Information processing system, information processing method and program

Abstract

To provide an information processing system etc. that enables survey subjects to efficiently respond to surveys. [Solution] According to one aspect of the present invention, there is provided an information processing system comprising at least one processor, the processor being configured to execute the following steps by reading a program: in a registration step, attributes of questions included in a security survey of the person being evaluated are registered, the attributes including a first attribute indicating a common question for which a common answer that can be used for multiple targets in the security survey of the person being evaluated is set, and a second attribute indicating an individual question that requires an individual answer for each target in the security survey of the person being evaluated; in an answer reception step, answers to the questions of the first attribute and the questions of the second attribute are received from the person being evaluated in respective answer input fields, and the answer input field for the questions of the first attribute initially displays the common answer that has been registered in advance for the question.

Description

[Technical Field]

[0001] The present invention relates to an information processing system, an information processing method, and a program. [Background technology]

[0002] Patent Document 1 describes a system audit support system that includes a checklist database that stores checkpoint array information data in a regular order to identify each checkpoint when auditing an audit target, and also stores evidence array information data corresponding to the checkpoint array information data to identify the evidence required to evaluate each checkpoint. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2003-44658 Summary of the Invention [Problem to be solved by the invention]

[0004] There is a need for technology that allows survey subjects to respond to surveys efficiently.

[0005] In view of the above circumstances, the present invention provides an information processing system and the like that allows survey subjects to efficiently respond to surveys. [Means for solving the problem]

[0006] According to one aspect of the present invention, there is provided an information processing system comprising at least one processor, the processor being configured to execute each of the following steps by reading a program, wherein in a registration step, attributes of questions included in a security survey of the person being evaluated are registered, the attributes including a first attribute indicating a common question for which a common answer that can be used for multiple targets in the security survey of the person being evaluated is set, and a second attribute indicating an individual question that requires an individual answer for each target in the security survey of the person being evaluated, and in an answer reception step, answers to the questions of the first attribute and the questions of the second attribute are received from the person being evaluated in respective answer input fields, and the answer input field for the questions of the first attribute initially displays the common answer that has been registered in advance for the question.

[0007] According to this embodiment, the survey subjects can efficiently respond to the survey. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a configuration diagram illustrating an information processing system 1. FIG. [Figure 2] 2 is a block diagram showing the hardware configuration of the server device 10 and the target person terminal 20. FIG. [Figure 3] FIG. 2 is a block diagram showing the hardware configuration of an evaluator terminal 30 and a user terminal 40. [Figure 4] 1 is a block diagram showing functions realized by a server device 10 (controller 11), a subject terminal 20 (controller 21), an evaluator terminal 30 (controller 31), and a user terminal 40 (controller 41). [Figure 5] 10 is a diagram showing an example of a request display screen RD displayed on the target person terminal 20. FIG. [Figure 6] 10 is a diagram showing an example of a detailed display screen SD displayed on the subject terminal 20. FIG. [Figure 7] FIG. 10 is a diagram showing an example of an answer input screen FD displayed on the subject terminal 20. [Figure 8] FIG. 8 is a diagram showing a continuation of the answer input screen FD in FIG. 7. [Figure 9] FIG. 10 is a diagram showing an example of a template update screen TD displayed on the target person terminal 20. [Figure 10] FIG. 10 is a diagram showing another example of a question area displayed on the answer input screen FD. [Figure 11] 10 is a diagram showing an example of a display format of the first statistical score and the second statistical score displayed on the subject terminal 20 or the user terminal 40. FIG. [Figure 12] 1 is an activity diagram showing an example of the flow of information processing (security investigation processing) executed by the information processing system 1. FIG. DETAILED DESCRIPTION OF THE INVENTION

[0009] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will be described below with reference to the accompanying drawings. Various features shown in the following embodiments can be combined with each other.

[0010] Incidentally, the program for realizing the software appearing in one embodiment may be provided as a non-transitory computer-readable medium, or may be provided so that it can be downloaded from an external server, or may be provided so that the program is started on an external computer and its functions are realized on a client terminal (so-called cloud computing).

[0011] Furthermore, various information processing according to an embodiment may realize input and output corresponding to the input. Here, the form of information referenced in such information processing (hereinafter referred to as reference information) is not limited as long as an output is obtained as a result of the input. The reference information may be, for example, rule-based information such as a database, a lookup table, or a predetermined function (including a decision formula such as a regression formula constructed using a statistical method), a trained model that has previously learned the correlation between input and output, or a generative AI such as a large-scale language model (these models include parameters that establish the correlation between input and output) or a visual language model that can output a desired result in response to a prompt.

[0012] In one embodiment, a "unit" may include, for example, a combination of hardware resources implemented by a circuit in the broad sense and software information processing that can be specifically realized by these hardware resources. In one embodiment, various information is handled, and this information is represented, for example, by physical values ​​of signal values ​​representing voltage and current, high and low signal values ​​as a binary bit set consisting of 0 or 1, or quantum superposition (so-called quantum bits), and communication and calculations can be performed on a circuit in the broad sense.

[0013] Furthermore, a circuit in the broad sense is a circuit realized by at least an appropriate combination of a circuit, circuitry, processor, memory, etc. The processor may be a general-purpose processor or a dedicated circuit. That is, it includes an application specific integrated circuit (ASIC), a programmable logic device (e.g., a simple programmable logic device (SPLD), a complex programmable logic device (CPLD), and a field programmable gate array (FPGA)), etc.

[0014] 1. Hardware Configuration This section explains the hardware configuration.

[0015] <Information Processing System 1> 1 is a configuration diagram showing an information processing system 1. The information processing system 1 includes a communication line 2, a server device 10, a plurality of subject terminals 20, at least one evaluator terminal 30, and a plurality of user terminals 40. The server device 10, the subject terminal 20, the evaluator terminal 30, and the user terminal 40 are configured to be able to communicate with each other via the communication line 2. The connection between the server device 10, the subject terminal 20, the evaluator terminal 30, and the user terminal 40 may be wired or wireless.

[0016] The information processing system 1 constitutes at least a part of a security evaluation system used by, for example, multiple evaluation subjects (a first evaluation subject U1 and a second evaluation subject U2), at least one evaluator U3, and multiple evaluation users (a first evaluation user U4 and a second evaluation user U5). The information processing system 1 mainly evaluates the security of commercial products and the like provided by the evaluation subjects, and provides security evaluations. For example, the information processing system 1 mainly provides security evaluation services by evaluators. In one embodiment, the information processing system 1 is composed of one or more devices or components. These components will be described below.

[0017] <Server device 10> Fig. 2 is a block diagram showing the hardware configuration of server device 10 and target person terminal 20. As shown in Fig. 2A, server device 10 includes a control unit 11, a storage unit 12, a communication unit 13, and a communication bus 14. Control unit 11, storage unit 12, and communication unit 13 are electrically connected via communication bus 14 inside server device 10.

[0018] <Control unit 11> The control unit 11 processes and controls the overall operations related to the server device 10. The control unit 11 is, for example, a central processing unit (CPU). The control unit 11 realizes various functions related to the server device 10 by reading out predetermined programs stored in the storage unit 12. In other words, information processing by software stored in the storage unit 12 is specifically realized by the control unit 11, which is an example of hardware, and can be executed as each functional unit included in the control unit 11. These will be described in more detail in the next section. Note that the control unit 11 is not limited to being a single unit, and the server device 10 may have multiple control units 11 for each function. Furthermore, the server device 10 may be configured with a combination of these.

[0019] <Storage section 12> The memory unit 12 stores various pieces of information defined above. This can be implemented, for example, as a storage device such as a solid state drive (SSD) that stores various programs and the like related to the server device 10 executed by the control unit 11, or as a memory such as a random access memory (RAM) that stores temporarily required information (arguments, arrays, etc.) related to the program operations. The memory unit 12 stores various programs, variables, etc. related to the server device 10 executed by the control unit 11.

[0020] <Communications Department 13> The communication unit 13 is preferably a wired communication means such as USB, IEEE1394, Thunderbolt (registered trademark), or wired LAN network communication, but may also include wireless LAN network communication, mobile communication such as LTE / 5G, or BLUETOOTH (registered trademark) communication as needed. That is, it is more preferable to implement it as a collection of multiple communication means. That is, the server device 10 may communicate various information from the outside via the communication unit 13 and the network.

[0021] The server device 10 may be an on-premise server or a cloud server. The cloud server device 10 may provide the above-described functions and processes in the form of, for example, SaaS (Software as a Service) or cloud computing.

[0022] <Target user terminal 20> The subject terminal 20 is an information processing terminal used by a person whose security is to be evaluated. The "subject to evaluation" includes a business partner organization or its personnel that has any type of business relationship with the evaluation user (especially the evaluation requester described below), such as the provision of commercial materials (products, services, etc.) (for example, the provision of cloud services) or the outsourcing of work. The subject to evaluation is, for example, a business operator such as a service provider, supplier, or outsourcing organization for the evaluation user (evaluation requester).

[0023] Here, "trading organization" includes a first-tier trading organization that receives direct transactions from the evaluation user (evaluation requester), a second-tier trading organization that receives second-tier transactions from the first-tier trading organization, etc. In other words, a trading organization means a first-tier trading organization or an Nth-tier trading organization (N>1) from the perspective of the trading source organization (evaluation user), and the first-tier trading organization and the Nth-tier trading organization for one trading object constitute the supply chain for that trading object. Trading objects include traded commodities, outsourced work, etc. Trading organizations may also include individual business owners who receive transactions.

[0024] A trading organization is an organization located downstream of a trading organization (evaluation user) in the supply chain. From the perspective of a trading organization, a trading organization may be a trading partner, a contractor (including a subcontractor or a sub-subcontractor), a vendor, a supplier, a seller, a subsidiary, etc. A trading organization may include businesses other than end users in the supply chain.

[0025] Furthermore, "organization" includes profit-making corporations (such as companies), non-profit corporations (such as cooperatives and foundations), and public corporations (such as local governments).

[0026] 2B, subject terminal 20 includes control unit 21, storage unit 22, communication unit 23, input unit 24, output unit 25, and communication bus 26. Control unit 21, storage unit 22, communication unit 23, input unit 24, and output unit 25 are electrically connected via communication bus 26 inside subject terminal 20. Description of control unit 21, storage unit 22, and communication unit 23 will be omitted as they are the same as the descriptions of the respective units in server device 10.

