Information processing systems, information processing methods, and programs

Abstract

This invention provides an information processing system, information processing method, and program that enable survey participants to efficiently answer survey questions. [Solution] The information processing system 1 executes each step, and in the registration step, it registers the attributes of the questions included in the security survey for the person to be evaluated. The attributes include a common attribute for which a first common answer is set that can be used for multiple targets of the security survey regardless of the type of business targeted by the security survey, and a business attribute indicating a second common question for which a second common answer can be set that can be used for multiple targets of the security survey for each type of business. In the response reception step, it accepts input of answers to the questions of the common attribute and the questions of the business attribute. In the answer input field for the questions of the common attribute, the first common answer that has been registered in advance for that question is initially displayed, and in the answer input field for the questions of the business attribute, the second common answer that has been registered in advance for that question is initially displayed according to the type of business.

Description

Technical Field

[0003]

[0001] The present invention relates to an information processing system, an information processing method, and a program.

Background Art

[0002] Patent Document 1 describes a system audit support system including a checkpoint sheet database that stores checkpoint array information data for specifying each checkpoint when auditing an audit target in an order according to rules, and stores evidence array information data for specifying evidence necessary for evaluating each checkpoint in correspondence with the checkpoint array information data.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] There is a need for a technology that allows a person under investigation to answer an investigation efficiently.

[0005] In view of the above circumstances, the present invention aims to provide an information processing system or the like that allows a person under investigation to answer an investigation efficiently.

Means for Solving the Problems

[0006] According to one aspect of the present invention, an information processing system is provided, comprising at least one processor, the processor configured to perform the following steps by reading a program, wherein in the registration step, attributes of questions included in a security survey for a person under evaluation are registered, the attributes include a common attribute indicating a first common question for which a first common answer is set that can be used by the person under evaluation for multiple targets of the security survey regardless of the type of business subject to the security survey, and a business attribute indicating a second common question for which a second common answer is set that can be used by the person under evaluation for multiple targets of the security survey for each type of business, and in the response reception step, the system receives input from the person under evaluation for answers to the common attribute questions and business attribute questions from the answer input fields for each question, the first common answer pre-registered for the question is initially displayed in the answer input field for the common attribute questions, and the second common answer pre-registered for the question is initially displayed in the answer input field for the business attribute questions, depending on the type of business.

[0007] This configuration allows survey participants to respond to the survey efficiently. [Brief explanation of the drawing]

[0008] [Figure 1] This is a diagram showing the configuration of Information Processing System 1. [Figure 2] This block diagram shows the hardware configuration of the server device 10 and the target terminal 20. [Figure 3] This block diagram shows the hardware configuration of the evaluator terminal 30 and the user terminal 40. [Figure 4] This is a block diagram showing the functions realized by the server device 10 (control unit 11), the subject terminal 20 (control unit 21), the evaluator terminal 30 (control unit 31), and the user terminal 40 (control unit 41). [Figure 5] This figure shows an example of the request display screen RD that is displayed on the target terminal 20. [Figure 6] This figure shows an example of the detailed display screen SD displayed on the target terminal 20. [Figure 7] This figure shows an example of a response input screen FD displayed on the target user's terminal 20. [Figure 8] This figure shows a continuation of the answer input screen FD shown in Figure 7. [Figure 9] This figure shows an example of the template update screen TD displayed on the target terminal 20. [Figure 10] This figure shows another example of the question area displayed on the answer input screen FD. [Figure 11] This figure shows an example of how the first statistical score and the second statistical score are displayed on the target terminal 20 or user terminal 40. [Figure 12] This is an activity diagram showing an example of the flow of information processing (security investigation processing) performed by Information Processing System 1. [Modes for carrying out the invention]

[0009] Embodiments of the present invention will be described below with reference to the drawings. The various features shown in the embodiments below can be combined with each other.

[0010] Incidentally, the program for implementing the software appearing in one embodiment may be provided as a non-transitory computer-readable medium, or it may be provided as a downloadable medium from an external server, or it may be provided so that the program is launched on an external computer and its functions are realized on a client terminal (so-called cloud computing).

[0011] Furthermore, in various information processing according to one embodiment, an input and an output corresponding to the input can be realized. Here, as long as an output is obtained as a result of the input, the form of the information referenced in such information processing (hereinafter referred to as "reference information") is not limited. The reference information may be, for example, rule-based information such as a database, a lookup table, or a predetermined function (including a decision formula such as a regression equation constructed by a statistical method), or a trained model that has been pre-trained to learn the correlation between input and output, or a generative AI such as a large-scale language model that can output a desired result by inputting a prompt (these models include parameters that construct the correlation relationship between input and output) or a visual language model.

[0012] Furthermore, in one embodiment, "part" may include, for example, hardware resources implemented by a circuit in a broad sense, and the information processing of software that can be specifically realized by these hardware resources. Also, in one embodiment, various types of information are handled, and this information can be represented, for example, by the physical values ​​of signal values ​​representing voltage and current, the high or low values ​​of signal values ​​as a set of binary bits composed of 0s or 1s, or by quantum superposition (so-called qubits), and communication and calculations can be performed on a circuit in a broad sense.

[0013] Furthermore, a circuit in a broad sense is a circuit realized by appropriately combining at least a circuit, circuitry, a processor, a memory, etc. The processor may be a general-purpose processor or a dedicated circuit. That is, it includes an application specific integrated circuit (ASIC), a programmable logic device (e.g., a simple programmable logic device (SPLD), a complex programmable logic device (CPLD), and a field programmable gate array (FPGA)), etc.

[0014] 1. Hardware Configuration In this section, the hardware configuration will be described.

[0015] <Information Processing System 1> FIG. 1 is a configuration diagram showing an information processing system 1. The information processing system 1 includes a communication line 2, a server device 10, a plurality of subject terminals 20, at least one evaluator terminal 30, and a plurality of user terminals 40. The server device 10, the subject terminals 20, the evaluator terminal 30, and the user terminals 40 are configured to be able to communicate with each other through the communication line 2. The connections of the server device 10, the subject terminals 20, the evaluator terminal 30, and the user terminals 40 may be wired or wireless.

[0016] The information processing system 1 constitutes at least a part of a security evaluation system used by, for example, a plurality of evaluation targets (the first evaluation target U1 and the second evaluation target U2), at least one evaluator U3, and a plurality of evaluation users (the first evaluation user U4 and the second evaluation user U5). The information processing system 1 mainly performs evaluations of security related to commercial materials and the like provided by the evaluation targets, provision of security evaluations, etc. For example, the information processing system 1 mainly provides security evaluation services by the evaluator. In one embodiment, the information processing system 1 consists of one or more devices or components. Hereinafter, these components will be described.

[0017] <Server device 10> FIG. 2 is a block diagram showing the hardware configurations of the server device 10 and the target terminal 20. As shown in FIG. 2A, the server device 10 includes a control unit 11 (processor), a storage unit 12, a communication unit 13, and a communication bus 14. The control unit 11, the storage unit 12, and the communication unit 13 are electrically connected via the communication bus 14 inside the server device 10.

