarity criterion between questions is a threshold value for the difference (vector distance) in the vector data of two questions, and questions whose vector data difference is less than the threshold value (for example, cosine similarity is equal to or greater than a threshold value) are determined to be similar to each other.

[0095] The second answer receiving unit 115B may input the answered question and the question in the second answer form to a similarity determination model of the artificial intelligence unit 120, cause the similarity determination model to output the similarity between the two, and determine the similarity between the answered question and the question in the second answer form based on the similarity. The similarity determination model is a learning model that is trained so as to be able to input two questions and output the similarity between the two questions.

[0096] The similarity determination model is a learning model that is trained using a combination of a set of learning questions and the similarity and similarity corresponding to the set of questions as teacher data. The similarity determination model may be a generation AI including a large-scale language model. In this case, the second answer receiving unit 115B receives the answered question and the question in the second answer form as input, inputs a prompt including an instruction to output the similarity and similarity of the two questions to the similarity determination model, and causes the similarity determination model to output the similarity. The second answer receiving unit 115B may generate a prompt that gives an instruction to the similarity determination model to output the similarity and similarity between the answered question and the answer in the second answer form, and inputs the prompt to the similarity determination model. The second answer receiving unit 115B may also input a prompt into which, in addition to the output instruction of the similarity and similarity and the answered question and the question in the second answer form, one or more samples of the answered question and the question in the second answer form and one or more samples of the similarity and similarity corresponding thereto are inserted as input and output samples to the similarity determination model. The similarity determination model outputs the degree of similarity or dissimilarity between the answered question and the question in the second answer form according to the input prompt.

[0097] Furthermore, the second answer receiving unit 115B may input previously input answers to organization-related questions that are the same as or similar to the answered questions. This eliminates the need to input answers to organization-related questions whose answer content is constant regardless of the business partner, greatly reducing the amount of work required for business partner organizations to answer.

[0098] The answer accepted by the second answer accepting unit 115B is registered by the answer registering unit 116 described below, and is evaluated by the evaluator (input and registration of the evaluation by the evaluator terminal 30). "Evaluation" refers to the act of checking whether there are any deficiencies in the answer included in the evaluation information, making comments on the content of the answer, scoring the answer, etc.

[0099] For example, when evaluation is performed in two stages, the initial evaluation (review) involves checking for deficiencies and creating issues. Subsequently, the evaluation information after the initial evaluation is evaluated as a final evaluation, such as scoring the content (answer) of the evaluation information and creating comments on the entire evaluation information, and a report or report (e.g., a security report) including the results is created. The report or report is created by the final evaluator or an evaluation unit possessed by the control unit 11. The evaluation unit is configured to generate a part or the whole of the report or report based on the input evaluation information. The evaluation result of the evaluation information may be included in the report or report as a part of the report or report or as reference information. The report or report is transmitted to the transaction source organization terminal 20.

[0100] Furthermore, a supply chain score, which is a security score for the entire supply chain, may be calculated using the evaluation scores of each trading partner organization. The supply chain score is calculated as the evaluation score with the highest risk (lowest evaluation) among the evaluation scores of multiple trading partner organizations connected by the flow of trading objects in the supply chain, for example.

[0101] The supply chain score may be calculated by multiplying the evaluation scores of multiple trading partner organizations by a coefficient for each trading partner organization. This coefficient is set according to, for example, the proportion of contribution to the provision of the commercial material being traded (degree of dependence), the importance or amount of information entrusted, the business form, organizational size, location, contract amount, the importance of the technology being used, etc.

[0102] <Answer Registration Section 116> The answer registration unit 116 is configured to register answered questions of the business partner organization in the security investigation and the answers entered by the business partner organization to the answered questions in the answer database. The answered questions may be answered using the second answer form or may be answered using a form other than the second answer form.

[0103] <Hierarchical structure display control unit 117> The hierarchical structure display control unit 117 is configured to display, based on the answer to the first answer form by the trading partner organization, a trading hierarchical structure showing the trading relationships of the trading targets, including the trading partner organization and the secondary trading partner organization with which the secondary transaction of the trading targets is conducted, on the trading source organization terminal 20. This allows the trading source company to consider the necessity and type of security investigation while getting an overview of the trading relationships.

[0104] The "transaction relationship" is, for example, the flow of merchandise that is the subject of a transaction. The "transaction hierarchical structure" is, for example, a block diagram or a node diagram showing the supply chain of one subject of a transaction.

[0105] The hierarchical structure display control unit 117 may display a transaction hierarchical structure including a specific information flow on the trading organization terminal 20 based on the information deposit attributes of each trading partner organization and second-level trading partner organization. This allows the trading organization to get an overview of the risks of information management in the supply chain.