[0027] <Input section 24> The input unit 24 accepts operation inputs made by the user. The operation inputs are transferred as command signals to the control unit 21 via the communication bus 26. The control unit 21 can execute predetermined control or calculations based on the transferred command signals as necessary. The input unit 24 may be included in the housing of the subject terminal 20 or may be externally attached. For example, the input unit 24 may be implemented as a touch panel integrated with the output unit 25. When the input unit 24 is implemented as a touch panel, the user can input tap operations, swipe operations, etc. to the input unit 24. Instead of a touch panel, a switch button, a mouse, a trackpad, a QWERTY keyboard, etc. can be used as the input unit 24.

[0028] <Output section 25> The output unit 25 displays a screen of a graphical user interface (GUI) that can be operated by a user. The output unit 25 may be included in the housing of the subject terminal 20 or may be externally attached. Specifically, the output unit 25 may be implemented as a display device such as a CRT display, a liquid crystal display, an organic EL display, or a plasma display. It is preferable that these display devices are used appropriately depending on the type of the subject terminal 20.

[0029] <Evaluator terminal 30> The evaluator terminal 30 is an information processing terminal used by an evaluator who evaluates the answers of the person being evaluated. An "evaluator" is an organization such as a company that evaluates security (for example, a security evaluation company that evaluates the security of services such as cloud services, software, etc.) or a person in charge thereof. The evaluator evaluates the security of the person being evaluated, for example, from the evaluator terminal 30 via the information processing system 1.

[0030] 3 is a block diagram showing the hardware configuration of the evaluator terminal 30 and the user terminal 40. As shown in FIG. 3A, the evaluator terminal 30 includes a control unit 31, a storage unit 32, a communication unit 33, an input unit 34, an output unit 35, and a communication bus 36. The control unit 31, the storage unit 32, the communication unit 33, the input unit 34, and the output unit 35 are electrically connected via the communication bus 36 inside the evaluator terminal 30. The description of the control unit 31, the storage unit 32, the communication unit 33, the input unit 34, and the output unit 35 is omitted because they are the same as the description of each unit in the subject terminal 20.

[0031] <User terminal 40> The user terminal 40 is an information processing terminal used by an evaluation user who uses services provided by the information processing system 1 (for example, a service for aggregating response data to questions or questionnaires, a service for investigating security, etc. related to organizations or services, a service for evaluating or analyzing security, a service for creating or providing security reports, etc.). "Evaluation users" include evaluation requesters, viewers, etc.

[0032] An "evaluation requester" is an evaluation user who requests an evaluation of the security of the evaluation target, and is, for example, an individual, an organization, or a person in charge of the organization who has a business relationship with the evaluation target. Evaluation requesters include, for example, evaluation users who have registered for the security evaluation service by evaluators provided by the information processing system 1.

[0033] The evaluation requester includes a trading organization, which is an organization or individual that requests a transaction with a trading organization (evaluation target). A trading organization receives and uses merchandise such as services and business provided by a trading organization. For example, if the merchandise being traded is a product, the evaluation requester (trading organization) is the purchaser of the item (finished product or parts) manufactured by the trading organization. Also, for example, if the merchandise being traded is a service, the evaluation requester (trading organization) is the user of the service provided by the trading organization (e.g., the user of a cloud service provided by a cloud service provider). Furthermore, for example, if the merchandise being traded is business (task), the evaluation requester (trading organization) is the business that requests or outsources the business.

[0034] The evaluation requester includes not only an individual or organization that conducts a transaction (use of a service, outsourcing, etc.) with the evaluation target that is the subject of evaluation, but also an individual or organization that requests an evaluation of a specific service. For example, the evaluation requester may include a company that wants to evaluate the security of a cloud service, etc. that it uses or is considering using, or a company that wants to confirm the evaluation.

[0035] A "viewer" is an individual or organization that uses the results of a security evaluation of an evaluation target conducted at the request of an evaluation requester (the viewer himself / herself or an evaluation requester other than the viewer). A viewer is, for example, a provider of a product such as a service that the user plans to use, a business partner organization with which the user plans to do business, or an individual or organization that requests an evaluation of an evaluation target as a candidate for these. Viewers may include evaluation users (which may also be referred to as "service users") who are registered with a service provided by the information processing system 1 (e.g., a security evaluation service by an evaluator) and other evaluation users who are not registered with the evaluation service (e.g., evaluation users who are not registered with the evaluation service but have obtained a web page that displays an evaluation provided by the evaluation service, a link to a file containing the evaluation, etc. that is accessible from outside the evaluation service, and may also be referred to as "other service users").

[0036] 4B, user terminal 40 includes a control unit 41, a memory unit 42, a communication unit 43, an input unit 44, an output unit 45, and a communication bus 46. Control unit 41, memory unit 42, communication unit 43, input unit 44, and output unit 45 are electrically connected via communication bus 46 inside user terminal 40. Description of control unit 41, memory unit 42, communication unit 43, input unit 44, and output unit 45 will be omitted as they are the same as the description of each unit in subject terminal 20.

[0037] 2. Functional configuration This section describes the functional configuration of this embodiment. Information processing by software stored in the storage unit 12 is specifically realized by the control unit 11, which is an example of hardware, and can be executed as each functional unit included in the control unit 11 (at least one processor included in the information processing system 1).

[0038] FIG. 4 is a block diagram showing functions realized by the server device 10 (controller 11), the subject terminal 20 (controller 21), the evaluator terminal 30 (controller 31), and the user terminal 40 (controller 41).

[0039] As shown in FIG. 4A, the server device 10 (control unit 11) includes a basic display control unit 111, a registration unit 112, a survey request receiving unit 113, a response receiving unit 114, an evaluation unit 115, a response providing unit 116, an information presentation unit 117, and an artificial intelligence unit 120.

[0040] As shown in Fig. 4B, the subject terminal 20 (controller 21) includes a display unit 211 and an operation acquisition unit 212. As shown in Fig. 4C, the evaluator terminal 30 (controller 31) includes a display unit 311 and an operation acquisition unit 312. As shown in Fig. 4D, the user terminal 40 (controller 41) includes a display unit 411 and an operation acquisition unit 412.

[0041] <Basic display control unit 111> The basic display control unit 111 is configured to display various information on the subject terminal 20, the evaluator terminal 30, and the user terminal 40. For example, the basic display control unit 111 displays an answer input form in which the person to be evaluated inputs their answers, the answers registered by the person to be evaluated, the evaluation results of the answers by the evaluator, etc. on the display unit 211 of the subject terminal 20, the display unit 311 of the evaluator terminal 30, or the display unit 411 of the user terminal 40.

[0042] <Registration Section 112> The registration unit 112 is configured to register attributes of questions included in a security survey for the person being evaluated. A "security survey" is a survey regarding the security or secondary transactions of the person being evaluated, and may also be called a risk survey. A security survey typically includes multiple questions.

[0043] The "questions" are questions to which the subject of assessment is required to respond, and may include, for example, questions regarding the subject's own security and the security of the products provided by the subject of assessment. The "questions" may also include questions regarding the security of other organizations in the subject's supply chain. "Other organizations" include, for example, the subject's business partners, such as organizations to which the subject of assessment outsources its business (including subcontractors, subcontractors, sub-subcontractors, etc.). In other words, "other organizations" may include questions regarding the security of N-th-tier business partners (N>1) from the perspective of the original trading organization, such as second-tier business partners that receive second-tier transactions directly from the first-tier business partners, as well as third-tier business partners that receive third-tier transactions from the second-tier business partners. The questions may also include a so-called security checklist.

[0044] The questions may include, for example, questions to confirm (and require responses from the person being evaluated) the status or evaluation of security certifications, service level, scope of responsibility, security measures within the person being evaluated, handling of data related to the person requesting the evaluation, handling of data managed by the person being evaluated, and service development, maintenance, or operation policies (account management, etc.).

[0045] Attributes of a questionnaire are set for each questionnaire. The attributes include a first attribute indicating a common question for which a common answer that can be used for multiple targets of a security survey of the person being evaluated is set, and a second attribute indicating an individual question for which an individual answer is required for each target of the security survey of the person being evaluated (hereinafter referred to as "survey target"). Either the first attribute or the second attribute is set for each questionnaire. The attributes are registered, together with the content of the questionnaire, for example, in a database in the memory unit 12.

[0046] The "survey target" is the target contract, target transaction, target merchandise (products, business, duties, services, etc.), target business, target department, etc. that the person being evaluated enters in response to the questionnaire. The survey target may be set as a category indicating the prerequisites of the person being evaluated in answering the questionnaire (for example, the merchandise that is the target of the response, the business that is the target of the response, the department that is the target of the response, the contract with the trading organization that is the target of the response, etc.). For example, the person being evaluated enters answers to the questionnaire about merchandise, etc. specified as a category by the person requesting the evaluation.

[0047] The category may be the type of merchandise handled by the person being evaluated, the provider of the merchandise, the type of plan included in the merchandise, the business that provides the merchandise, or a combination of these. The category may also be a contract name that represents a combination of these. This allows different answers to be entered and registered depending on the survey target, even for the same person being evaluated, as answers to questions may differ depending on the merchandise, etc.

[0048] A person to be evaluated who provides a service inputs answers according to service attributes such as the type of service to be surveyed (e.g., AI (Artificial Intelligence) service, RPO (Recruitment Process Outsourcing) service, etc.), the destination of the service (e.g., the name of the organization requesting the evaluation, the attributes of the person requesting the evaluation, etc.), the type of plan (option) included in the service, the name of the business providing the service, the name of the department, etc. In other words, a person to be evaluated who provides multiple services or plans may input answers for each of these service attributes or contracts (categories), and the answer receiving unit 114 described below may register answer data for each service attribute or contract. The input answers are stored as answer data in association with the service attributes or contracts.

[0049] The "services" provided by the assessee include services provided via the Internet, such as SaaS, IaaS (Infrastructure as a Service), PaaS (Platform as a Service), and cloud services, and in this case, the assessee includes cloud service providers, etc. The "services" provided by the assessee may also be services (for example, commissioned work) provided to business partners, customers, etc.

[0050] Questions for which the first attribute is set are questions for which the answers are common to all assessees, regardless of the survey target, or questions that are expected to have common answers, and for example, if the assessee is a company, these include questions about certifications acquired by the company as a whole, policies established by the company as a whole, etc. Questions for which the second attribute is set are questions for which the answers are expected to change depending on the survey target (e.g., the work content), or questions for which the answers are expected to change, and for example, include questions about the work environment in which the assessee performs the work, whether or not there are subcontractors, etc. For example, if the survey target is non-routine work, there tends to be more questions with the second attribute than if the survey target is routine work.