[0018] <Control unit 11> The control unit 11 performs processing and control of the overall operations related to the server device 10. The control unit 11 is, for example, a Central Processing Unit (CPU). The control unit 11 realizes various functions related to the server device 10 by reading a predetermined program stored in the storage unit 12. That is, the information processing by the software stored in the storage unit 12 is specifically realized by the control unit 11, which is an example of hardware, and can be executed as each functional unit included in the control unit 11. These will be described in more detail in the next section. Note that the control unit 11 is not limited to being single, and the server device 10 may have a plurality of control units 11 for each function. Also, the server device 10 may be configured by combinations of these.

[0019] <Storage unit 12> The storage unit 12 stores various types of information as defined above. This can be done, for example, as a storage device such as a solid-state drive (SSD) that stores various programs related to the server device 10 executed by the control unit 11, or as memory such as random access memory (RAM) that stores temporarily necessary information (arguments, arrays, etc.) related to program calculations. The storage unit 12 stores various programs, variables, etc. related to the server device 10 executed by the control unit 11.

[0020] <Communications Department 13> The communication unit 13 preferably uses wired communication methods such as USB, IEEE1394, Thunderbolt®, and wired LAN network communication, but may also include wireless LAN network communication, mobile communication such as LTE / 5G, and Bluetooth® communication as needed. In other words, the communication unit 13 may be implemented as a collection of these multiple communication methods. Furthermore, the server device 10 may communicate various information with the outside world via the communication unit 13 and the network.

[0021] The server device 10 may be on-premises or in a cloud environment. A cloud-based server device 10 may provide the above-mentioned functions and processing in the form of, for example, SaaS (Software as a Service) or cloud computing.

[0022] <Target user device 20> The target terminal 20 is an information processing terminal used by the person being evaluated for security, and it has access to the server device 10.

[0023] "Those being evaluated" include business partners or their representatives who have any form of transactional relationship with the evaluation user (especially the evaluation requester, as described below), such as the provision of goods (products, services, etc.) (e.g., provision of cloud services) or the outsourcing of work. Those being evaluated are, for example, service providers, suppliers, outsourcing organizations, and other businesses that have a relationship with the evaluation user (evaluation requester).

[0024] Here, "trading partner organization" includes primary trading partner organizations that receive transactions directly from evaluation users (evaluation requestors), secondary trading partner organizations that receive secondary transactions from primary trading partner organizations, etc. In other words, a trading partner organization refers to a primary trading partner organization or an Nth-tier trading partner organization (N>1) from the perspective of the trading source organization (evaluation user), and the primary trading partner organization and Nth-tier trading partner organizations for a single transaction object constitute the supply chain for that transaction object. The transaction object includes the goods traded, outsourced services, etc. Furthermore, a trading partner organization may also include individual business owners who receive transactions.

[0025] A trading partner organization is an organization located downstream from the trading source organization (evaluation user) in the supply chain. From the perspective of the trading source organization, a trading partner organization may include trading partners, contractors (including subcontractors, sub-subcontractors, etc.), vendors, suppliers, sellers, subsidiaries, etc. A trading partner organization may include entities other than end users in the supply chain.

[0026] Furthermore, "organizations" include for-profit corporations (e.g., companies), non-profit corporations (e.g., cooperatives, foundations, etc.), and public corporations (e.g., local governments, etc.).

[0027] As shown in Figure 2B, the target terminal 20 comprises a control unit 21, a storage unit 22, a communication unit 23, an input unit 24, an output unit 25, and a communication bus 26. The control unit 21, storage unit 22, communication unit 23, input unit 24, and output unit 25 are electrically connected within the target terminal 20 via the communication bus 26. The descriptions of the control unit 21, storage unit 22, and communication unit 23 are the same as the descriptions of each part in the server device 10 and are therefore omitted.

[0028] <Input section 24> The input unit 24 receives operation inputs made by the user. The operation inputs are transmitted as command signals to the control unit 21 via the communication bus 26. The control unit 21 can perform predetermined controls or calculations based on the transmitted command signals as needed. The input unit 24 may be included in the housing of the user terminal 20 or it may be an external component. For example, the input unit 24 may be implemented as a touch panel integrated with the output unit 25. When the input unit 24 is implemented as a touch panel, the user can input tap operations, swipe operations, etc. to the input unit 24. Instead of a touch panel, the input unit 24 can be a switch button, mouse, trackpad, QWERTY keyboard, etc.

[0029] <Output section 25> The output unit 25 displays a graphical user interface (GUI) screen that can be operated by the user. The output unit 25 may be included in the casing of the user terminal 20 or it may be an external component. Specifically, the output unit 25 can be implemented as a display device such as a CRT display, liquid crystal display, organic EL display, or plasma display. It is preferable that these display devices be used in accordance with the type of user terminal 20.

[0030] <Evaluator terminal 30> The evaluator terminal 30 is an information processing terminal used by the evaluator to evaluate the responses of the person being evaluated. The "evaluator" is an organization such as a company that conducts security evaluations (for example, a security evaluation company that conducts security evaluations of services such as cloud services, software, etc.) or a person in charge thereof. The evaluator, for example, conducts the security evaluation of the person being evaluated via the information processing system 1 from the evaluator terminal 30.

[0031] Figure 3 is a block diagram showing the hardware configuration of the evaluator terminal 30 and the user terminal 40. As shown in Figure 3A, the evaluator terminal 30 comprises a control unit 31, a storage unit 32, a communication unit 33, an input unit 34, an output unit 35, and a communication bus 36. The control unit 31, storage unit 32, communication unit 33, input unit 34, and output unit 35 are electrically connected within the evaluator terminal 30 via the communication bus 36. The descriptions of the control unit 31, storage unit 32, communication unit 33, input unit 34, and output unit 35 are the same as the descriptions of each part in the subject terminal 20 and are therefore omitted.

[0032] <User terminal 40> User terminal 40 is an information processing terminal used by evaluation users who utilize services provided by information processing system 1 (for example, services for aggregating response data to questions and questionnaires, security investigation services related to organizations and services, security evaluation or analysis services, security report creation or provision services, etc.). "Evaluation users" include evaluation requesters, viewers, etc.

[0033] A "requester for evaluation" is an evaluation user who requests an evaluation of the security of the person being evaluated. This may be, for example, an individual, an organization, or a representative of such an organization that has a business relationship with the person being evaluated. Requesters for evaluation include, for example, evaluation users who are registered with the security evaluation service provided by Information Processing System 1.

[0034] The requester for evaluation includes trading organizations, which are organizations or individuals that request transactions from trading partners (the entities being evaluated). Trading organizations receive, use, etc., the goods, such as services and operations, provided by trading partners. For example, if the goods being traded are products, the requester for evaluation (trading organization) is the purchaser of the goods (finished products or parts) manufactured by the trading partner. Also, for example, if the goods being traded are services, the requester for evaluation (trading organization) is a user of the services provided by the trading partner (for example, a user of cloud services provided by a cloud service provider). Furthermore, for example, if the goods being traded are operations (work), the requester for evaluation (trading organization) is the client or contractor for the operations.