[0106] The hierarchical structure display control unit 117 may display a transaction hierarchical structure in which labels indicating attributes are assigned to each of the trading partner organization and the second-level trading partner organization on the trading source organization terminal 20. This allows the trading source organization to grasp the positions of important trading partner organizations in addition to the trading relationships (flow of merchandise) in the transaction hierarchical structure, making it easier for the trading source organization to consider the necessity or type of security investigation.

[0107] The hierarchical structure display control unit 117 may display multiple transaction hierarchical structures associated with the same transacting organization in an overlapping manner. This makes it easier for the transacting organization to simultaneously grasp the transaction hierarchical structures for multiple transactions, and allows the transacting organization to confirm a transacting party organization that is common to multiple transaction hierarchical structures. For example, the hierarchical structure display control unit 117 may arrange multiple transaction hierarchical structures one by one in multiple layers, and display the multiple layers in an overlapping manner on the transacting organization terminal 20. The position of the layers (hierarchical relationship) can be switched, for example, by an instruction from the transacting organization terminal 20.

[0108] Furthermore, when a trading partner organization included in one trading hierarchical structure is also included in another trading hierarchical structure of the same trading source organization, the hierarchical structure display control unit 117 may display information indicating that in the trading hierarchical structure. For example, the hierarchical structure display control unit 117 may display a trading hierarchical structure in which a trading partner organization included in such multiple supply chains is labeled with a label indicating that the trading partner organization is also included in another supply chain.

[0109] Furthermore, the hierarchical structure display control unit 117 may display multiple transaction hierarchical structures associated with the same transaction source organization on one screen in an independent state without overlapping them. In this case, too, when a transaction partner organization included in one transaction hierarchical structure is also included in another transaction hierarchical structure of the same transaction source organization, the hierarchical structure display control unit 117 may display information indicating that in the transaction hierarchical structure.

[0110] 11 is a diagram showing an example of a hierarchical structure display screen HD displayed on the source organization terminal 20. The hierarchical structure display screen HD includes a hierarchical structure display field HF, a first investigation status display field SF1, a second investigation status display field SF2, and an information display field IDF.

[0111] The hierarchical structure display field HF displays a type selection object KO and a transaction hierarchical structure HS. In the transaction hierarchical structure HS, the transaction relationships for one transaction target are shown in a block diagram. In the transaction hierarchical structure HS in Figure 11, the transaction relationships are shown as lines connecting organizations, with the further down the hierarchy the lower the hierarchy. In the transaction hierarchical structure HS in Figure 11, two first-order trading partner organizations are shown in a parallel relationship, and transaction relationships are connected in series from each first-order trading partner organization to second-order trading partner organizations and third-order trading partner organizations.

[0112] In addition, in the transaction hierarchical structure HS, the flow (deposit) of specific information (for example, personal information) is highlighted with a thick line. Specifically, organizations (nodes) that handle specific information are highlighted (displayed with a thick frame) relative to other organizations (organizations that do not handle specific information). Furthermore, the flow (edge) of the transfer of specific information is also highlighted (displayed with a thick line) relative to other flows (flows that do not transfer specific information). Note that the highlighting may be performed by coloring, increasing the size, etc.

[0113] In addition, each organization included in the transaction hierarchy structure HS is displayed with a label LB indicating the organization's attributes, its security research evaluation score, whether it is included in other transaction hierarchy structures, etc.

[0114] The type selection object KO accepts an input for selecting the type of information to highlight in the transaction hierarchical structure HS. Examples of the information type include personal information, confidential information, and information for which use should be restricted.

[0115] The first investigation status display field SF1 displays the progress of the secondary transaction investigation for the trading partner organization selected in the transaction hierarchical structure HS. The second investigation status display field SF2 displays the progress of the security investigation for the trading partner organization selected in the transaction hierarchical structure HS. The information display field IDF displays information about the trading partner organization selected in the transaction hierarchical structure HS.

[0116] Fig. 12 is a diagram showing another example of a transaction hierarchical structure HS displayed on the hierarchical structure display screen HD of Fig. 11. In the transaction hierarchical structure HS of Fig. 12, one organization included in multiple transaction hierarchical structures is displayed in a form shared by these transaction hierarchical structures. In the example of Fig. 12, LLC CCC, which is an organization common to the transaction hierarchical structure shown by the solid line and the transaction hierarchical structure shown by the dashed line, is shared by the two transaction hierarchical structures and is highlighted with respect to the other organizations.

[0117] Fig. 13 is a diagram showing yet another example of the hierarchical structure display screen HD displayed on the source organization terminal 20. The hierarchical structure display screen HD in Fig. 13 displays a highlight setting object HO and a transaction hierarchical structure HS. The highlight setting object HO accepts input of organizations to be highlighted in the transaction hierarchical structure HS. In the example of Fig. 13, the highlight setting object HO accepts input or selection of the company name, case name, security investigation evaluation score, type of information handled, whether or not the client is an important client, and whether or not re-entrustment is possible.