[0051] The attributes of the questions are set for each assessee. The attributes may also be set for each question group that includes multiple questions. A question group is, for example, a group of questions related to items common to multiple survey subjects (e.g., authentication, policy, delegation, etc.).

[0052] The registration unit 112 may register, for each evaluation target, multiple answer templates that differ from each other in at least some of the attributes of each of the multiple questions and the common answers to the questions of the first attribute. This allows the evaluation requester to easily switch attributes for each question by selecting an answer template that suits the survey target. This improves the efficiency of responses to security surveys.

[0053] An "answer template" includes multiple questions included in a security survey, the attributes of each of those questions, and common answers to questions with a first attribute among those questions.An answer template is used in common for multiple survey subjects that share the same question (common question) as the first attribute.For example, a common answer template is used in security surveys that survey the same service, security surveys that survey the same business, security surveys that survey the same business, etc.

[0054] The registration unit 112 may accept creation of an answer template. Specifically, the registration unit 112 may accept input of attributes of each question and common answers to questions of the first attribute from the subject terminal 20, and register an answer template including this information. Furthermore, when questions in the security survey are added or revised, the registration unit 112 may request the subject to be evaluated to register attributes and common answers to the questions.

[0055] In this way, the registration unit 112 may accept the specification of attributes for questions from the person being evaluated (subject terminal 20). This allows the person being evaluated to arbitrarily set common questions according to the survey target, etc., thereby making it possible to efficiently respond to security surveys. For example, when creating a new response template, the registration unit 112 accepts the specification of attributes for each question from the person being evaluated.

[0056] Note that "attribute specification" includes not only setting a new attribute to a questionnaire item for which no attribute has been registered, but also changing an attribute of a questionnaire item for which an attribute has already been registered. In addition to specifying an attribute, the registration unit 112 may also accept specification of an answer template (selection of an answer template, input of an answer template name, etc.), thereby updating or creating a new answer template based on the specified attribute. For example, the registration unit 112 may accept specification of an attribute on an edit screen for an answer template.

[0057] Furthermore, the registration unit 112 may accept specification of attributes for questions from the evaluator (evaluator terminal 30), the evaluation user (evaluation requester / user terminal 40), or the provider of the service provided by the information processing system 1. In other words, the attributes of the questions may be set in advance by someone other than the person being evaluated, such as the evaluator, the evaluation user (evaluation requester), or the provider of the service provided by the information processing system 1. Furthermore, the preset attributes may be changeable by the person being evaluated, or may be unchangeable (fixed values). Furthermore, the preset attributes may be changeable by the evaluator, the evaluation user (evaluation requester), or the provider of the service provided by the information processing system 1.

[0058] <Investigation Request Reception Department 113> The investigation request receiving unit 113 is configured to receive a request for a security investigation of an evaluation target from an evaluation requester (user terminal 40).

[0059] The investigation request receiving unit 113 receives input of the evaluation subject and the investigation subject (commercial product, etc.) for which a security investigation is requested, for example, from the user terminal 40. The investigation request receiving unit 113 notifies the subject terminal 20 of the evaluation subject that received the input of a request for a security investigation of the investigation subject, and causes the response receiving unit 114 to receive the response.

[0060] <Answer Reception Section 114> The answer receiving unit 114 is configured to create or update answer data by receiving input of answers to questions in a security investigation from the person to be evaluated. The person to be evaluated answers the questions in response to a request received by the investigation request receiving unit 113 from an evaluation user with whom the person to be evaluated is conducting a transaction (having concluded a contract for the transaction), for example.

[0061] Specifically, the answer receiving unit 114 receives input of answers to the questions regarding the first attribute and the questions regarding the second attribute from the person to be evaluated (the person to be evaluated terminal 20) in the respective answer input fields. An answer input field is displayed on the person to be evaluated terminal 20 for each question. Furthermore, the answer input field may be included in, for example, a predetermined answer input form that receives input of answers to questions regarding security from the person to be evaluated. The answer receiving unit 114 registers the answers that have been input into the answer input field (answer input form) and further confirmed (sent to the answer receiving unit 114) as answer data.

[0062] "Response data" includes the responses of the person being evaluated to each of multiple questions regarding the security of the service, and is information that is the subject of evaluator checks and evaluations. Response data may be evaluated once or multiple times. That is, evaluations of response data may include initial evaluations (so-called reviews), interim evaluations, and final evaluations. Initial evaluations and interim evaluations are evaluations in which further evaluations are conducted after the initial evaluation. Response data may be revised by the person being evaluated based on the initial evaluation or interim evaluation. Multiple evaluations may be performed by the same evaluator or by different evaluators (so-called reviewers, etc.). The final evaluation creates an evaluation that is used in a report or report provided to the evaluation user. Furthermore, response data may be evaluated again by the evaluator when the person being evaluated makes corrections or updates. The evaluator's evaluation results of the response data are used as part of the report or report or as reference information.

[0063] The answers to each question included in the answer data are the answers entered by the person being evaluated into the answer input form for each question presented in the answer input form, and are registered in the answer database. The answers to one question may be hierarchical.

[0064] In addition, the response receiving unit 114 may receive response input via an interface other than the response input form (for example, uploading a data file containing the response by the person being evaluated), and register this response as response data in the response database.

[0065] The security investigation for which the response receiving unit 114 accepts responses may include an investigation into secondary transactions (secondary transaction investigation). The secondary transaction investigation is an investigation into transactions between a trading partner organization and other organizations that are trading counterparties. For example, the secondary transaction investigation is an investigation into the existence of Nth-tier trading partner organizations (N>1) from the perspective of the trading source organization, such as second-tier trading partner organizations that receive second-tier transactions directly from the first-tier trading partner organization, as well as third-tier trading partner organizations that receive third-tier transactions from the second-tier trading partner organization, and may be interpreted as an "Nth-tier transaction investigation." The second-tier transaction investigation may also be called a "subcontractor investigation." The second-tier transaction investigation may also be an investigation into the constituent organizations of the sub-supply chain formed by the trading partner organization for the trading counterpart.

[0066] A second-tier transaction investigation may be requested by a source organization to a first-tier trading partner organization, or may be requested directly by the source organization to a second-tier trading partner organization known to the source organization. Note that a "second-tier transaction investigation of an Nth-tier trading partner organization" refers to an investigation of trading partners downstream of an Nth-tier trading partner organization (i.e., N+1th-tier trading partner organizations and beyond).

[0067] The response input form for the secondary transaction survey may be sent to the person being evaluated at the request of the evaluation user. The response input form for the security survey may also be sent to the person being evaluated at the request of the evaluation user. These response input forms may also be sent to the secondary business partner organization at the request of the evaluation user. Furthermore, these response input forms may be created and sent for each transaction target.

[0068] An answer input form corresponding to the type of security survey selected by the evaluation user may be sent to the person being evaluated. For example, an answer input form with a large number of questions (e.g., about 100 items) may be sent to an person being evaluated who has selected "normal survey" as the type of security survey, and an answer input form with fewer questions than the "normal survey" (e.g., about 10 items) may be sent to an person being evaluated who has selected "simple survey" as the type of security survey. Note that a security survey may not be conducted for a person being evaluated who has been set to be prohibited from secondary transactions.

[0069] The answer receiving unit 114 may receive answers to security-related questions from the evaluation target terminal 20 and a category to be assigned to the answer, and add answer data including the answers and the category to the answer database. Note that a category is assigned to the entire answer data including multiple answers. Also, the category may be designated by specifying an answer template.

[0070] Furthermore, the answer receiving unit 114 may, for example, present questions (answer input form) with pre-specified categories to the person being evaluated, and register answer data in which the pre-specified categories are assigned to the answers entered on the subject terminal 20.

[0071] The answer data may include question data in addition to answer data and information indicating a category. If answer data has already been registered for the same question and category, the answer receiving unit 114 replaces the answer included in the answer data with the newly entered answer.

[0072] In the answer input field for a question of the first attribute, a common answer registered in advance for the question is initially displayed. That is, when displaying the answer input field, the answer accepting unit 114 determines whether the corresponding question has the first attribute based on, for example, the attribute of the question registered in the answer template, and if it does, causes the subject terminal 20 to display the answer input field in which the common answer has been entered in advance.

[0073] If there is a common question for which no common answer is registered in the answer template among the questions (common questions) of the first attribute, the answer receiving unit 114 does not initially display (i.e., display as an initial value) the common answer in the answer input field for that common question. In other words, the answer receiving unit 114 may initially display the pre-registered common answer only for the common questions for which the common answer is registered in the answer template.

[0074] Furthermore, when a common answer is not registered for a security investigation requested by an evaluation requester (for example, when only the attribute settings of the questions are registered), the answer receiving unit 114 may register the answer entered by the evaluation target person to the questions of the first attribute as the common answer for the question. This allows the answer to the security investigation to be registered as the common answer as is, without the evaluation target person having to individually register the common answer.

[0075] If a common answer has not been registered for a security survey requested by an evaluation requester, the answer receiving unit 114 may register (create) a new answer template in which the answer entered by the evaluation target person to a question of the first attribute is used as the common answer to that question.

[0076] The answer receiving unit 114 may receive from the subject terminal 20 a designation of an answer template to be used to answer questions from the subject to be evaluated. For example, the answer receiving unit 114 receives a selection of a registered answer template from the subject terminal 20, and displays an answer input format corresponding to the selected answer template. The answer input format initially displays a common answer registered in the selected answer template in the answer input field of the question set as the first attribute in the selected answer template.

[0077] The answer receiving unit 114 may display information indicating the designated answer template together with the answer input field on the subject terminal 20. This allows the evaluation requester to input or modify an answer while checking the answer template currently being used. This improves the efficiency of the work of responding to security surveys. For example, the answer receiving unit 114 displays the name of the answer template in an answer input format that includes an answer input field.

[0078] The answer entered in the answer input field (information such as selected options, text, etc.) is accepted by the answer accepting unit 114, for example, by an input operation to send the answer (confirm the answer) on the subject terminal 20, and is registered as answer data. The answer accepting unit 114 may accept editing (modification, deletion, etc.) of the initially displayed common answer in the answer input field before sending the answer. Furthermore, the answer accepting unit 114 may not accept an input operation to send an answer for questions for which the common answer has not been edited. In this case, the answer accepting unit 114 automatically registers the common answer registered in the database (answer template) as answer data.