[0035] Applicants for evaluation include not only individuals or organizations that conduct transactions subject to evaluation (such as service use or outsourcing) with the person being evaluated, but also individuals or organizations that request evaluations of specific services. For example, applicants for evaluation may include companies that want to have the security of cloud services they use or are considering using evaluated, or companies that want to verify such evaluations.

[0036] A “viewer” is an individual or organization that uses the results of a security assessment of a subject being assessed, at the request of an assessment requester (either the viewer themselves or an assessment requester other than the viewer). Viewers are, for example, providers of services or other goods that are planned to be used, business partners with whom transactions are planned, or individuals or organizations that seek assessments of subject beings as potential partners. Viewers may include assessment users (who may also be called “service users”) who are registered with the services provided by Information Processing System 1 (for example, the security assessment service by assessors) and other assessment users who are not registered with the assessment service (for example, assessment users who are not registered with the assessment service but have obtained links to web pages displaying assessments provided by the assessment service, files containing such assessments, etc., that are accessible from outside the assessment service and may be called “other service users”).

[0037] As shown in Figure 3B, the user terminal 40 comprises a control unit 41, a storage unit 42, a communication unit 43, an input unit 44, an output unit 45, and a communication bus 46. The control unit 41, storage unit 42, communication unit 43, input unit 44, and output unit 45 are electrically connected within the user terminal 40 via the communication bus 46. The descriptions of the control unit 41, storage unit 42, communication unit 43, input unit 44, and output unit 45 are the same as the descriptions of each part in the target terminal 20 and are therefore omitted.

[0038] 2. Functional Configuration This section describes the functional configuration of this embodiment. Information processing by software stored in the memory unit 12 is specifically realized by the control unit 11, which is an example of hardware, and can be executed as each functional unit included in the control unit 11 (at least one processor provided by the information processing system 1).

[0039] Figure 4 is a block diagram showing the functions realized by the server device 10 (control unit 11), the subject terminal 20 (control unit 21), the evaluator terminal 30 (control unit 31), and the user terminal 40 (control unit 41).

[0040] As shown in Figure 4A, the server device 10 (control unit 11) comprises a basic display control unit 111, a registration unit 112, a survey request reception unit 113, a response reception unit 114, an evaluation unit 115, a response provision unit 116, an information presentation unit 117, and an artificial intelligence unit 120.

[0041] As shown in Figure 4B, the subject terminal 20 (control unit 21) comprises a display unit 211 and an operation acquisition unit 212. As shown in Figure 4C, the evaluator terminal 30 (control unit 31) comprises a display unit 311 and an operation acquisition unit 312. As shown in Figure 4D, the user terminal 40 (control unit 41) comprises a display unit 411 and an operation acquisition unit 412.

[0042] <Basic display control unit 111> The basic display control unit 111 is configured to display various information on the subject terminal 20, the evaluator terminal 30, and the user terminal 40. For example, the basic display control unit 111 displays the answer input form in which the subject enters their answers, the answers registered by the subject, and the evaluator's evaluation results of the answers on the display unit 211 of the subject terminal 20, the display unit 311 of the evaluator terminal 30, or the display unit 411 of the user terminal 40.

[0043] <Registration Section 112> The registration unit 112 is configured to register the attributes of the questions included in the security survey for the person being evaluated. The “security survey” is a survey concerning the security or secondary transactions of the person being evaluated, and may also be called a risk survey. A security survey typically includes several questions.

[0044] The "questions" are items that the evaluated party is required to answer, and may include, for example, matters concerning the evaluated party's own security, the security of the products / services provided by the evaluated party, etc. The "questions" may also include matters concerning the security of other organizations included in the evaluated party's supply chain. "Other organizations" include, for example, organizations to which the evaluated party outsources its operations (including subcontractors, sub-subcontractors, sub-subcontractors, etc.), and other organizations that are the evaluated party's business partners. In other words, "other organizations" may include matters concerning the security of N-tier business partners (N>1) from the perspective of the trading organization, including not only second-tier business partners that receive second-tier transactions directly from first-tier business partners, but also third-tier business partners that receive third-tier transactions from second-tier business partners, etc. The "questions" may also include so-called security checklists.

[0045] The questions may include, for example, those that confirm the status or evaluation of security certifications, service levels, scope of responsibility, security measures within the evaluated entity, handling of data related to the evaluation requester, handling of data managed by the evaluated entity, and service development, maintenance, or operational policies (such as account management) (questions that require answers from the evaluated entity).

[0046] The attributes of each question are set for each question. These attributes may include a first attribute that indicates a common question for which a common answer can be used for multiple subjects of the security survey of the person being evaluated is set, and a second attribute (which may also be called an "individual attribute") that indicates an individual question for which a separate answer is required for each subject of the security survey of the person being evaluated (hereinafter referred to as the "survey subject"). Each question may have either the first attribute or the second attribute set for it, for example. The attributes, along with the content of the question, are registered, for example, in the database of the storage unit 12.

[0047] The "subject of investigation" refers to the contracts, transactions, goods (products, operations, services, etc.), businesses, departments, etc. that are subject to the answers that the person being evaluated will enter in response to the questions. The subject of investigation may also be set as a category that indicates the prerequisites for the person being evaluated in answering the questions (for example, the goods, businesses, departments, contracts with the trading organizations that are subject to the answers). For example, the person being evaluated will enter their answers to the questions regarding the goods, etc., that are specified as categories by the evaluation requestor.

[0048] The categories may include the type of goods handled by the person being evaluated, the customers to whom the goods are provided, the types of plans included in the goods, the business that provides the goods, or a combination of these. Furthermore, the categories may also be contract names representing these combinations. Additionally, the categories may be business types. This allows for the input and registration of different answers depending on the person being evaluated, even if their answers to the questions differ depending on the goods being investigated.

[0049] The service provider being evaluated will input responses according to service attributes such as the type of service being investigated (e.g., AI (Artificial Intelligence) service, Recruitment Process Outsourcing (RPO) service, etc.), the recipient of the service (e.g., the name of the organization requesting the evaluation, the attributes of the evaluation requester, etc.), the type of plan (option) included in the service, the name of the business providing the service, the name of the department, etc. In other words, the service provider offering multiple services or plans will input responses for each of these service attributes or contract (category), and the response receiving unit 114, described later, may register the response data for each service attribute or contract. The input responses are stored as response data, associated with the service attributes or contract.

[0050] The "services" provided by the evaluated party include services delivered via the internet, such as SaaS, IaaS (Infrastructure as a Service), PaaS (Platform as a Service), and cloud services. In this case, the evaluated party includes cloud service providers, etc. Furthermore, the "services" provided by the evaluated party may also be services provided to business partners or customers (for example, outsourced work).

[0051] Questions assigned a first attribute are those that will result in common answers or are expected to result in common answers among the evaluators, regardless of the subject of the survey. For example, if the evaluator is a company, this would include questions about certifications obtained by the company as a whole, and policies established by the company as a whole. Questions assigned a second attribute are those whose answers will vary or are expected to vary depending on the subject of the survey (for example, the detailed content of the work). For example, this would include questions about the work environment in which the evaluator performs their work, and whether or not they have subcontractors. For example, if the subject of the survey is non-routine work, there tends to be more questions assigned a second attribute than if the subject of the survey is routine work.