[0118] The transaction hierarchy structure HS is a block diagram similar to the transaction hierarchy structure HS in Figure 11, and each organization included in the block diagram is displayed with a label LB indicating the organization's attributes, security investigation evaluation score, and whether it is also included in other transaction hierarchy structures.

[0119] In the transaction hierarchical structure HS in Fig. 13, organizations that satisfy the conditions selected in the highlight setting object HO are highlighted. Furthermore, when information is selected as the target for highlighting, the flow of that information is also highlighted. In the example of Fig. 13, "personal information" is selected in the highlight setting object HO, and organizations that handle personal information and the flow (deposit) of personal information are highlighted with thick lines.

[0120] Fig. 14 is a diagram showing a state where the hierarchical structure display screen HD in Fig. 13 has changed. When any organization included in the transaction hierarchical structure HS is selected on the hierarchical structure display screen HD in Fig. 13, a detailed information display area SIA for that organization is expanded as shown in Fig. 14. For example, the security investigation history, correction management status, case ledger, etc. of the selected organization are displayed in the detailed information display area SIA. Note that Fig. 14 shows a state where AAA Co., Ltd. has been selected in the transaction hierarchical structure HS.

[0121] <Progress display control unit 118> The progress display control unit 118 displays the progress of the secondary transaction investigation in the trading partner organization or the secondary trading partner organization where the secondary transaction of the trading target is conducted on the trading partner organization terminal 20. This allows the progress of the secondary transaction investigation in the supply chain, including the secondary trading partners and beyond, to be grasped.

[0122] In addition, data for secondary business partner surveys is registered and displayed without evaluation (review) by an evaluator. On the other hand, security surveys require evaluation by an evaluator, and data is registered and displayed after the evaluation is completed.

[0123] 15 is a diagram showing an example of a progress display screen PD displayed on the source organization terminal 20. The progress display screen PD includes a partner organization list field LF and a progress display field PF.

[0124] The trading partner organization list field LF displays a list of N-th order trading partner organizations that have requested a secondary trading partner survey (that have sent the first response form). The trading partner organization list field LF also displays the hierarchy of each trading partner organization using numbers and display positions indicating the hierarchy. The response status of the secondary trading partner survey is displayed for each trading partner organization. For example, "Response" indicates a state in which the first response form has been sent and the input of the response is being accepted, "Confirm" indicates a state in which the response has been entered and data checking is being performed for registration in the supply chain database, "Complete" indicates a state in which the response has been registered in the supply chain database (a state in which the response result is reflected in the trading hierarchical structure displayed on the trading source organization terminal 20), and "Added" indicates a state in which the secondary trading partner survey has not been performed for a trading partner organization that has been added by a response to the secondary trading partner survey of another trading partner organization, for example.

[0125] The progress display field PF displays detailed progress information of the secondary transaction investigation for the business partner organization selected in the business partner organization list field LF (for example, an input operation has been performed on the "Details" object). The business partner organization list field LF displays, for example, the progress of each step of the secondary transaction investigation request sending (sending the first response form), the response by the business partner organization, and the receipt (registration) of the response from the business partner organization, together with the date and time.

[0126] <Survey list display control unit 119> The investigation list display control unit 119 is configured to receive an instruction from the trading organization, to display on the trading organization terminal 20 a list of secondary transaction investigations and / or security investigations requested by the trading organization, and to receive another instruction from the trading organization, to display on the trading organization terminal 20 a list of secondary transaction investigations and / or security investigations requested by the trading organization as a trading partner organization for another trading organization. This makes it possible to centrally manage, by one application, the investigation status of a transaction (supply chain) starting from the trading organization itself and an investigation request in another transaction in which the trading organization constitutes a supply chain as a trading partner organization.

[0127] In the security evaluation system provided by the information processing system 1, the same organization can be both a transaction source (survey requester) and a transaction destination (survey responder). In other words, one organization can use one account to switch between the service usage form as a transaction source and the service usage form as a transaction destination.

[0128] The investigation list display control unit 119, for example, receives an instruction from the trading organization terminal 20 to display a list of investigation requests to trading partner organizations (hereinafter, "first list"), and causes the trading organization terminal 20 to display the first list. The first list includes, for example, the name or ID of the investigation, the type of investigation, the party to which the investigation is requested (the respondent), the investigation status, the request date, the completion date, etc. The first list may also include the evaluation of security investigations that have been evaluated (the evaluation score for each trading partner organization or the supply chain score for the entire supply chain).

[0129] The investigation list display control unit 119, upon receiving an instruction from the trading organization terminal 20 to display a list of investigation requests from other trading organizations (hereinafter, "second list"), displays the second list on the trading organization terminal 20. The second list includes, for example, the requesting organization (other trading organization), the type of investigation, the investigation status, the request date, the deadline, and the like.