[0079] When the person to be evaluated inputs a new answer different from the common answer to a question of the first attribute in response to a security survey requested by the evaluation requester, the answer receiving unit 114 may receive from the person to be evaluated (subject terminal 20) whether or not to update the common answer to the new answer, and may further update the common answer with the new answer when updating the common answer is selected on the subject terminal 20. This allows the new answer input in the security survey to be registered as a new common answer without the person to be evaluated individually correcting the common answer.

[0080] For example, when a new answer different from the common answer initially displayed is entered in an answer input field for a question of the first attribute on the subject terminal 20 and the new answer is sent (when the new answer is accepted), the answer accepting unit 114 may display a message asking whether to update the common answer and an object accepting whether to update on the subject terminal 20. Furthermore, the answer accepting unit 114 may display an object accepting the sending of an answer and an option (for example, a check box) accepting whether to update the common answer on the subject terminal 20, and update the common answer depending on the selection status of the option when the answer is sent.

[0081] When the person to be evaluated inputs a new answer that differs from the common answer in the designated answer template to a question of the first attribute, the answer receiving unit 114 may present the person to be evaluated (subject terminal 20) with at least the options of updating the common answer to a new answer and adding a new answer template, and may further replace the common answer in the designated answer template with the new answer if updating the common answer is selected on the subject terminal 20, or may register a new answer template in which the common answer in the designated answer template is replaced with the new answer if adding an answer template is selected. This allows the person to be evaluated to edit or create an answer template by using the new answer input in the security survey as a new common answer without having to edit or create an answer template individually.

[0082] For example, when an answer template is specified, and a new answer different from the common answer initially displayed in the answer input field for a question of a first attribute is entered on the subject terminal 20, and the new answer is sent, the answer receiving unit 114 may display on the subject terminal 20 a first option for updating the common answer of the current answer template (the answer template from which the common answer was called), a second option for creating a new answer template with the new answer as the common answer (registering the new answer as an answer template separate from the answer template from which the common answer was called), and a third option for not registering a new answer (making it a one-time answer).

[0083] When the first option is selected on the target user terminal 20, the answer receiving unit 114 replaces the common answer in the specified answer template with a new answer and registers it. On the other hand, when the second option is selected on the target user terminal 20, the answer receiving unit 114 replaces the common answer in the specified answer template with the new answer, registers a new answer template separately from the specified answer template, and does not update the specified answer template.

[0084] The answer receiving unit 114 may accept an update to the common answer or an addition of a new answer template for each individual question, or may accept an update to the common answer or an addition of a new answer template for each security investigation (answer data unit) including multiple questions. For example, the answer receiving unit 114 may accept the selection of an answer template for updating the common answer (registering a new answer as a common answer) for each question. Furthermore, the answer receiving unit 114 may register a new answer template in which answers (including the common answer) entered for each of multiple first questions in one security investigation are used as the common answers for each first question.

[0085] When the person to be evaluated inputs a new answer to a question of the first attribute that is different from the common answer in the designated answer template, the answer accepting unit 114 may accept a change in the attribute of the question (change to the second attribute) from the subject terminal 20. In this case, the answer accepting unit 114 may present to the subject terminal 20 options of updating the attribute in the designated answer template and adding a new answer template, and may further update the attribute of the question in the designated answer template to the second attribute when updating the answer template is selected in the subject terminal 20, or may register a new answer template in which the attribute of the question in the designated answer template is replaced with the second attribute when adding an answer template is selected.

[0086] Furthermore, the answer receiving unit 114 may receive, from the subject terminal 20, an answer to a question of the second attribute, as well as a change in the attribute of the question (change to the first attribute). In this case, the answer receiving unit 114 may present to the subject terminal 20 options to update the attribute of the designated answer template, newly register a common answer, and add a new answer template, and further, when updating the answer template is selected on the subject terminal 20, the answer receiving unit 114 may update the attribute of the question in the designated answer template to the first attribute and register the input answer as a common answer for the question, and when adding an answer template is selected, the answer receiving unit 114 may replace the attribute of the question in the designated answer template with the first attribute and further register a new answer template in which the input answer is used as the common answer for the question.

[0087] The timing at which the updated common answer (answer template) is registered in the database (the update is reflected) may be after all questions in one security survey have been answered (after the answer data has been registered), or after the evaluation of the answer data has been completed, etc.

[0088] When the person to be evaluated inputs a new answer different from the common answer to the question of the first attribute in the answer input field, the answer receiving unit 114 may present to the person to be evaluated (subject terminal 20) information indicating that the common answer has been changed. This allows the person to be evaluated to notice if the common answer has been changed unintentionally.

[0089] For example, when a new answer is entered in an answer input field, the answer receiving unit 114 may display a message such as "Answer has been edited" above the answer input field. Also, when the common answer in the answer input field has not been edited, the answer receiving unit 114 may display a message such as "Answer matches the template."

[0090] The answer receiving unit 114 may determine that a new answer has been input by comparing information input in an answer input field for a question of the first attribute with information indicating a common answer. Furthermore, if it is determined that a new answer has been input, the answer receiving unit 114 may receive, from the subject terminal 20, an input operation into a transmission reception object that accepts the transmission of a new answer, and if it is determined that a new answer has not been input, the answer receiving unit 114 may not receive, from the subject terminal 20, an input operation into the transmission reception object. This allows the acceptance or rejection of the acceptance of the transmission of an answer to a question of the first attribute to be switched based on the determination of whether a new answer has been input. As a result, if the common answer is maintained, the person being evaluated does not have to take the trouble of inputting information into the transmission reception object.

[0091] The answer receiving unit 114 may display the transmission reception object on the subject terminal 20 only when a new answer is input. Alternatively, the answer receiving unit 114 may display the transmission reception object together with the answer input field on the subject terminal 20 regardless of whether a new answer has been input. In this case, the answer receiving unit 114 may display the transmission reception object in an inactive state (a state in which input is not accepted) when it determines that a new answer has not been input, and may display the transmission reception object in an active state (a state in which input is accepted) when it determines that a new answer has been input. Note that when the transmission reception object is displayed in an active state, input to the transmission reception object is required, and answers to questions may not be accepted unless the survey subject inputs into the transmission reception object.

[0092] If the answer input field includes an input field that accepts the selection of an option, the answer receiving unit 114 determines whether a new answer has been input by comparing the input (selected) option with options registered as common answers. Also, if the answer input field includes a free input field (an input field that accepts text input), the answer receiving unit 114 determines whether a new answer has been input by comparing the text in the answer input field with the text registered as a common answer character by character. The answer receiving unit 114 may determine whether a new answer has been input each time the survey subject edits a new answer (each time the information entered in the answer input field changes).

[0093] Furthermore, if the answer receiving unit 114 determines that a new answer has been input and then the survey subject changes the new answer back to a common answer, the answer receiving unit 114 may determine that a new answer has not been input. In this case, the answer receiving unit 114 may switch the transmission reception object from an active state to an inactive state. Furthermore, once the answer receiving unit 114 determines that a new answer has been input, the answer receiving unit 114 may continue to accept input to the transmission reception object without changing the determination, even if the survey subject changes the new answer back to a common answer.

[0094] The answer receiving unit 114 may change the display mode of the transmission reception object depending on whether a new answer has not been input or whether a new answer has been input. For example, the answer receiving unit 114 may display the transmission reception object in a grayed-out mode with the text "Answered" displayed when a new answer has not been input, and may display the transmission reception object in an active mode with the text "Answered" displayed when a new answer has been input. Furthermore, in accordance with the transmission reception object, when a new answer has not been input, the transmission reception object may be in an inactive state in which an option for accepting whether or not to update the common answer cannot be selected, and when a new answer has been input, the transmission reception object may be in an active state in which the option can be selected.

[0095] When it is determined that a new answer has been input, the answer receiving unit 114 may receive a request to restore the new answer input in the answer input field to the common answer from the subject terminal 20. This allows the common answer to be re-input easily and reliably when a new answer is input by mistake.

[0096] For example, the answer receiving unit 114 displays a restoration reception object that receives a request for processing restoration to a common answer on the subject terminal 20 together with an answer input field, and receives restoration input from the subject terminal 20. The answer receiving unit 114 may display the restoration reception object on the subject terminal 20 only when a new answer has been input.

[0097] The answer receiving unit 114 may highlight the answer input fields for questions for which it is determined that a new answer has been input, more than the answer input fields for questions for which it is determined that a new answer has not been input. For example, the answer receiving unit 114 may highlight the answer input fields by coloring the display area including the questions and the answer input fields, bolding the borders, changing the font, or the like.

[0098] 5 is a diagram showing an example of a request display screen RD displayed on the target terminal 20. The request display screen RD displays, for example, a list of security investigation requests along with information such as the case name, requesting company (evaluation requester), investigation status, request date, desired deadline, and used template (reply template specified when responding). Note that "(Responding)" in the used template indicates that a reply template has not yet been specified. When one of the requests displayed on the request display screen RD is selected, detailed information about that request (progress of the reply) is displayed.

[0099] Fig. 6 is a diagram showing an example of a detail display screen SD displayed on the target user terminal 20. The detail display screen SD is displayed, for example, when any request is selected on the request display screen RD of Fig. 5. The detail display screen SD includes a progress display area PA and a content display area CA.

[0100] The progress display area PA displays the progress of responses to requests in chronological order. In the example of Fig. 6, the status of unanswered requests is shown. In this example, a template selection object OB1, a first start instruction object OB2, and a second start instruction object OB3 are displayed.

[0101] The template selection object OB1 accepts the selection of an answer template to be used for an answer from among the registered answer templates. The first start instruction object OB2 accepts an instruction to start answering using the selected answer template. When an input operation is performed on the first start instruction object OB2, an answer input format in which the common answers registered in the selected answer template are initially input for questions for which the first attribute is set in the selected answer template is displayed on the target user terminal 20. The second start instruction object OB3 accepts an instruction to start answering without using an answer template. When an input operation is performed on the second start instruction object OB3, an answer input format in which the common answers are not initially input in any answer input field is displayed on the target user terminal 20.

[0102] The content display area CA displays detailed content of the request (for example, the case name, the requesting company, the date and time of the request, etc.) Note that the content display area CA may also accept editing of the case name.