[0052] Questions for the second attribute (individual attribute) may be questions to which the common answers (the first common answers and the second common answers described later) cannot be applied. For example, questions for the second attribute (individual attribute) are individual questions (handover items, remarks, etc.) to which the evaluation requester (client) requests individual answers for each survey subject. The registration unit 112 may automatically register the second attribute for questions to which the first attribute has not been registered. Furthermore, the registration unit 112 is not required to assign the second attribute to questions; for example, it may determine that questions to which the first attribute has not been registered are individual questions.

[0053] The attributes of the questions are set for each person being evaluated. Alternatively, attributes may be set for question groups that include multiple questions. A question group might be a collection of questions related to common topics across multiple survey subjects (e.g., certification, policy, outsourcing, etc.).

[0054] The registration unit 112 may register multiple response templates for each person being evaluated, in which at least some of the attributes of each of the multiple questions and the common answers for the questions of the first attribute differ from one another. This allows the requester to easily switch the attributes of each question by selecting a response template that suits the person being investigated. As a result, the efficiency of responding to security surveys is improved.

[0055] The "answer template" includes multiple questions included in the security investigation, the attributes of each question, and common answers to the questions of the first attribute. The answer template is used in common across multiple investigation subjects that share the same first attribute question (common question). For example, a common answer template is used in security investigations targeting the same service, the same business operations, and the same business.

[0056] The registration unit 112 may accept the creation of response templates. Specifically, the registration unit 112 may accept input from the target user terminal 20 of the attributes of each question and the common answers to the questions of the first attribute, and register a response template containing this information. In addition, if questions are added or revised in the security survey, the registration unit 112 may request the person being evaluated to register the attributes and common answers to those questions.

[0057] Thus, the registration unit 112 may accept attribute specifications for the questions from the person being evaluated (the person's terminal 20). This allows the person being evaluated to arbitrarily set common questions according to the subject of the investigation, etc., thereby streamlining the response to the security investigation. For example, when creating a new response template, the registration unit 112 accepts attribute specifications for each question from the person being evaluated.

[0058] Furthermore, "specifying attributes" includes not only setting new attributes for questions that do not already have attributes registered, but also changing attributes for questions that already have attributes registered. In addition to specifying attributes, the registration unit 112 may also accept the specification of an answer template (selection of an answer template, input of an answer template name, etc.) and update or create a new answer template based on the specified attributes. For example, the registration unit 112 may accept the specification of attributes on the answer template editing screen.

[0059] Furthermore, the registration unit 112 may accept the specification of attributes for the questions from the evaluator (evaluator terminal 30), the evaluation user (evaluation requester / user terminal 40), or the provider of services provided by the information processing system 1. In other words, the attributes of the questions may be pre-set by evaluators, evaluation users (evaluation requesters), service providers provided by the information processing system 1, etc., other than the person being evaluated. Moreover, the pre-set attributes may be changeable by the person being evaluated, or they may be unchangeable (fixed values). Furthermore, the pre-set attributes may be changed by the evaluator, evaluation user (evaluation requester), or the provider of services provided by the information processing system 1.

[0060] The attributes of the questions may include a common attribute indicating a first common question for which a first common answer can be set that can be used for multiple targets of the security survey regardless of the type of business being surveyed by the person being evaluated, and a business attribute indicating a second common question for which a second common answer can be set that can be used for multiple targets of the security survey for each type of business being evaluated. This makes it possible to automatically input both a general answer that is not dependent on the type of business and an answer specific to the type of business when answering the questions.

[0061] Common attributes and business attributes may also be attributes included in the first attribute. In other words, common attributes and business attributes may be set as questions as the first attribute. In this context, the first common answer and the second common answer are common answers that can be used for multiple targets of security surveys of the person being evaluated, subdivided (categorized) based on whether or not they depend on the type of business, and the first common question and the second common question are common questions for which common answers are set, subdivided based on whether or not they depend on the type of business.

[0062] Furthermore, the types of attributes registered for the same question (questions included in the common format of security surveys provided by Information Processing System 1) (first attribute (common attribute and industry attribute) and second attribute (individual attribute)) may differ depending on the person being evaluated.

[0063] The "type of work" may include at least one of the following: the content of the work, the location where the work is performed, and the environment in which the work is performed. This makes it easier for those being evaluated to answer the security survey using the second common response registered for the questions regarding work attributes.

[0064] "Content of work" refers to the details of the tasks performed by the person being evaluated in response to a request from the client organization. "Location of work" refers to the place where the work is performed (such as a store, factory, warehouse, or other facility). "Work environment" refers to the type or presence of utilities such as equipment, tools, and materials used in the work, and the provider of those utilities (whether it is the client organization or the person requesting the evaluation).

[0065] A work type may be a combination of two or more elements: the content of the work, the location where the work is performed, and the environment in which the work is performed. For example, a work type may be specified in the form of "Work B performed at location A."

[0066] For example, if the survey subject, to which the evaluator enters their answers to the questions, is a target contract, target transaction, target business, or target department, then the attributes of the questions will be a combination of common attributes and business attributes.

[0067] The registration unit 112 may register a second common answer for each type of business for the questions in which business attributes have been registered. In other words, the registration unit 112 may register multiple second common answers for a single question in a business attribute. Each of the multiple second common answers is registered in association with its corresponding type of business.

[0068] The registration unit 112 may register one common answer template and multiple task-based answer templates for each person being evaluated. The common answer template includes a first common answer to each of the multiple common attribute questions included in the security survey. The common answer template is an answer template prepared in common for all types of tasks undertaken by the person being evaluated (i.e., the entire organization of the person being evaluated). The registration unit 112 may also register a combination of the common answer template and task-based answer templates as a single answer template.

[0069] The business response template includes a second common answer for each of the multiple business attribute questions included in the security survey. The business response template is a response template prepared for each type of work that the person being evaluated is contracted to do. In other words, the registration unit 112 may register multiple business response templates for each type of work. This allows the person being evaluated to select a type of work when responding to the security survey, and the second common answer corresponding to that type of work can be automatically entered.

[0070] The registration unit 112 may register both common attributes and business attributes as attributes for a single question item. In other words, there may be questions for which both common attributes and business attributes are registered. For a question item with two attributes registered (hereinafter referred to as a "dual-attribute question item"), a first common answer and a second common answer are set. For example, for a dual-attribute question item for which a first common answer is registered in the common answer template, a second common answer may be registered in the business answer template.

[0071] The registration unit 112 may receive input of answers to questions from the person being evaluated, register the answers as the second common answer to the questions, and also register business attributes as attributes of the questions. The registration unit 112 may further register common attributes as attributes for questions specified by the person being evaluated from among the questions for which business attributes have been registered, and register the aforementioned second common answer to those questions as the aforementioned first common answer. This allows the initial answer to be registered as the answer to the business attribute question (second common answer), and if that answer can be applied to other types of work, it can then be registered as the answer to the common attribute question (first common answer). As a result, it becomes easier for the person being evaluated to set common attributes and the first common answer.