[0130] FIG. 16 is a diagram showing an example of an investigation list display screen LD displayed on the trading organization terminal 20. The investigation list display screen LD includes a menu area MA and a display area DA. A mode switching object CO and a menu list ML are displayed in the menu area MA. The mode switching object CO accepts an operation to switch the investigation list displayed in the display area DA between a first list (trading organization mode) and a second list (trading partner organization mode). In the example of FIG. 16, when "entrustor" is selected, the first list (list of investigation requests as a trading partner organization) is displayed in the display area DA, and when "responder" is selected, the second list (list of investigation requests as a trading partner organization) is displayed.

[0131] The menu list ML displays a list of items to be displayed in the display area DA. In the example of Fig. 16, "Entrustor" is selected in the mode switching object CO, and "List of investigation requests" is selected in the menu list ML. The contents of the menu list ML change depending on the mode selected by the mode switching object CO.

[0132] The display area DA displays information according to the selection made in the menu area MA. In the example of Fig. 16, the display area DA displays a first list RL1 of investigations that have been requested to the trading partner organization. When an investigation included in the first list RL1 is selected, detailed information on the investigation contents (investigation result report) is displayed on the trading partner organization terminal 20.

[0133] 17 is a diagram showing an example of the investigation result display screen SRD displayed on the trading organization terminal 20. The investigation result display screen SRD includes a detailed information display field SIF, a supply chain display field SCF, a security evaluation display field SVF, and a response content display field ACF.

[0134] The detailed information display field SIF displays the survey target (information on the business partner organization), the survey content, etc. In the example of FIG. 17, the detailed information display field SIF is displayed in a collapsed state. The supply chain display field SCF displays the supply chain (transaction hierarchical structure) that includes the business partner organization being surveyed. The supply chain display field SCF displays labels indicating the attributes of each business partner organization, the security survey evaluation (score), etc.

[0135] The security evaluation display field SVF displays the evaluation results (report) by the evaluator on the answers to the security survey. The answer content display field ACF displays the answers to the security survey from the business partner organization (answers to the second answer form) along with the questions. The answer content display field ACF displays a filter setting area FSA for narrowing down the answers to be displayed.

[0136] Fig. 18 is a diagram showing another example of the investigation list display screen LD displayed on the source organization terminal 20. The investigation list display screen LD in Fig. 18 is displayed when the mode is switched from the source organization mode to the target organization mode by the mode switching object CO on the investigation list display screen LD in Fig. 16. In the example of Fig. 18, "Answering side" is selected in the mode switching object CO, and "Investigation request" is selected in the menu list ML. Also, in the example of Fig. 18, a second list RL2 of investigations requested by multiple source organizations is displayed in the display area DA.

[0137] <Artificial Intelligence Department 120> The artificial intelligence unit 120 is configured to receive input from each functional unit and return the instructed output. The artificial intelligence used by the server device 10 in each functional unit may be a common one, or may be prepared individually for each functional unit.

[0138] The artificial intelligence unit 120 is an AI (Artificial Intelligence) equipped with learning models such as Transformers including GPT (Generative Pretrained Transformer, including GPT-1, GPT-2, GPT-3, and GPT-4), BERT (Bidirectional Encoder Representations from Transformers), BART (Bidirectional and Auto-regressive Transformer), etc., and language models such as Recurrent Neural Networks (RNN), and may include a generative AI.

[0139] The language model is an example of a learning model based on a machine learning algorithm. Specific examples of machine learning algorithms include nearest neighbor methods, naive Bayes methods, decision trees, support vector machines, and deep learning using neural networks. The artificial intelligence unit 120 can apply the above algorithms as appropriate.

[0140] The artificial intelligence unit 120 may have a trained model constructed by a learning method such as supervised learning, unsupervised learning, or self-supervised learning. In supervised learning, machine learning is performed using training data (training data). The training data is composed of a pair of input data for learning and output data (correct answer data). In addition, the language model may not only be one trained for a specific task, but also a general-purpose model that can be used for a wide range of tasks.

[0141] The artificial intelligence unit 120 may be a general-purpose natural language processing learning model such as a large language model (LLM) that has learned a huge amount of data as an artificial intelligence. The LLM is a learning model that has learned a large amount of large data (for example, (i) web content on the Internet, or (ii) data stored in a specified database) composed of text data and the like in advance, and can execute various language processing tasks by giving tasks. According to a given prompt, it can perform a wide range of natural language processing tasks such as grasping sentence patterns and contexts, answering questions, and generating sentences. Such a general-purpose learning model includes a language model that can handle various tasks without fine tuning by One-shot Learning, Few-shot Learning, etc. In addition, the general-purpose learning model may be configured to be able to handle various tasks by Zero-shot Learning as well. The artificial intelligence used in each functional unit of the control unit 11 may be a separate learning model, or a common general-purpose learning model.