[0103] Fig. 7 is a diagram showing an example of the answer input screen FD displayed on the target user terminal 20. Fig. 8 is a diagram showing a continuation of the answer input screen FD of Fig. 7. The answer input screen FD is displayed, for example, when an input is made to the first start instruction object OB2 or the second start instruction object OB3 on the detail display screen SD of Fig. 6. As shown in Fig. 7, the answer input screen FD includes a side panel area SA and an answer input area IA.

[0104] The side panel area SA displays an evaluation request reception object OB4 and a template display object OB5. The evaluation request reception object OB4 receives a request for an answer review (evaluation) of an input answer from the evaluation unit 115, which will be described later. The template display object OB5 displays the answer template (answer template currently in use) specified by the person requesting the evaluation. The template display object OB5 may also receive a request to switch (change) the answer template.

[0105] The answer input area IA displays multiple question areas (first question area QA1, second question area QA2, etc.) and a display switching checkbox CB1. Question areas QA1 and QA2 are displayed for each question included in the security investigation request. The display switching checkbox CB1 accepts narrowing of the question areas QA1 and QA2 to be displayed in the answer input area IA. Specifically, when the display switching checkbox CB1 is checked, only question areas QA1 and QA2 for which no answer (including automatically entered common answers) has been entered are displayed in the answer input area IA. Note that in the examples of Figures 7 and 8, question areas QA1 and QA2 for questions of the first attribute are displayed.

[0106] Each question area (first question area QA1 and second question area QA2) displays a question QI, an answer input field IF, a determination message JM, and a transmission receipt object OB6. The determination message JM indicates the determination result of whether a new answer different from the common answer has been entered for the question of the first attribute. In the first question area QA1 shown in FIG. 7, the common answer (the "Yes" option and the detailed answer content) has not been changed, so a determination message JM is displayed indicating that the answer matches the template. Note that the determination message JM is not displayed for questions of the second attribute. The transmission receipt object OB6 accepts the transmission of a new answer. In the example of FIG. 7, the common answer has not been changed in the first question area QA1, so the transmission receipt object OB6 is grayed out (inactivated).

[0107] 8, the common answer has been changed (when the common answer was "Yes," a new answer of "No" has been selected), so a determination message JM indicating that the answer has been edited is displayed. Furthermore, in response to the change in the common answer, the second question area QA2 is displayed in a different manner from the first question area QA1 (for example, in a highlighted form (thick frame)). Furthermore, in the second question area QA2, a transmission reception object OB6 has been activated.

[0108] In addition, in the second question area QA2, a restoration reception object OB7 is displayed in response to the change in the common answer. The restoration reception object OB7 accepts the restoration of the new answer to the common answer. When an input operation is performed on the restoration reception object, the input content in the answer input field IF in the second question area QA2 is changed to the common answer (for example, "Yes"). In addition, in accordance with this, the content of the judgment message JM and the display form of the second question area QA2 are changed (to the same as in the first question area QA1), and the transmission reception object OB6 is grayed out.

[0109] Fig. 9 is a diagram showing an example of a template update screen TD displayed on the target user terminal 20. The template update screen TD is displayed, for example, when a request for an answer review is made by inputting information into the evaluation request reception object OB4 on the answer input screen FD in Fig. 7. The template update screen TD displays template information TI, a selection input field SF, a save refusal object OB8, and a save reception object OB9.

[0110] The template information TI displays the name of the answer template used for the answer (specified when the answer was created). The selection input field SF displays a first option for updating the common answer in the answer template and a second option for adding a new answer template. The first option displays a message that the update of the common answer will be notified to the evaluation user by the answer providing unit 116 (described later), and the question (item number) of the first attribute for which a new answer has been entered. The second option displays an input field for accepting input of the registration name (administration name) of the new answer template.

[0111] When an input operation is performed on the save refusal object OB8, the answer data is registered without updating the answer template or registering a new answer template. When an input operation is performed on the save acceptance object OB9, if the first option is selected, a new common answer is saved by updating the answer template, and if the second option is selected, a new common answer is saved by adding a new answer template.

[0112] FIG. 10 is a diagram showing another example of a question area displayed on the answer input screen FD. FIG. 10 shows a modified example of the second question area QA2 (a question area in which the common answer is edited) in FIG. 8. In the second question area QA2 in FIG. 10, a template update checkbox CB2 is displayed next to the transmission reception object OB6. When an input operation is performed on the transmission reception object OB6 with the template update checkbox CB2 checked (the update option for the common answer selected), the new answer entered in the answer input field IF is sent and the common answer of the answer template being used is updated to the new answer. On the other hand, when an input operation is performed on the transmission reception object OB6 with the template update checkbox CB2 unchecked (the update option for the common answer unselected), only the new answer entered in the answer input field IF is sent, and the common answer of the answer template is not updated. Note that if a new answer has not been entered (the common answer has not been edited), the template update checkbox CB2 may be inactivated.

[0113] <Evaluation Department 115> The evaluation unit 115 is configured to determine an evaluation score based on the evaluation subject's responses to a plurality of questions included in the security survey.

[0114] Specifically, the evaluation unit 115 determines the evaluation score by receiving, from the evaluator, the evaluation result for the answer data registered (created or updated) by the answer receiving unit 114. The evaluation unit 115, for example, registers the evaluated answer data together with the evaluation result in an answer database or the like. The evaluation result includes at least an evaluation score (security score) indicating the level of the security measures (how many or few problems there are in the security measures). The evaluation score is calculated based on the scores of each question item.

[0115] "Evaluation" refers to the act of checking for deficiencies or inconsistencies in the answers included in the answer data, making comments on the content of the answers, assessing the content of the answers, scoring the answers based on predetermined criteria, etc. As described above, evaluation may be performed by multiple evaluators, or a first evaluator may request a second evaluator to evaluate the registered answer data. In this case, the evaluation unit 115 may accept an evaluation from the second evaluator after the first evaluator's evaluation.

[0116] For example, if the evaluation is performed in two stages, the initial evaluation (review) involves checking for deficiencies or inconsistencies and creating points of criticism. Subsequently, the response data after the initial evaluation is subjected to a final evaluation, which involves assessing and scoring the content (response) based on predetermined criteria, and creating comments on the entire response data, and a report or report (e.g., a security report) including the results is created. The report or report is created, for example, by a final evaluator. The evaluation results of the response data may be included in the report or report as part of the report or report or as reference information.

[0117] The evaluation unit 115 may calculate an evaluation score for the response data based on the response (response data) of the person being evaluated to the questions and the reference information. The reference information includes a correlation between the response data and the evaluation score. The reference information is stored, for example, in the storage unit 12. The reference information may include, for example, a table, a function, a simple algorithm, or the like, which indicates the correlation between the response data and the evaluation score. The correlation included in the reference information can be constructed, for example, by statistically analyzing data recording the response data and the corresponding evaluation score.

[0118] The reference information may include a learning model that uses answer data as input and is machine-learned to output an evaluation score, or an evaluation model that is a generative AI. In this case, the evaluation unit 115 inputs the answer data into the evaluation model and causes the evaluation model to output an evaluation score. This makes it possible to create an evaluation score based on actual evaluation examples of the answer data or natural language processing. In the evaluation model, parameters calculated, tuned, etc. through learning constitute the correlation of the reference information.

[0119] The evaluation model is included in the artificial intelligence unit 120. The evaluation model, which has been trained to be able to output an evaluation score, is trained using, for example, answer data and data on the corresponding evaluation score as training data.

[0120] When the evaluation model is a generative AI including a general-purpose natural language model (large-scale language model), the evaluation unit 115 inputs answer data, inputs a prompt including an instruction to output an evaluation score corresponding to the answer data to the evaluation model, and causes the evaluation model to output the evaluation score. The evaluation unit 115 may generate a prompt that instructs the evaluation model to calculate the evaluation score and input the prompt to the evaluation model. Furthermore, the evaluation unit 115 may input, in addition to the instruction to calculate and output the evaluation score and the answer data, a prompt that inserts, for example, one or more answer data samples and one or more corresponding evaluation score samples as examples, samples, or training data of input and output pairs to the evaluation model.

[0121] The evaluation unit 115 may create all or part of an evaluation result (report or report) including comments, etc. in addition to the evaluation score, based on the response data and the reference information. For example, the evaluation model may be configured to receive the response data as input and output the evaluation result.

[0122] Evaluation (determination of evaluation score) is typically performed on answer data in which all questions have been answered. Answer data that has unanswered questions (questions for which answers are not registered) is not subject to evaluation, and the evaluation unit 115 may not determine an evaluation score or create an evaluation result. Furthermore, even if answer data includes unanswered questions (questions for which answers are not registered), only the answered questions may be subject to partial evaluation.

[0123] <Answer provision section 116> The answer providing unit 116 is configured to provide answer data including answers to questions by the person to be evaluated to the evaluation user (user terminal 40). The answer providing unit 116 may provide the evaluation results created by the evaluation unit 115 to the evaluation user (especially the evaluation requester who requested the security investigation) together with the answer data.

[0124] The response data and the evaluation results may be provided to the evaluation user by, for example, being registered in a database accessible to the evaluation user and notifying the evaluation user of access information to the response data and the evaluation results. Also, the response data and the evaluation results may be provided to the evaluation user by being attached to or written in a communication tool such as an email sent to the evaluation user.

[0125] When the common answer applied to the answer data already provided to the evaluation user is updated by the person to be evaluated, the answer providing unit 116 may update the answer to which the common answer is applied in the answer data. This makes it possible to update the answer data already provided to the evaluation user to the latest answer content when the answer content (e.g., certification, system, etc.) to the question item (common question) of the first attribute of the person to be evaluated changes.

[0126] The update of the common answer here may be performed when responding to a request for a new security investigation, as described above, or may be performed as an edit of the answer template by the evaluation requester, independent of the response to an individual security investigation.

[0127] The answer data already provided to the evaluation user is updated, for example, in a database in which the answer data is registered. The answer providing unit 116 may also transmit the updated answer data to the user terminal 40.

[0128] When the common answer applied to the answer data already provided to the evaluation user is updated by the person to be evaluated, the answer providing unit 116 notifies the evaluation user (user terminal 40) that the common answer has been updated. This allows the evaluation user to know when the content of the answer to the question (common question) of the first attribute of the person to be evaluated has changed, and therefore allows the evaluation user to check the updated common answer.