[0072] For example, the registration unit 112 may accept the setting (input) of the type of work in the security survey from the person being evaluated, and then accept the input of answers from the person being evaluated for questions for which the attributes are not registered (neither the first common answer nor the second common answer has been set). The registration unit 112 registers the work attribute as the attribute of the question, and further registers the input answers as the second common answer corresponding to the set type of work.

[0073] When the registration unit 112 registers common attributes in a business attribute question based on the designation of the person to be evaluated, it may also deregister the business attribute of the question and leave only the common attribute registered as an attribute. Alternatively, when the registration unit 112 registers common attributes in a business attribute question based on the designation of the person to be evaluated, it may also register the common attribute in addition while maintaining the business attribute of the question. In other words, the registration unit 112 may make the designated question a dual-attribute question.

[0074] If multiple second common answers (second common answers for each type of work) are set for a question item of a single business attribute, the registration unit 112 may accept the selection of a second common answer to be designated as the first common answer from the person being evaluated. In addition, the registration unit 112 may set, for example, a combined answer that integrates multiple second common answers, or a representative answer extracted from multiple second common answers, as the first common answer.

[0075] The "integrated answer" may be the union of multiple second common answers. For example, if the second common answer is selected from a set of options, the registration unit 112 may consider the combination of options selected in at least one of the multiple second common answers as the integrated answer.

[0076] Furthermore, the "representative response" may be a predetermined high-priority response from among several common responses. The "priority" may be set by the person being evaluated (for example, the importance rank assigned by the person being evaluated for each type of work), or it may be set according to the content of the response (for example, the level of security measures).

[0077] Furthermore, the registration unit 112 may register the business attributes for the business type selected by the person being evaluated for the questions specified by the person being evaluated, and may also register the first common answer to the question as the second common answer. In this case, the registration unit 112 may accept the selection of the business type to which the second common answer is linked from the person being evaluated.

[0078] <Investigation Request Reception Department 113> The investigation request reception unit 113 is configured to receive requests for security investigations of the person being evaluated from the evaluation requester (user terminal 40).

[0079] The investigation request reception unit 113 receives input from, for example, the user terminal 40, regarding the person to be evaluated and the subject of the investigation (product, etc.) requesting a security investigation. The investigation request reception unit 113 notifies the subject terminal 20 of the person to be evaluated who has provided input of the request for a security investigation regarding the subject of the investigation, and prompts the response reception unit 114 to receive the response.

[0080] <Response Reception Department 114> The response reception unit 114 is configured to create or update response data by receiving input from the person being evaluated to answer questions in the security survey. The person being evaluated answers questions in response to a request received by the survey request reception unit 113 from an evaluation user with whom they are conducting business (with whom they have a contract related to the transaction).

[0081] Specifically, the response reception unit 114 receives input from the person being evaluated (person terminal 20) for questions regarding the first attribute and questions regarding the second attribute through the respective input fields for each attribute. Furthermore, if common attributes and business attributes are provided as attributes for the questions, the response reception unit 114 also receives input from the person being evaluated (person terminal 20) for questions regarding the common attributes and questions regarding business attributes through the respective input fields for each attribute.

[0082] If common attributes and business attributes are provided as attributes for the questions, the response receiving unit 114 may also accept input from the person being evaluated for individual attribute questions through the input field for the answer to that question. This allows the person requesting the evaluation to prepare individual questions that cannot be answered by either the first common answer or the second common answer, and the person being evaluated to answer them.

[0083] The answer input field is displayed on the participant's terminal 20 for each question. The answer input field may also be included in a predetermined answer input form that accepts answers from the person being evaluated to questions about security. The answer receiving unit 114 registers the answers that have been entered into the answer input field (answer input form) and then confirmed (sent to the answer receiving unit 114) as answer data.

[0084] "Response data" includes the evaluator's answers to each of several questions regarding the security of the service, and is the information that the evaluator checks and evaluates. Response data may be evaluated only once or multiple times. In other words, the evaluation of response data may include an initial evaluation (so-called review), an intermediate evaluation, a final evaluation, etc. The initial and intermediate evaluations are evaluations in which further evaluations are conducted after the initial evaluation. Response data may be modified by the evaluator based on the initial or intermediate evaluation. Multiple evaluations may be performed by the same evaluator or by different evaluators (so-called reviewers, etc.). The final evaluation creates an evaluation to be used in a report or document provided to the evaluation user. Furthermore, response data may be evaluated again by the evaluator when it is modified or updated by the evaluator. The evaluator's evaluation results of the response data are used as part of or as reference information in the report or document.

[0085] The responses to each question included in the response data are those entered by the evaluators into the response input form for each question presented in the response input form, and registered in the response database. Responses to a single question may be hierarchical.

[0086] Furthermore, the response receiving unit 114 may accept responses through an interface other than the response input form (for example, uploading a data file containing responses by the person being evaluated) and register these responses as response data in the response database.

[0087] The security investigations for which the response reception unit 114 accepts responses may include investigations related to secondary transactions (secondary transaction investigations). A secondary transaction investigation is an investigation into the transactions of the trading partner organization with other organizations that are the subject of the trading. For example, a secondary transaction investigation is an investigation into the existence of N-th tier trading partners (N>1) from the perspective of the trading partner organization, including secondary trading partners that receive secondary transactions directly from the primary trading partner organization, as well as tertiary trading partners that receive tertiary transactions from the secondary trading partners, and may be rephrased as an "N-th tier transaction investigation." A secondary transaction investigation may also be called a "subcontractor investigation." A secondary transaction investigation may also be an investigation into the constituent organizations of the subsupply chain formed by the trading partner organization with respect to the trading target.

[0088] A secondary transaction investigation may be requested by the primary trading organization from the primary trading organization, or it may be requested directly by the primary trading organization from secondary trading organizations that the primary trading organization is aware of. Note that "a secondary transaction investigation of an Nth-tier trading organization" refers to an investigation of trading partners further downstream than the Nth-tier trading organization (i.e., N+1th-tier trading organizations and beyond).

[0089] The response form for the secondary transaction investigation may be sent to the person being evaluated upon request from the evaluation user. Similarly, the response form for the security investigation may be sent to the person being evaluated upon request from the evaluation user. Furthermore, these response forms may be sent to the secondary transaction organization upon request from the evaluation user. In addition, these response forms may be created and sent for each transaction target.

[0090] The person being evaluated may be sent a response form corresponding to the type of security survey selected by the evaluator. For example, a person being evaluated who selects "Standard Survey" as the type of security survey may be sent a response form with a large number of questions (e.g., around 100 items), while a person being evaluated who selects "Simplified Survey" may be sent a response form with fewer questions than the "Standard Survey" (e.g., around 10 items). Furthermore, a security survey may not be conducted for a person being evaluated who is prohibited from engaging in secondary transactions.

[0091] The response receiving unit 114 may receive responses from the evaluator's terminal 20 to security-related questions and the designation of the category to be assigned to the response, and add the response data, including the response and category, to the response database. The category is assigned to the entire response data, including multiple responses. The category may also be designated by specifying a response template.