[0142] The learning model (such as a similarity determination model) included in the artificial intelligence unit 120 can perform additional learning as transfer learning or fine tuning. For example, each time new evaluation information, reports, or reports are registered, the artificial intelligence unit 120 may perform additional learning and fine tuning using the new evaluation information, reports, or reports as new teacher data. This improves the accuracy of the information output from the learning model.

[0143] The learning model included in the artificial intelligence unit 120 may be a learning model (distilled model) obtained by knowledge distillation using an original learning model. In knowledge distillation, a learned model such as a large-scale language model is used as a teacher model, and the parameters of the student model are adjusted so that the output loss (Soft Target Loss) of the student model (distilled model) relative to the output (Soft Target) of the teacher model is reduced, thereby learning the student model, and the student model becomes a distilled model. In addition, the student model may be learned so that the output loss (Hard Target Loss) of the student model relative to the correct label (Hard Target) of the teacher data (combination of input data and output data of the learning model) is reduced. Compared to the original learning model (teacher model), the distilled model has a smaller number of parameters and a smaller processing load while having performance close to that of the learning model. Therefore, by using the distilled model, the cost of the information processing system 1 can be reduced.

[0144] For example, the learning model used in each functional unit may be a distilled model trained using a combination of input data and output data in a large-scale language model as training data. When the information processing system 1 is introduced, a large-scale language model may be used as the learning model used in each functional unit, and when training data from the large-scale language model is accumulated, a distilled model obtained by knowledge distillation using the training data may be used as the learning model used in each functional unit.

[0145] <Display section> The display unit 211 of the trading organization terminal 20, the display unit 311 of the evaluator terminal 30, and the display unit 411 of the trading organization terminal 40 each display a screen indicated by the screen data transmitted from the server device 10.

[0146] <Operation acquisition part> The operation acquisition unit 212 of the trading organization terminal 20 accepts operations by the trading organization using the trading organization terminal 20. The operation acquisition unit 312 of the evaluator terminal 30 accepts operations by the evaluator using the evaluator terminal 30. The operation acquisition unit 412 of the trading partner organization terminal 40 accepts operations by the trading partner organization using the trading partner organization terminal 40.

[0147] 3. Information processing method This section describes an information processing method of the server device 10. This information processing method is executed by a computer, with each unit of the server device 10 acting as each step.

[0148] This information processing includes a transaction investigation request receiving step, a security investigation request receiving step, a form sending step, a first response receiving step, and a second response receiving step. In the transaction investigation request receiving step, a request as to whether a secondary transaction investigation is required for a trading partner organization with which a transaction is conducted is received as first request information from a trading source organization. In the security investigation request receiving step, a request as to whether or not a security investigation is required or the type of security investigation for the trading partner organization is received as second request information from a trading source organization. In the form sending step, a first response form for inputting a response to the secondary transaction investigation is sent to the trading partner organization in response to the first request information, and a second response form for inputting a response to the security investigation is sent to the trading partner organization in response to the second request information. In the first response receiving step, a response to the first response form is received from the trading partner organization. In the second response receiving step, a response to the second response form is received from the trading partner organization.

[0149] 19 is an activity diagram showing an example of the flow of information processing (security investigation processing) executed by the information processing system 1. The information processing will be described below along with each activity in this activity diagram.

[0150] The security investigation process starts with a request for a secondary transaction investigation or a request for a security investigation. In the following, the flow of the secondary transaction investigation will be described first, but the security investigation may be performed before the secondary transaction investigation, the secondary transaction investigation and the security investigation may be performed in parallel, or the secondary transaction investigation and the security investigation may be performed alternately.

[0151] The trading organization inputs request information for a second trading investigation of the trading partner organization in the trading organization terminal 20 (activity A101). The server device 10 accepts the second trading investigation based on the request information sent from the trading organization terminal 20 (activity A102). Next, the server device 10 transmits a first answer form to the trading partner organization terminal 40 of the specified trading partner organization (activity A103). The trading partner organization inputs an answer to the first answer form in the trading partner organization terminal 40 (activity A104). The server device 10 accepts the answer to the first answer form sent from the trading partner organization terminal 40 and registers it in the supply chain database (activity A105).

[0152] The trading organization also inputs request information for a security investigation for the trading partner organization in the trading organization terminal 20 (activity A106). The server device 10 accepts the security investigation based on the request information sent from the trading organization terminal 20 (activity A107). Next, the server device 10 transmits the specified second answer form to the trading partner organization terminal 40 of the specified trading partner organization (activity A108). The trading partner organization inputs an answer to the second answer form in the trading partner organization terminal 40 (activity A109). The server device 10 accepts the answer to the second answer form sent from the trading partner organization terminal 40 and registers it in the supply chain database (activity A110). The answers (evaluation information) in the registered second answer form are evaluated by an evaluator.