[0129] The notification to the evaluation user (a notification message sent to the user terminal 40) may include only the fact that the common answer has been updated, or it may include information indicating the updated common answer (e.g., the question number, the item name, etc.), the content of the common answer, etc.

[0130] When the common answer applied to the answer data already provided to the evaluation user is cancelled by the person being evaluated (i.e., when the attribute of the corresponding question is changed from the first attribute to the second attribute), the answer providing unit 116 may notify the evaluation user (user terminal 40) that the answer is no longer a common answer (has become an individual answer).

[0131] <Information presentation section 117> The information presenting unit 117 is configured to present analytical information relating to answer data, answer templates, evaluation scores, etc. to the person to be evaluated or the evaluation user.

[0132] Specifically, the information presenting unit 117 may present to the person being evaluated (subject terminal 20) or the evaluation user (user terminal 40) first percentage information indicating the percentage of questions to which the common answer is applied as an answer among the multiple questions included in the security survey. This allows the person being evaluated to understand, for example, the degree of consistency of his or her own security quality across multiple survey targets. Also, the evaluation user can understand, for example, the percentage of customization of security measures according to the survey targets of the person being evaluated.

[0133] "Questions to which a common answer is applied as an answer" (hereinafter referred to as "specific questions") may refer to, for example, questions of the first attribute to which a common answer registered in an answer template is used as an answer as is, and may not include questions to which a new answer has been confirmed as an answer even if a corresponding common answer is registered. In other words, the percentage indicated by the first percentage information does not include questions of the first attribute to which a common answer has not been applied (i.e., to which a new answer has been entered).

[0134] The first ratio information may be a numerical value indicating the ratio (the ratio between the common answer and the individual answers other than the common answer), or may be data illustrating the ratio such as a bar graph, or a combination thereof. Furthermore, the display format of the first ratio information on the subject terminal 20 may be different from the display format of the first ratio information on the user terminal 40.

[0135] The "individual answers" may include, for example, answers to questions of the second attribute and new answers to questions of the first attribute that are different from the registered common answers.

[0136] The first percentage information may be presented, for example, on an editing screen of the answer template displayed on the subject terminal 20. Furthermore, the first percentage information may be displayed on the user terminal 40 together with the answer data and / or the evaluation results, or may be displayed on the user terminal 40 as part of the information when the information of the subject to be evaluated is displayed (for example, when the evaluation user searches for the subject to be evaluated).

[0137] The information presenting unit 117 may present to the person to be evaluated (subject terminal 20) or the evaluation user (user terminal 40) second ratio information indicating the ratio between the score based on the common answer and the score based on an individual answer other than the common answer in the evaluation score determined by the evaluating unit 115. This makes it possible to visualize the attributes of the person to be evaluated based on a comparison between the score in the common answer and the score in the individual answer.

[0138] The "score based on the common answer" is, for example, the sum of the evaluation scores for the questions to which the common answer was entered. The "score based on the individual answers" is, for example, the sum of the evaluation scores for the questions to which the individual answers were entered.

[0139] The second ratio information may be a numerical value indicating the ratio (the ratio between the score of the common answer and the score of an individual answer), data illustrating the ratio such as a bar graph, or a combination thereof. Furthermore, the display format of the second ratio information on the subject terminal 20 may be different from the display format of the second ratio information on the user terminal 40.

[0140] The second percentage information may be displayed as part of the evaluation results of the response data displayed on the subject terminal 20 or the user terminal 40, for example.

[0141] The information presenting unit 117 may present the first statistical score for each answer template registered by one evaluation target to the evaluation target (target terminal 20) or evaluation user (user terminal 40). The "first statistical score" indicates the statistical value of the evaluation score for each of multiple security surveys in which the answer template was used. This allows the evaluation target or evaluation user to understand the trend of the evaluation score for each answer template with different question attributes and / or common answers.

[0142] The "multiple security investigations" that are the subject of the first statistical score may include only security investigations requested by one evaluation user (evaluation requester), or may include security investigations requested by multiple evaluation users (evaluation requesters), and typically include all security investigations in which one answer template was used. In addition, the "statistical value" includes an average, maximum value, minimum value, deviation, etc.

[0143] The information presenting unit 117 may present the second statistical score for each evaluation target to the evaluation target (target terminal 20) or the evaluation user (user terminal 40). The second statistical score indicates the statistical value of the first statistical score for each of the multiple answer templates registered by the evaluation target. This allows the evaluation target or evaluation user to understand the overall evaluation score trend of the evaluation target.

[0144] The "multiple answer templates" that are the subject of the second statistical score may include only answer templates used in security surveys requested by one evaluation user (evaluation requester), or may include answer templates used in security surveys requested by multiple evaluation users (evaluation requesters), and typically include all answer templates registered by the person being evaluated.

[0145] The first statistical score and the second statistical score may be numerical values ​​indicating the statistical value itself, or may be data illustrating the magnitude of the statistical value such as a bar graph, or may be score distribution data (for example, a distribution table or histogram indicating the distribution of each score). Furthermore, the display form of the first statistical score and the second statistical score on the subject terminal 20 may be different from the display form of the first statistical score and the second statistical score on the user terminal 40.

[0146] The first statistical score and the second statistical score may be presented, for example, on an editing screen of an answer template displayed on the subject terminal 20. Furthermore, the first statistical score and the second statistical score may be presented, for example, as part of the information when the information of the subject to be evaluated is displayed (for example, when the evaluation user searches for the subject to be evaluated).

[0147] Fig. 11 is a diagram showing an example of the display format of the first statistical score and the second statistical score displayed on the subject terminal 20 or the user terminal 40. In the example of Fig. 11A, the first statistical scores (minimum, maximum, and average values) for each of two answer templates (template A and template B) are displayed numerically and as a bar graph. In the example of Fig. 11B, the second statistical score (average value) is displayed numerically, and its breakdown (first statistical score for each answer template) is also displayed.

[0148] <Artificial Intelligence Department 120> The artificial intelligence unit 120 is configured to receive input from each functional unit and return the instructed output. The artificial intelligence used by the server device 10 in each functional unit may be a common one, or may be prepared individually for each functional unit.

[0149] The artificial intelligence unit 120 may be an AI (Artificial Intelligence) equipped with a learning model such as a language model, such as a Transformer (including GPT (Generative Pretrained Transformer, including GPT-1, GPT-2, GPT-3, and GPT-4)), a Bidirectional Encoder Representations from Transformers (BERT), a Bidirectional and Auto-regressive Transformer (BART), or a Recurrent Neural Network (RNN). The artificial intelligence unit 120 may be, for example, a generative AI or an AI agent including a large-scale language model. A large-scale language model is a type of generative AI and includes models provided by services such as OpenAI's GPT, Google's Gemini, and Microsoft's Azure AI Studio. The artificial intelligence unit 120 may also include any machine learning model, deep learning model, artificial intelligence model, or the like.

[0150] The language model is an example of a learning model based on a machine learning algorithm. Specific examples of machine learning algorithms include nearest neighbor methods, naive Bayes methods, decision trees, support vector machines, and deep learning using neural networks. The artificial intelligence unit 120 can apply the above algorithms as appropriate.

[0151] The artificial intelligence unit 120 may have a trained model constructed by a learning method such as supervised learning, unsupervised learning, or self-supervised learning. In supervised learning, machine learning is performed using training data (training data). The training data consists of pairs of input data for learning and output data (correct answer data). Furthermore, the language model may not only be trained for a specific task, but also be a general-purpose model that can be used for a wide range of tasks.

[0152] The artificial intelligence unit 120 may include a natural language model as its artificial intelligence, or may be a general-purpose natural language processing trained model such as a large-scale language model (LLM). An LLM is a learning model that has previously trained a large amount of data, such as text data (e.g., (i) web content on the Internet, or (ii) data stored in a specified database). It can perform various language processing tasks when given a task, and can perform a wide range of natural language processing tasks, such as understanding sentence patterns and context, answering questions, and generating sentences, according to given prompts. Such a general-purpose learning model includes a language model that can handle various tasks without fine-tuning, using one-shot learning, few-shot learning, etc. Furthermore, a general-purpose learning model may also be configured to handle various tasks using zero-shot learning. The artificial intelligence used in each functional unit of the control unit 11 may be a separate learning model, or a common general-purpose learning model.

[0153] The learning models included in the artificial intelligence unit 120 (learning models used in each functional unit, such as the evaluation score calculation model) can undergo additional learning using techniques such as transfer learning and fine tuning. For example, each time new data is registered, the artificial intelligence unit 120 may perform additional learning and fine tuning using the new data as new training data. This improves the accuracy of the information output from the learning model.

[0154] The learning model included in the artificial intelligence unit 120 may be a learning model (distilled model) obtained by knowledge distillation using an original learning model. In knowledge distillation, a trained model such as a large-scale language model is used as a teacher model, and the parameters of the student model are adjusted to reduce the output loss (Soft Target Loss) of the student model (distilled model) relative to the output (Soft Target) of the teacher model, thereby learning the student model, which becomes the distilled model. Alternatively, the student model may be learned to reduce the output loss (Hard Target Loss) of the student model relative to the correct label (Hard Target) of the teacher data (combination of input data and output data of the learning model). Compared to the original learning model (teacher model), the distilled model has a smaller number of parameters and a smaller processing load while maintaining performance similar to the learning model. Therefore, using a distilled model can reduce the cost of the information processing system 1.

[0155] For example, the learning model used in each functional unit may be a distilled model trained using a combination of input data and output data in a large-scale language model as training data. Furthermore, when the information processing system 1 is introduced, a large-scale language model may be used as the learning model used in each functional unit, and when training data from the large-scale language model is accumulated, a distilled model obtained by knowledge distillation using the training data may be used as the learning model used in each functional unit.

[0156] <Display section> The display unit 211 of the subject terminal 20, the display unit 311 of the evaluator terminal 30, and the display unit 411 of the user terminal 40 each display a screen indicated by the screen data transmitted from the server device 10.

[0157] <Operation acquisition part> The operation acquisition unit 212 of the subject terminal 20 accepts operations by the subject to be evaluated who uses the subject terminal 20. The operation acquisition unit 312 of the evaluator terminal 30 accepts operations by the evaluator who uses the evaluator terminal 30. The operation acquisition unit 412 of the user terminal 40 accepts operations by the evaluation user who uses the user terminal 40.

[0158] 3. Information Processing Method This section describes an information processing method of the server device 10. This information processing method is executed by a computer, with each unit of the server device 10 acting as each step.