[0092] Furthermore, the response receiving unit 114 may, for example, present the person being evaluated with questions (response input forms) for which categories have been predetermined, and register the response data in which the pre-determined categories have been assigned to the answers entered on the person's terminal 20.

[0093] The response data may include not only the response data and information indicating the category, but also the question data. Furthermore, if response data has already been registered for the same question and category, the response receiving unit 114 will replace the response included in the response data with the newly entered response.

[0094] In the answer input field for the question of the first attribute, a common answer that has been pre-registered for that question is initially displayed. In other words, when the answer receiving unit 114 displays the answer input field, it determines whether the corresponding question is of the first attribute, for example, based on the attributes of the question registered in the answer template, and if it is of the first attribute, it displays the answer input field with the common answer pre-filled on the user terminal 20.

[0095] Furthermore, the input field for common attribute questions initially displays a pre-registered first common answer for that question, and the input field for business attribute questions initially displays a pre-registered second common answer for that question, depending on the type of business being investigated. In other words, when displaying the input field for an answer, the response receiving unit 114 determines whether the corresponding question is a common attribute or a business attribute based on the attributes of the question registered in the common answer template or business answer template. If it is a common attribute, it displays the input field with the first common answer pre-filled on the user terminal 20; if it is a business attribute, it displays the input field with the second common answer pre-filled on the user terminal 20.

[0096] Furthermore, if multiple common second answers (common second answers for each type of work) are set for a single business attribute question, the common second answer corresponding to the type of work selected by the person being evaluated, or the type of work preset (automatically set) according to the survey target, will be initially displayed in the answer input field when the person starts responding to the security survey. For example, the response reception unit 114 displays the answer input field on the person's terminal 20 with the common second answer registered in the business response template corresponding to the selected type of work already entered.

[0097] For questions that have both common attributes and business attributes registered as attributes (dual-attribute questions), the answer input field may initially display a combined answer that integrates the first common answer and the second common answer. This eliminates the need for the person being evaluated to select either the first or second common answer, thereby improving the efficiency of the security survey response process.

[0098] The "integrated answer" may be the union of the first common answer and the second common answer. This allows the initial display to show an answer that combines the first common answer and the second common answer. For example, if a dual-attribute question requires selecting an answer from a set of options, the registration unit 112 may use the combination of options selected in at least one of the first common answer and the second common answer as the integrated answer.

[0099] For questions that have both common attributes and business attributes registered as attributes (dual-attribute questions), the answer input field may initially display the answer with the higher predetermined priority from the first common answer and the second common answer. This allows for the automatic input of the answer that is more appropriate to the question from the first common answer and the second common answer, or the answer that the person being evaluated has pre-selected.

[0100] As mentioned above, the "priority" of a response may be set by the evaluator (for example, the importance rank assigned by the evaluator for each type of work), or it may be set according to the content of the response (for example, the level of security measures). Furthermore, priority may include whether the response is the first common response (i.e., the first common response should be displayed first), the second common response (i.e., the second common response should be displayed first), etc. In addition, priority may be set for each question.

[0101] For questions that have both common attributes and business attributes registered as attributes (dual-attribute questions), the answer input field may initially display the answer selected by the person being evaluated from among the first common answer and the second common answer. This allows the person being evaluated to select the answer to be automatically entered for each question from among the first common answer and the second common answer.

[0102] Specifically, the response receiving unit 114 may, for example, display a first common answer and a second common answer corresponding to each dual attribute question on the user terminal 20, along with an answer input field, and accept a selection of either the first common answer or the second common answer from the user terminal 20. In this case, the response receiving unit 114 will initially display the selected answer in the answer input field.

[0103] If there are common questions among the questions of the first attribute (common attribute or business attribute) for which a common answer is not registered in the answer template (common answer template or business answer template), the answer receiving unit 114 will not initially display the common answer in the answer input field for that common question (i.e., display it as the initial value). In other words, the answer receiving unit 114 may initially display the pre-registered common answer only for common questions for which a common answer is registered in the answer template.

[0104] Furthermore, if no common answers are registered for a security survey requested by an evaluation requester (for example, if only the attribute settings for the questions are registered), the response entered by the person being evaluated for the first attribute (common attribute or business attribute) may be registered as a common answer for that question. This allows the person being evaluated to register their responses to the security survey as common answers without having to individually register common answers.

[0105] In this case, the response receiving unit 114 may register the entered response as a first common response or as a second common response. The response receiving unit 114 may also accept a selection from the user terminal 20 whether to register the entered response as a first common response or as a second common response. Furthermore, the response receiving unit 114 may register common attributes for questions for which a first common response has been registered, and business attributes for questions for which a second common response has been registered.

[0106] The response receiving unit 114 may, if no common response is registered for a security survey requested by the evaluation requester, register (create) a new response template in which the response entered by the person being evaluated for the question of the first attribute (common attribute or business attribute) will be used as the common response for that question.

[0107] The response reception unit 114 may receive from the person being evaluated the specification of a response template to be used to answer the questions (hereinafter, this includes a combination of a common response template and a business response template) from the person being evaluated, via the person's terminal 20. For example, the response reception unit 114 receives the selection of a registered response template from the person's terminal 20 and displays the response input format corresponding to the selected response template. In this response input format, the common answers registered in the response template are initially displayed in the response input fields for the questions set as the first attribute in the selected response template.

[0108] The response reception unit 114 may, for example, accept a designation from the person being evaluated to use as a business response template when they begin responding to a security survey. In this case, the second common response included in the business response template will be initially displayed for the questions for which business attributes have been registered. In other words, the response reception unit 114 may accept the designation of the type of business in the security survey by specifying a business response template. The response reception unit 114 may, for example, display a list of registered business response templates (list of business types) on the subject terminal 20 and accept the selection of a business response template from the subject terminal 20. The common response template is used for initial input of answers to questions with common attributes (first common response), regardless of the selected business response template (business type).

[0109] The response receiving unit 114 may display information indicating the designated response template on the respondent terminal 20 along with the response input field. This allows the evaluation requester to input or modify their response while checking the response template currently in use. As a result, the response process for security surveys is made more efficient. For example, the response receiving unit 114 may display the response template name within the response input format that includes the response input field.

[0110] The answers entered in the answer input field (selected options, text, and other information) are received by the answer reception unit 114, for example, when the user sends the answer (confirms the answer) on the user terminal 20, and are registered as answer data. The answer reception unit 114 may also accept editing (modification, deletion, etc.) of the initially displayed common answer in the answer input field before the answer is sent. Furthermore, the answer reception unit 114 does not have to accept the input operation to send an answer for questions where the common answer has not been edited. In this case, the answer reception unit 114 automatically registers the common answer registered in the database (answer template) as answer data.

[0111] The response receiving unit 114, in response to a security survey requested by the evaluation requester, receives a response from the evaluation subject (subject terminal 20) indicating whether or not to update the common answer to the new answer when the evaluation subject enters a new answer to a question of the first attribute (common attribute or business attribute) that differs from the common answer. Furthermore, if the subject terminal 20 selects to update the common answer, the common answer may be updated with the new answer. This allows the evaluation subject to register the new answer entered in the security survey as the new common answer without having to individually modify the common answer.