[0153] 4. Effect The operation of this embodiment can be summarized as follows: That is, a source organization can collect information on secondary business partners and information on security from a business partner organization. Therefore, it is possible to grasp the security risks in the supply chain.

[0154] Although the embodiment of the present invention has been described above, the present invention is not limited to this, and can be modified as appropriate without departing from the technical concept of the invention.

[0155] 5.Other In the above embodiment, the server device 10 performs various storage and control, but multiple external devices may be used instead of the server device 10. That is, various information and programs may be distributed and stored in multiple external devices using block chain technology or the like. In particular, the artificial intelligence unit 120 may be an external configuration of the server device 10. In that case, the artificial intelligence unit 120, which is an external configuration, is provided by, for example, an artificial intelligence service server, and is configured to receive input from each functional unit of the server device 10, receive a request to execute an artificial intelligence service, and return an instructed output as a processing result to the server device 10. The artificial intelligence service server may be a server that provides a service using a language model as a learning model, or may be a server that executes a language processing task using a language model. The artificial intelligence service server may be constructed by LLM. The artificial intelligence service server receives input of a prompt by text, image, voice, etc., and generates and responds to the prompt.

[0156] The aspect of the present embodiment is not limited to the information processing system 1, and may be an information processing method or a program. The information processing method includes each step executed by the information processing system 1. The program causes a computer to execute each step of the information processing system 1.

[0157] It may be provided in any of the following ways:

[0158] (1) An information processing system comprising at least one processor, the processor being configured to execute each of the following steps by reading out a program: in a transaction investigation request receiving step, a request for a secondary transaction investigation is received from a source organization as first request information regarding the necessity of a secondary transaction investigation of a trading partner organization with which a transaction of a trading target is conducted, the secondary transaction investigation being an investigation into the trading partner organization's transaction with another organization of the trading target; in a security investigation request receiving step, a request for a security investigation is received from the source organization as second request information regarding the necessity or type of a security investigation of the trading partner organization, the security investigation being an investigation into the security of the trading partner organization; and in a form sending step, a first response form for inputting a response to the secondary transaction investigation is sent to the trading partner organization in response to the first request information, and a second response form for inputting a response to the security investigation is sent to the trading partner organization in response to the second request information.

[0159] (2) In the information processing system described in (1) above, in the transaction investigation request receiving step, the necessity of the secondary transaction investigation for the secondary trading partner organization with which the secondary transaction of the trading target is conducted is further received as the first request information, in the security investigation request receiving step, the necessity or type of the security investigation for the secondary trading partner organization is further received as the second request information, and in the form sending step, the first answer form is sent to the secondary trading partner organization in accordance with the first request information, and the second answer form is sent to the secondary trading partner organization in accordance with the second request information.

[0160] (3) In the information processing system described in (2) above, the processor is configured to further execute the following step, in which in the ticket management step, security investigation tickets granted to the trading organization are consumed in accordance with the number of submissions of the second answer form to the trading partner organization and the second-level trading partner organization.

[0161] (4) In the information processing system described in any one of (1) to (3) above, in the security investigation request receiving step, an information processing system receives input of attributes of the trading partner organization from the source organization and presents to the source organization options for selecting whether or not or the type of the security investigation is required, with initial values ​​set based on the attributes of the trading partner organization.

[0162] (5) In the information processing system described in any one of (1) to (4) above, the processor is configured to further execute the following steps: in the response receiving step, a response to the first response form is received from the trading partner organization, and in the hierarchical structure display control step, a transaction hierarchical structure indicating the trading relationships of the trading partners, including the trading partner organization and a secondary trading partner organization with which secondary transactions with the trading partner are conducted, is displayed based on the response to the first response form.

[0163] (6) In the information processing system described in (5) above, in the security investigation request receiving step, an input of an information deposit attribute indicating that the trading partner organization will be entrusted with specific information is received from the source organization, and the answer to the first answer form includes the presence or absence of the information deposit attribute of the second-level trading partner organization, and in the hierarchical structure display control step, the transaction hierarchical structure including the flow of the specific information is displayed based on the information deposit attributes of the trading partner organization and the second-level trading partner organization.

[0164] (7) In the information processing system described in (5) or (6) above, in the security investigation request receiving step, input of attributes of the trading partner organization is received from the source organization, and the response to the first response form includes attributes of the second-level trading partner organization, and in the hierarchical structure display control step, the transaction hierarchical structure is displayed in which labels indicating attributes are assigned to the trading partner organization and the second-level trading partner organization, respectively.