[0159] This information processing includes a registration step, an investigation request receiving step, an answer receiving step, an evaluation step, and an answer providing step. In the registration step, attributes of questions included in a security investigation for the person being evaluated are registered. In the investigation request receiving step, a request for a security investigation for the person being evaluated is received from the evaluation requester. In the answer receiving step, input of answers to questions for a first attribute and questions for a second attribute is received from the person being evaluated in the respective answer input fields. In the evaluation step, an evaluation score is determined based on the answers of the person being evaluated to multiple questions included in the security investigation. In the answer providing step, answer data including the answers to the questions by the person being evaluated is provided to the evaluation user.

[0160] 12 is an activity diagram showing an example of the flow of information processing (security investigation processing) executed by the information processing system 1. Below, the information processing will be described along with each activity in this activity diagram.

[0161] The security survey process begins with the person being evaluated setting the attributes of the questions included in the security survey. The person being evaluated sets the attributes of the questions on the person being evaluated terminal 20, for example, by creating a response template (activity A101). The server device 10 registers the attributes of the questions entered on the person being evaluated terminal 20 (activity A102). Note that the setting of attributes by the person being evaluated may be omitted. In other words, the setting and registration of attributes may be performed when the person being evaluated enters responses to the security survey.

[0162] After registering the attributes, the evaluation user (evaluation requester) inputs a request for a security investigation into the user terminal 40 (activity A103). The server device 10 accepts the request for a security investigation from the user terminal 40 (activity A104). Next, the server device 10 outputs an answer input form, in which common answers are initially input to the questions for the first attribute, to the subject terminal 20 of the person to be evaluated who is the subject of the security investigation (activity A105). As a result, the answer input form is displayed on the subject terminal 20 (activity A106).

[0163] The person to be evaluated inputs an answer in the answer input form displayed on the subject terminal 20 (activity A107). The server device 10 accepts the answer input at the subject terminal 20 as answer data (activity A108). Next, the server device 10 evaluates the answer data, including determining an evaluation score (activity A109). Furthermore, the server device 10 outputs the answer data and the evaluation result to the user terminal 40 (activity A110). As a result, the answer data and the evaluation result are displayed on the user terminal 40 (activity A111).

[0164] 4. Effect The operation of this embodiment can be summarized as follows: That is, by initially displaying pre-registered common answers to common questions in a security survey, the survey subjects can efficiently answer the security survey.

[0165] Although the embodiment of the present invention has been described above, the present invention is not limited to this and can be modified as appropriate within the scope of the technical idea of ​​the invention.

[0166] 5.Other In the above embodiment, the server device 10 performs various storage and control functions. However, multiple external devices may be used instead of the server device 10. That is, various information and programs may be distributed and stored in multiple external devices using blockchain technology or the like. In particular, the artificial intelligence unit 120 may be an external component of the server device 10. In this case, the external artificial intelligence unit 120 may be provided, for example, by an artificial intelligence service server and configured to receive inputs from each functional unit of the server device 10, receive requests to execute artificial intelligence services, and return the instructed output as a processing result to the server device 10. The artificial intelligence service server may be a server that provides services using a language model as a learning model, or a server that executes language processing tasks using a language model. The artificial intelligence service server may be constructed using LLM. The artificial intelligence service server receives inputs of prompts such as text, images, and voice, and generates and responds to the prompts.

[0167] The control unit 11 does not necessarily have to include the information presenting unit 117. In other words, the information processing system 1 does not necessarily have to present analytical information (first ratio information, second ratio information, first statistical score, second statistical score, etc.) related to answer data, answer templates, evaluation scores, etc.

[0168] The aspect of this embodiment is not limited to the information processing system 1, and may be an information processing method or a program. The information processing method includes steps executed by the information processing system 1. The program causes a computer to execute the steps of the information processing system 1.

[0169] It may be provided in the following manner.

[0170] (1) An information processing system comprising at least one processor, the processor being configured to execute each of the following steps by reading a program: in a registration step, attributes of questions included in a security survey for a person to be evaluated are registered, wherein the attributes include a first attribute indicating a common question for which a common answer that can be used for multiple targets of the security survey for the person to be evaluated is set, and a second attribute indicating an individual question for which an individual answer is required for each target of the security survey for the person to be evaluated; in an answer reception step, answers to the questions of the first attribute and the questions of the second attribute are received from the person to be evaluated in respective answer input fields, wherein the common answer previously registered for the question is initially displayed in the answer input field for the question of the first attribute.

[0171] (2) In the information processing system described in (1) above, the registration step receives, from the person to be evaluated, a designation of the attribute for the question.

[0172] (3) In the information processing system described in (1) or (2) above, in the investigation request receiving step, a request for the security investigation for the person being evaluated is received from the person requesting the evaluation, and in the response receiving step, if the common response is not registered for the security investigation requested by the person requesting the evaluation, the response entered by the person being evaluated to the question of the first attribute is registered as the common response to the question.

[0173] (4) In an information processing system described in any one of (1) to (3) above, in the investigation request receiving step, a request for the security investigation for the person being evaluated is received from the person requesting the evaluation, and in the response receiving step, when the person being evaluated enters a new response different from the common answer to the question of the first attribute for the security investigation requested by the person requesting the evaluation, an information processing system is provided in which the person being evaluated indicates whether or not to update the common answer to the new answer when updating the common answer is selected.

[0174] (5) In the information processing system described in any one of (1) to (4) above, in the registration step, a plurality of answer templates are registered in which at least some of the attributes of each of the plurality of questions and the common answers for the questions of the first attribute are different from each other, wherein the answer templates include the plurality of questions included in the security survey, the attributes of each of the questions, and the common answers for the questions of the first attribute among the questions, and in the answer receiving step, designation of the answer template to be used in answering the questions is received from the person being evaluated.

[0175] (6) In the information processing system described in (5) above, in the answer receiving step, information indicating the designated answer template is displayed together with the answer input field.

[0176] (7) In the information processing system described in (5) or (6) above, in the answer receiving step, when the person to be evaluated inputs a new answer that is different from the common answer in the designated answer template to the question of the first attribute, the information processing system presents the person to be evaluated with at least two options: updating the common answer to the new answer and adding a new answer template; and, if updating the common answer is selected, replacing the common answer in the designated answer template with the new answer, and, if adding the answer template is selected, registering a new answer template in which the common answer in the designated answer template is replaced with the new answer.

[0177] (8) In the information processing system described in any one of (1) to (7) above, in the answer receiving step, when the person being evaluated enters a new answer that is different from the common answer to the question of the first attribute, information indicating that the common answer has been changed is presented to the person being evaluated.

[0178] (9) In the information processing system described in (8) above, in the answer receiving step, it is determined that a new answer has been input by comparing the information entered in the answer input field for the question of the first attribute with information indicating the common answer, and if it is determined that the new answer has been input, it accepts an input operation to a transmission reception object that accepts the transmission of the new answer, and if it is determined that the new answer has not been input, it does not accept an input operation to the transmission reception object.

[0179] (10) In the information processing system described in (9) above, if it is determined that a new answer has been input in the answer receiving step, the information processing system accepts the restoration of the new answer entered in the answer input field to the common answer.

[0180] (11) In the information processing system described in any one of (1) to (10) above, the processor is configured to further execute the following steps: in the answer providing step, answer data including the answers to the questions by the person being evaluated is provided to the evaluation user; and when the common answer applied to the answer data already provided to the evaluation user is updated by the person being evaluated, the answer to which the common answer is applied in the answer data is updated.

[0181] (12) In the information processing system described in any one of (1) to (11) above, the processor is configured to further execute the following steps: in the answer providing step, answer data including the answers to the questions by the person being evaluated is provided to the evaluation user; and when the common answer applied to the answer data already provided to the evaluation user is updated by the person being evaluated, the information processing system notifies the evaluation user that the common answer has been updated.

[0182] (13) In the information processing system described in any one of (1) to (12) above, the processor is configured to further execute the following steps: in the information presentation step, presenting to the person being evaluated or the evaluation user information indicating the percentage of the questions included in the security survey to which the common answer is applied as an answer.

[0183] (14) In the information processing system described in any one of (1) to (13) above, the processor is configured to further perform the following steps: in the evaluation step, an evaluation score is determined based on the responses of the person being evaluated to the multiple questions included in the security survey; and in the information presentation step, information indicating the ratio of the score based on the common answer to the score based on answers other than the common answer is presented to the person being evaluated or the evaluation user.

[0184] (15) In the information processing system described in any one of (5) to (7) above, the processor is configured to further perform the following steps: in the evaluation step, an evaluation score is determined based on the answers of the person being evaluated to the multiple questions included in the security survey; and in the information presentation step, a first statistical score for each answer template is presented to the person being evaluated or the evaluation user, wherein the first statistical score indicates a statistical value of the evaluation score for each of the multiple security surveys in which the answer template was used.

[0185] (16) In the information processing system described in (15) above, in the information presentation step, a second statistical score for each of the evaluation subjects is presented to the evaluation subject or the evaluation user, and the second statistical score indicates a statistical value of the first statistical score for each of the multiple answer templates registered by the evaluation subject.

[0186] (17) An information processing method, comprising steps executed by the information processing system according to any one of (1) to (16) above.

[0187] (18) A program for causing a computer to execute each step of the information processing system described in any one of (1) to (16) above. Of course, this is not the case.