[0112] For example, the response receiving unit 114 may, when a new answer different from the initially displayed common answer is entered in the answer input field for a question item of the first attribute (common attribute or business attribute) on the target terminal 20, and the new answer is submitted (the new answer is accepted), display a message on the target terminal 20 asking whether or not to update the common answer, and an object that accepts whether or not to update it. Alternatively, the response receiving unit 114 may display an object that accepts the submission of an answer and an option (for example, a checkbox) on the target terminal 20 to accept whether or not to update the common answer, and update the common answer according to the selection status of the option when the answer is submitted.

[0113] The response receiving unit 114, when an evaluator enters a new answer to a question regarding the first attribute (common attribute or business attribute) that differs from the common answer in the designated response template, presents the evaluator (evaluator terminal 20) with at least two options: updating the common answer to the new answer, and adding a new response template. Furthermore, if updating the common answer is selected on the evaluator terminal 20, the common answer in the designated response template is replaced with the new answer. If adding a response template is selected, a new response template is registered in which the common answer in the designated response template has been replaced with the new answer. This allows evaluators to edit or create response templates using the new answers they entered in the security survey as new common answers, without having to individually edit or create response templates.

[0114] For example, if an answer template is specified, and a new answer different from the common answer initially displayed in the answer input field for the question item of the first attribute (common attribute or business attribute) is entered on the target terminal 20 and the new answer is submitted, the answer reception unit 114 may display the following options on the target terminal 20: a first option to update the common answer in the current answer template (the answer template from which the common answer was called); a second option to create a new answer template that uses the new answer as the common answer (registering the new answer as a separate answer template from the answer template from which the common answer was called); and a third option not to register the new answer (treating it as a one-time answer).

[0115] If the first option is selected on the user terminal 20, the response reception unit 114 replaces the common answer in the specified response template with the new answer and registers it. On the other hand, if the second option is selected on the user terminal 20, the response reception unit 114 replaces the common answer in the specified response template with the new answer and registers a new response template separately from the specified response template, and does not update the specified response template.

[0116] The response reception unit 114 may accept updates to common answers or additions of new answer templates on an individual question basis, or it may accept updates to common answers or additions of new answer templates on a security survey unit (response data unit) that includes multiple questions. For example, the response reception unit 114 may accept the selection of an answer template to update the common answer (register a new answer as a common answer) on a question basis. In addition, the response reception unit 114 may register a new answer template that uses the answers (including common answers) entered for each question of multiple first attributes (common attributes or business attributes) in a single security survey as the common answer for each first attribute question.

[0117] The response receiving unit 114 may accept changes to the attributes of a question item (such as a change to a second attribute, a change from a common attribute to a business attribute, or a change from a business attribute to a common attribute) from the user terminal 20 if the user enters a new answer to a question item of the first attribute that differs from the common answer in the designated response template. In this case, the response receiving unit 114 may present the user terminal 20 with the options of updating the attributes in the designated response template and adding a new response template. Furthermore, if the user terminal 20 selects to update the response template, the unit may update the attribute of the question item in the designated response template to the target attribute (for example, the second attribute), and if the user selects to add a response template, the unit may register a new response template in which the attribute of the question item in the designated response template has been replaced with the target attribute (for example, the second attribute).

[0118] Furthermore, the response receiving unit 114 may accept input of answers to questions of the second attribute, as well as changes to the attributes of those questions (changes to the first attribute (common attribute or business attribute)) from the user terminal 20. In this case, the response receiving unit 114 may present the user terminal 20 with options to update the attributes in the specified response template, register a new common answer, and add a new response template. If updating the response template is selected on the user terminal 20, the unit may update the attributes of the question in the specified response template to the first attribute and register the input answer as the common answer for that question. If adding a response template is selected, the unit may replace the attributes of the question in the specified response template with the first attribute and register a new response template in which the input answer will be the common answer for that question.

[0119] The updated common response (response template) may be registered in the database (the update may be reflected) after all questions in a security survey have been answered (after the response data has been registered), or after the evaluation of the response data has been completed, etc.

[0120] The response receiving unit 114 may, in the response input field, display information to the evaluator (evaluator terminal 20) indicating that the common answer has been changed if the evaluator enters a new answer different from the common answer to a question regarding the first attribute (common attribute or business attribute). This allows the evaluator to notice if they have unintentionally changed the common answer.

[0121] The response receiving unit 114 may, for example, display a message such as "Response has been edited" above the response input field when a new response is entered into the response input field. Alternatively, if the common response in the response input field has not been edited, it may display a message such as "Response matches the template."

[0122] The response receiving unit 114 may determine whether a new response has been entered by comparing the information entered in the response input field for the question item of the first attribute (common attribute or business attribute) with the information indicating the common answer. Furthermore, if the response receiving unit 114 determines that a new response has been entered, it accepts an input operation to the transmission receiving object that accepts the submission of the new response from the target terminal 20, and if it determines that no new response has been entered, it does not need to accept an input operation to the transmission receiving object from the target terminal 20. This makes it possible to switch whether or not to accept the submission of responses to the question item of the first attribute based on the determination of whether or not a new response has been entered. As a result, when the common answer is maintained, the effort required of the person being evaluated to input into the transmission receiving object is saved.

[0123] The response reception unit 114 may display the submission reception object on the participant terminal 20 only when a new response is entered. Alternatively, the response reception unit 114 may display the submission reception object on the participant terminal 20 together with the response input field, regardless of whether a new response has been entered. In this case, if the response reception unit 114 determines that no new response has been entered, it may display the submission reception object in an inactive state (not accepting input), and if it determines that a new response has been entered, it may display the submission reception object in an active state (accepting input). Furthermore, if the submission reception object is displayed in an active state, input into the submission reception object may be made mandatory, and responses to the questions may not be accepted unless the survey participant inputs into the submission reception object.

[0124] If the response input field includes an input field that accepts the selection of options, the response reception unit 114 determines the input of a new response by comparing the entered (selected) option with the options registered as common answers. Furthermore, if the response input field includes a free input field (an input field that accepts text input), the response reception unit 114 determines the input of a new response by comparing the text in the response input field with the text registered as a common answer on a character-by-character basis. The response reception unit 114 may also determine the input of a new response each time a new response is edited by the survey participant (when the information entered in the response input field changes).

[0125] Furthermore, if the response receiving unit 114 determines that a new response has been entered, and then the new response is returned to the common response by the survey participant, it may determine that no new response has been entered. In this case, the response receiving unit 114 may switch the transmission receiving object from the active state to the inactive state. Moreover, once the response receiving unit 114 has determined that a new response has been entered, it may continue to accept input to the transmission receiving object without changing its determination, even if the new response is returned to the common response by the survey participant.

[0126] The response reception unit 114 may change the display format of the submission reception object depending on whether a new response has been entered or not. For example, if no new response has been entered, the response reception unit 114 may display the submission reception object in a grayed-out format with the text "Answered," and if a new response has been entered, it may display the submission reception object in an active format with the text "Answer." In addition, depending on the submission reception object, if no new response has been entered, the option to accept whether or not to update the common response may be set to an inactive state where it is not possible to select, and if a new response has been entered, the option may be set to an active state where it is possible to select.