[0165] (8) In an information processing system described in any one of (5) to (7) above, in the hierarchical structure display control step, multiple transaction hierarchical structures associated with the same source organization are displayed in an overlapping manner.

[0166] (9) In the information processing system described in any one of (1) to (8) above, the processor is configured to further execute the following steps, and in a progress display control step, a progress status of the secondary transaction investigation in the trading partner organization or in a secondary trading partner organization where secondary transactions with the trading subject are conducted is displayed.

[0167] (10) In the information processing system described in any one of (1) to (9) above, the processor is configured to further execute the following steps: in an answer registration step, the answered questions of the business partner organization in the security investigation and the answers entered by the business partner organization to the answered questions are registered in a database; and in an answer acceptance step, answers to questions that are identical or similar to the answered questions are accepted into the second answer form in which the entered answers have been pre-entered.

[0168] (11) In the information processing system described in (10) above, the second answer form includes transaction object-related questions regarding the transaction object and organization-related questions regarding the transaction object itself, which are independent of the transaction object, and in the answer receiving step, the input answers are pre-entered to the organization-related questions that are identical or similar to the answered questions.

[0169] (12) In the information processing system described in any one of (1) to (11) above, the processor is configured to further execute the following steps: in the investigation list display control step, a list of the secondary transaction investigations and / or security investigations requested by the trading organization is displayed, and, upon instruction from the trading organization, a list of the secondary transaction investigations and / or security investigations that the trading organization has been requested to conduct as a trading partner organization for another trading organization is displayed.

[0170] (13) An information processing method comprising steps executed by an information processing system according to any one of (1) to (12) above.

[0171] (14) A program for causing a computer to execute each step of the information processing system described in any one of (1) to (12) above. Of course, this is not the case.

[0172] Finally, although various embodiments according to the present disclosure have been described, these are presented as examples and are not intended to limit the scope of the invention. The novel embodiment can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. The embodiments and their modifications are included within the scope and spirit of the invention, and are included in the scope of the invention and its equivalents described in the claims. [Explanation of symbols]

[0173] 1: Information processing system 2: Communication lines 10: Server device 11: Control section 12: Storage section 13: Communications Department 14: Communication bus 20: Transaction source organization terminal 21: Control section 22: Storage section 23: Communications Department 24: Input section 25: Output section 26: Communication bus 30: Evaluator terminal 31: Control section 32: Storage section 33: Communications Department 34: Input section 35: Output section 36: Communication bus 40: Business partner organization terminal 41: Control section 42: Storage section 43: Communications Department 44: Input section 45: Output section 46: Communication bus 111: Basic display control unit 112A: Transaction Investigation Request Reception Department 112B: Security Investigation Request Reception Department 113: Form submission section 114: Ticket Management Department 115A: First Response Reception Section 115B: Second Answer Reception Section 116: Answer Registration Department 117: Hierarchical structure display control unit 118: Progress display control section 119: Survey list display control unit 120: Artificial Intelligence Department 211:Display section 212: Operation acquisition section 311: Display section 312: Operation acquisition section 411: Display section 412: Operation acquisition section AA : Attribute input area ACF: Answer content display field AF: Additional information frame AO : Organization Addition Object B11: Create button B21: Request button B31: Request button B41: Send button BF: Customer input field CA: Request content input area CF: Case input field CI: Requester Information CO : Mode switching object DA:Display area DF: Transaction information section EO :Edit Object FD: First answer form display screen FO : Filter Selection Object FSA: Filter setting area HD: Hierarchical structure display screen HF: Hierarchical structure display field HO : Highlight setting object HS: Transaction Hierarchy Structure IDF: Information display field IF: Information input field IO : Import Object KO : Type selection object LB : Label LD: Survey list display screen LF: Business Partner List Field MA: Menu area ML: Menu List MO : Moving Object NF: Organization name input box OA: Organization information input area OF: Organization registration field PD: Progress display screen PF: Progress display column PO: Partner Organization RA1: Requestee selection area RA2: Requestee selection area RF : Request setting area RL1: First list RL2: Second List SA : Survey input area SCF: Supply Chain Display Column SD1: First survey reception screen SD2: Second survey reception screen SD3: Third survey reception screen SF1: First survey status display field SF2: Second investigation status display field SIA: Detailed information display area SIF: Detailed information display field SO :Detailed display object SRD: Survey result display screen SVF: Security rating display field TN: Number of tickets U1: First Trading Organization U2: Secondary trading organization U3: Evaluator U4: First trading organization U5: Secondary trading organization

Claims

1. An information processing system, At least one processor; The processor is configured to execute the following steps by reading the program: In the transaction investigation request receiving step, a request for a secondary transaction investigation of a trading partner organization with which a transaction of the trading target is conducted is received as first request information from a trading partner organization terminal used by the trading partner organization, where the secondary transaction investigation is an investigation of the trading partner organization's transaction with another organization of the trading target, In the security investigation request receiving step, a request for a security investigation is received from the trading organization terminal as second request information, the request being related to the security of the trading organization, and the type of the security investigation is received from the trading organization terminal as second request information, the security investigation being related to the security of the trading organization, In a form sending step, in response to the first request information, a first response form for inputting a response to the secondary transaction survey is sent to a trading organization terminal used by the trading organization, and in response to the second request information, a second response form for inputting a response to the security survey is sent to the trading organization terminal, in accordance with the second request information, in an information processing system.