[0188] Finally, while various embodiments of the present disclosure have been described, they are presented as examples and are not intended to limit the scope of the invention. The novel embodiments may be embodied in various other forms, and various omissions, substitutions, and modifications may be made without departing from the spirit of the invention. Such embodiments and modifications are intended to be included within the scope and spirit of the invention, as well as within the scope of the inventions and their equivalents as defined in the claims. [Explanation of symbols]

[0189] 1: Information processing system 2: Communication line 10: Server device 11: Control section 111: Basic display control section 112: Registration Department 113: Investigation Request Reception Department 114: Answer Reception Department 115: Evaluation section 116:Answer provision department 117: Information presentation section 120: Artificial Intelligence Department 12: Storage section 13: Communications Department 14: Communication bus 20: Target device 21: Control unit 211:Display section 212: Operation acquisition section 22: Storage section 23: Communications Department 24: Input section 25: Output section 26: Communication bus 30: Evaluator terminal 31: Control unit 311: Display section 312: Operation acquisition section 32: Storage section 33: Communications Department 34: Input section 35: Output section 36: Communication bus 40: User terminal 41: Control unit 411: Display section 412: Operation acquisition section 42: Storage section 43: Communications Department 44: Input section 45: Output section 46: Communication bus CA:Content display area CB1: Display switching checkbox CB2: Template Update Checkbox FD: Answer input screen IA: Answer input area IF:Answer input field JM: Judgment message OB1: Template Selection Object OB2: First start instruction object OB3: Second start instruction object OB4: Evaluation request reception object OB5: Template display object OB6: Outbound Receipt Object OB7: Restore Reception Object OB8: Objects denied to save OB9: Save Reception Object PA: Progress display area QA1: 1st question area QA2: 2nd question area QI: Questions RD: Request display screen SA: Side panel area SD:Details display screen SF:Selection input field TD: Template update screen TI: Template Information

Claims

1. An information processing system, at least one processor; The processor is configured to execute the following steps by reading the program: In the registration step, attributes of questions included in a security survey for the person being evaluated are registered, wherein the attributes include a first attribute indicating a common question for which a common answer that can be used for multiple targets of the security survey for the person being evaluated is set, and a second attribute indicating an individual question requiring an individual answer for each target of the security survey for the person being evaluated; In the answer receiving step, input of answers to the questions regarding the first attribute and the questions regarding the second attribute is received from the evaluation subject in each answer input field, and the common answer registered in advance for the question is initially displayed in the answer input field for the question regarding the first attribute; In the registration step, the information processing system receives, from the person to be evaluated, a specification of the attribute for the question.

2. An information processing system, at least one processor; The processor is configured to execute the following steps by reading the program: In the registration step, attributes of questions included in a security survey for the person being evaluated are registered, wherein the attributes include a first attribute indicating a common question for which a common answer that can be used for multiple targets of the security survey for the person being evaluated is set, and a second attribute indicating an individual question requiring an individual answer for each target of the security survey for the person being evaluated; In the answer receiving step, input of answers to the questions regarding the first attribute and the questions regarding the second attribute is received from the evaluation subject in each answer input field, and the common answer registered in advance for the question is initially displayed in the answer input field for the question regarding the first attribute; In the investigation request receiving step, a request for the security investigation of the evaluation target is received from an evaluation requester; In the response reception step, if the common response is not registered for the security survey requested by the evaluation requester, the information processing system registers the response entered by the person being evaluated to the question of the first attribute as the common response to the question.

3. An information processing system, at least one processor; The processor is configured to execute the following steps by reading the program: In the registration step, attributes of questions included in a security survey for the person being evaluated are registered, wherein the attributes include a first attribute indicating a common question for which a common answer that can be used for multiple targets of the security survey for the person being evaluated is set, and a second attribute indicating an individual question requiring an individual answer for each target of the security survey for the person being evaluated; In the answer receiving step, input of answers to the questions regarding the first attribute and the questions regarding the second attribute is received from the evaluation subject in each answer input field, and the common answer registered in advance for the question is initially displayed in the answer input field for the question regarding the first attribute; In the investigation request receiving step, a request for the security investigation of the evaluation target is received from an evaluation requester; In the response acceptance step, when the person being evaluated enters a new response different from the common response to the question of the first attribute in response to the security survey requested by the evaluation requester, an information processing system accepts from the person being evaluated whether or not to update the common response to the new response, and further updates the common response with the new response if updating the common response is selected.

4. An information processing system, at least one processor; The processor is configured to execute the following steps by reading the program: In the registration step, attributes of questions included in a security survey for the person being evaluated are registered, wherein the attributes include a first attribute indicating a common question for which a common answer that can be used for multiple targets of the security survey for the person being evaluated is set, and a second attribute indicating an individual question requiring an individual answer for each target of the security survey for the person being evaluated; In the answer receiving step, input of answers to the questions regarding the first attribute and the questions regarding the second attribute is received from the evaluation subject in each answer input field, and the common answer registered in advance for the question is initially displayed in the answer input field for the question regarding the first attribute; In the registration step, a plurality of answer templates are registered, each of which differs from the other in at least some of the attributes of each of the plurality of questions and the common answers for the questions of the first attribute, wherein the answer template includes the plurality of questions included in the security investigation, the attributes of each of the questions, and the common answers for the questions of the first attribute among the questions, In the answer receiving step, a designation of the answer template to be used for answering the questions is received from the person to be evaluated.

5. 5. The information processing system according to claim 4, In the answer receiving step, information indicating the designated answer template is displayed together with the answer input field.

6. 5. The information processing system according to claim 4, In the answer receiving step, when the person to be evaluated inputs a new answer that is different from the common answer in the designated answer template to the question of the first attribute, the information processing system presents the person to be evaluated with at least options of updating the common answer to the new answer and adding a new answer template, and further, when updating the common answer is selected, replaces the common answer in the designated answer template with the new answer, and when adding the answer template is selected, registers the new answer template in which the common answer in the designated answer template is replaced with the new answer.

7. An information processing system, at least one processor; The processor is configured to execute the following steps by reading the program: In the registration step, attributes of questions included in a security survey for the person being evaluated are registered, wherein the attributes include a first attribute indicating a common question for which a common answer that can be used for multiple targets of the security survey for the person being evaluated is set, and a second attribute indicating an individual question requiring an individual answer for each target of the security survey for the person being evaluated; In the answer receiving step, input of answers to the questions regarding the first attribute and the questions regarding the second attribute is received from the evaluation subject in each answer input field, and the common answer registered in advance for the question is initially displayed in the answer input field for the question regarding the first attribute; In the answer acceptance step, when the person being evaluated enters a new answer that differs from the common answer to the question of the first attribute, the information processing system presents the person being evaluated with information indicating that the common answer has been changed.

8. 8. The information processing system according to claim 7, In the response receiving step, determining whether the new answer has been input by comparing information input in the answer input field for the question of the first attribute with information indicating the common answer; When it is determined that the new response has been input, the information processing system accepts an input operation to a transmission reception object that accepts the transmission of the new response, and when it is determined that the new response has not been input, the information processing system does not accept an input operation to the transmission reception object.

9. 9. The information processing system according to claim 8, In the answer receiving step, if it is determined that the new answer has been input, the information processing system receives a request to restore the new answer input in the answer input field to the common answer.

10. An information processing system, at least one processor; The processor is configured to execute the following steps by reading the program: In the registration step, attributes of questions included in a security survey for the person being evaluated are registered, wherein the attributes include a first attribute indicating a common question for which a common answer that can be used for multiple targets of the security survey for the person being evaluated is set, and a second attribute indicating an individual question requiring an individual answer for each target of the security survey for the person being evaluated; In the answer receiving step, input of answers to the questions regarding the first attribute and the questions regarding the second attribute is received from the evaluation subject in each answer input field, and the common answer registered in advance for the question is initially displayed in the answer input field for the question regarding the first attribute; In the answer providing step, answer data including the answers to the questions by the person being evaluated is provided to the evaluation user, and when the common answer applied to the answer data already provided to the evaluation user is updated by the person being evaluated, the answer to which the common answer is applied in the answer data is updated, in the information processing system.

11. An information processing system, at least one processor; The processor is configured to execute the following steps by reading the program: In the registration step, attributes of questions included in a security survey for the person being evaluated are registered, wherein the attributes include a first attribute indicating a common question for which a common answer that can be used for multiple targets of the security survey for the person being evaluated is set, and a second attribute indicating an individual question requiring an individual answer for each target of the security survey for the person being evaluated; In the answer receiving step, input of answers to the questions regarding the first attribute and the questions regarding the second attribute is received from the evaluation subject in each answer input field, and the common answer registered in advance for the question is initially displayed in the answer input field for the question regarding the first attribute; In the answer providing step, the information processing system provides answer data including the answers to the questions by the person being evaluated to the evaluation user, and when the common answer applied to the answer data already provided to the evaluation user is updated by the person being evaluated, notifies the evaluation user that the common answer has been updated.

12. An information processing system, at least one processor; The processor is configured to execute the following steps by reading the program: In the registration step, attributes of questions included in a security survey for the person being evaluated are registered, wherein the attributes include a first attribute indicating a common question for which a common answer that can be used for multiple targets of the security survey for the person being evaluated is set, and a second attribute indicating an individual question requiring an individual answer for each target of the security survey for the person being evaluated; In the answer receiving step, input of answers to the questions regarding the first attribute and the questions regarding the second attribute is received from the evaluation subject in each answer input field, and the common answer registered in advance for the question is initially displayed in the answer input field for the question regarding the first attribute; In the information presentation step, the information processing system presents to the person being evaluated or the evaluation user information indicating the percentage of the questions included in the security survey to which the common answer is applied as an answer.

13. An information processing system, at least one processor; The processor is configured to execute the following steps by reading the program: In the registration step, attributes of questions included in a security survey for the person being evaluated are registered, wherein the attributes include a first attribute indicating a common question for which a common answer that can be used for multiple targets of the security survey for the person being evaluated is set, and a second attribute indicating an individual question requiring an individual answer for each target of the security survey for the person being evaluated; In the answer receiving step, input of answers to the questions regarding the first attribute and the questions regarding the second attribute is received from the evaluation subject in each answer input field, and the common answer registered in advance for the question is initially displayed in the answer input field for the question regarding the first attribute; In the evaluation step, an evaluation score is determined based on the evaluation subject's responses to the plurality of questions included in the security survey; In the information presentation step, the information processing system presents to the person being evaluated or the evaluation user information indicating the ratio of the score based on the common answer to the score based on answers other than the common answer in the evaluation score.

14. 5. The information processing system according to claim 4, The processor is further configured to perform the steps of: In the evaluation step, an evaluation score is determined based on the evaluation subject's responses to the plurality of questions included in the security survey; In the information presentation step, a first statistical score for each answer template is presented to the evaluation subject or evaluation user, wherein the first statistical score indicates a statistical value of the evaluation score for each of the multiple security surveys in which the answer template was used.

15. 15. The information processing system according to claim 14, In the information presentation step, a second statistical score for each of the evaluation subjects is presented to the evaluation subject or the evaluation user, wherein the second statistical score indicates a statistical value of the first statistical score for each of the multiple answer templates registered by the evaluation subject.

16. An information processing method, comprising: An information processing method comprising the steps executed by the information processing system according to any one of claims 1 to 15.

17. A program, A program for causing a computer to execute each step of the information processing system according to any one of claims 1 to 15.

Images