2. 2. The information processing system according to claim 1, In the transaction investigation request receiving step, a request for the secondary transaction investigation of the secondary transaction target organization with which the secondary transaction is conducted is further received as the first request information from the transaction source organization terminal; In the security investigation request receiving step, the necessity or type of the security investigation for the second-level trading partner organization is further received as the second request information from the trading source organization terminal; In the form sending step, the first answer form is sent to a secondary business partner organization terminal used by the secondary business partner organization in response to the first request information, and the second answer form is sent to the secondary business partner organization terminal in response to the second request information, in an information processing system.

3. 3. The information processing system according to claim 2, The processor is further configured to perform the steps of: In the ticket management step, the information processing system consumes security investigation tickets given to the trading source organization according to the number of transmissions of the second answer form to the trading partner organization and the second-level trading partner organization.

4. 2. The information processing system according to claim 1, In the security investigation request receiving step, an information processing system receives input of attributes of the trading partner organization from the trading organization terminal, and presents to the trading organization terminal options for selecting whether or not to conduct a security investigation or the type of investigation, with initial values ​​set based on the attributes of the trading partner organization.

5. 2. The information processing system according to claim 1, The processor is further configured to perform the steps of: In the answer receiving step, an answer to the first answer form is received from the business partner organization terminal; In a hierarchical structure display control step, the information processing system causes the trading source organization terminal to display a trading hierarchical structure indicating the trading relationship of the trading objects, including the trading partner organization and a secondary trading partner organization with which secondary trading of the trading object is conducted, based on the response to the first response form.

6. 6. The information processing system according to claim 5, The security investigation request receiving step includes receiving, from the source organization terminal, an input of an information deposit attribute indicating that the destination organization is to receive a deposit of specific information; The answer to the first answer form includes whether or not the secondary business partner organization has the information deposit attribute; In the hierarchical structure display control step, the information processing system causes the trading hierarchical structure including the specific information flow to be displayed on the trading organization terminal based on the information deposit attributes of each of the trading partner organization and the second-level trading partner organization.

7. 6. The information processing system according to claim 5, In the security investigation request receiving step, an input of attributes of the trading partner organization is received from the trading source organization terminal; The answer to the first answer form includes attributes of the secondary business partner organization; In the hierarchical structure display control step, the information processing system causes the trading organization terminal to display the trading hierarchical structure in which labels indicating attributes are assigned to the trading partner organizations and the second-level trading partner organizations.

8. 6. The information processing system according to claim 5, In the hierarchical structure display control step, a plurality of transaction hierarchical structures associated with the same transacting organization are displayed in an overlapping manner on the transacting organization terminal.

9. 2. The information processing system according to claim 1, The processor is further configured to perform the steps of: In the progress display control step, the information processing system causes the transaction source organization terminal to display the progress of the secondary transaction investigation in the transaction source organization or in a secondary transaction target organization with which the secondary transaction is conducted.

10. 2. The information processing system according to claim 1, The processor is further configured to perform the steps of: In the answer registration step, the answered questions of the business partner organization in the security investigation and the input answers of the business partner organization to the answered questions are registered in a database; In the answer receiving step, an answer to a question that is the same as or similar to the answered question is received from the business partner organization terminal into the second answer form in which the already-entered answer has been entered in advance.

11. 11. The information processing system according to claim 10, the second answer form includes a transaction object-related question about the transaction object and an organization-related question about the transaction object organization itself, independent of the transaction object; In the answer receiving step, an information processing system receives from the business partner organization terminal an answer to the second answer form in which the already-entered answer has been pre-entered to the organization-related question that is identical or similar to the already-entered question.

12. 2. The information processing system according to claim 1, The processor is further configured to perform the steps of: In the investigation list display control step, the information processing system causes the trading organization terminal to display a list of the secondary transaction investigations and / or security investigations requested by the trading organization, and also causes the trading organization terminal to display, upon instruction from the trading organization, a list of the secondary transaction investigations and / or security investigations that the trading organization has been requested to conduct as a trading partner organization with other trading organizations.

13. 1. An information processing method, comprising: An information processing method comprising the steps executed by the information processing system according to any one of claims 1 to 12.

14. A program, A program for causing a computer to execute each step of the information processing system according to any one of claims 1 to 12.

Images