[0127] If the response receiving unit 114 determines that a new response has been entered, it may accept a request from the user terminal 20 to restore the new response entered in the response input field to the common response. This allows for easy and reliable re-entry of the common response if a new response is entered by mistake.

[0128] For example, the response reception unit 114 displays a restoration request object, which accepts requests for processing to restore to a common response, on the user terminal 20 along with a response input field, and accepts restoration input from the user terminal 20. The response reception unit 114 may also display the restoration request object on the user terminal 20 only when a new response has been entered.

[0129] The response receiving unit 114 may highlight the response input fields for questions in which a new response has been entered more than the response input fields for questions in which a new response has not been entered. For example, the response receiving unit 114 may highlight the response input fields by coloring the display area including the question and the response input field, thickening the border, changing the font, etc.

[0130] Figure 5 shows an example of the request display screen RD displayed on the target terminal 20. The request display screen RD displays a list of requests, such as security investigation requests, along with information such as the case name, requesting company (evaluation requester), investigation status, request date, desired deadline, and template used (response template specified when responding). Note that "(responding)" in the template used indicates that a response template has not yet been specified. When any of the requests displayed on the request display screen RD is selected, the detailed information (response progress) of that request is displayed.

[0131] Figure 6 shows an example of the detailed display screen SD displayed on the target terminal 20. The detailed display screen SD is displayed, for example, when any request is selected on the request display screen RD in Figure 5. The detailed display screen SD includes a progress display area PA and a content display area CA.

[0132] The progress display area PA shows the progress of responses to requests in chronological order. In the example in Figure 6, the status of unanswered requests is shown. In this example, the template selection object OB1, the first start instruction object OB2, and the second start instruction object OB3 are displayed.

[0133] The template selection object OB1 accepts the selection of an answer template to be used for answering from among the registered answer templates. The first start instruction object OB2 accepts the instruction to start answering using the selected answer template. When an input operation is performed on the first start instruction object OB2, an answer input format with the common answers registered in the selected answer template pre-filled for the questions for which the first attribute is set in that answer template is displayed on the target terminal 20. The second start instruction object OB3 accepts the instruction to start answering without using an answer template. When an input operation is performed on the second start instruction object OB3, an answer input format with the common answers not pre-filled in any of the answer input fields is displayed on the target terminal 20.

[0134] The content display area CA will show the details of the request (e.g., project name, requesting company, request date and time, etc.). Editing of the project name may also be permitted within the content display area CA.

[0135] Figure 7 shows an example of an answer input screen FD displayed on the user terminal 20. Figure 8 shows a continuation of the answer input screen FD in Figure 7. The answer input screen FD is displayed, for example, when input is made to the first start instruction object OB2 or the second start instruction object OB3 in the detailed display screen SD of Figure 6. As shown in Figure 7, the answer input screen FD includes a side panel area SA and an answer input area IA.

[0136] The side panel area SA displays the evaluation request acceptance object OB4 and the template display object OB5. The evaluation request acceptance object OB4 accepts requests for the entered answers to be reviewed (evaluated) by the evaluation unit 115, which will be described later. The template display object OB5 displays the answer template specified by the evaluation requester (the answer template currently in use). The template display object OB5 may also accept requests to switch (change) the answer template.

[0137] The answer input area IA displays multiple question areas (first question area QA1, second question area QA2, etc.) and a display toggle checkbox CB1. Question areas QA1 and QA2 are displayed for each question item included in the security investigation request. The display toggle checkbox CB1 allows filtering of the question areas QA1 and QA2 to be displayed in the answer input area IA. Specifically, when the display toggle checkbox CB1 is checked, only question areas QA1 and QA2 for which no answers (including automatically entered common answers) have been entered will be displayed in the answer input area IA. Note that in the examples in Figures 7 and 8, question areas QA1 and QA2 for the questions of the first attribute are displayed.

[0138] Each question area (the first question area QA1 and the second question area QA2) displays the question item QI, the answer input field IF, the judgment message JM, and the submission acceptance object OB6. The judgment message JM indicates whether a new answer different from the common answer has been entered for the question item of the first attribute. In the first question area QA1 shown in Figure 7, the common answer (the "yes" option and the detailed answer content) has not been changed, so the judgment message JM indicating that the answer matches the template is displayed. Note that the judgment message JM is not displayed for the question item of the second attribute. The submission acceptance object OB6 accepts the submission of new answers. In the example in Figure 7, the submission acceptance object OB6 is grayed out (deactivated) in the first question area QA1 because the common answer has not been changed.

[0139] On the other hand, in the second question area QA2 shown in Figure 8, the common answer has been changed (when the common answer was "yes", a new answer of "no" has been selected), so the judgment message JM indicating that the answer has been edited is displayed. In addition, the second question area QA2 is displayed in a different manner than the first question area QA1 (for example, in an emphasized form (thick frame)) due to the change in the common answer. Furthermore, in the second question area QA2, the transmission reception object OB6 has been activated.

[0140] Furthermore, in the second question area QA2, the restoration acceptance object OB7 is displayed in response to the change in the common answer. The restoration acceptance object OB7 accepts the restoration of a new answer to the common answer. When an input operation is performed on the restoration acceptance object, the input content of the answer input field IF in the second question area QA2 is changed to the common answer (for example, "Yes"). In conjunction with this, the content of the judgment message JM and the display format of the second question area QA2 are changed (to the same as the first question area QA1), and the transmission acceptance object OB6 is grayed out.

[0141] Figure 9 shows an example of the template update screen TD displayed on the user terminal 20. The template update screen TD is displayed, for example, when a request for response review is made by inputting into the evaluation request acceptance object OB4 on the response input screen FD in Figure 7. The template update screen TD displays template information TI, selection input field SF, save rejection object OB8, and save acceptance object OB9.

[0142] The template information TI displays the name of the answer template used for the answer (specified when the answer was created). The selection input field SF displays two options: a first option to update the common answer in the answer template, and a second option to add a new answer template. The first option displays that the update of the common answer will be notified to the evaluation user by the answer provision unit 116 (described later), and the question item (item number) of the first attribute into which the new answer was entered. The second option displays an input field that accepts the input of the registration name (management name) of the new answer template.

[0143] When an input operation is performed on the save rejection object OB8, the response data is registered without updating the response template or registering a new response template. When an input operation is performed on the save acceptance object OB9, if the first option is selected, a new common response is saved by updating the response template, and if the second option is selected, a new common response is saved by adding a new response template.

[0144] Figure 10 shows another example of the question area displayed on the answer input screen FD. Figure 10 shows a modified version of the second question area QA2 (the question area with edited common answers) from Figure 8. In the second question area QA2 of Figure 10, the template update checkbox CB2 is displayed next to the submission receiving object OB6. When the template update checkbox CB2 is checked (the option to update common answers is selected) and an input operation is performed on the submission receiving object OB6, the common answers in the answer template being used are updated to the new answers at the same time as the new answers entered in the answer input field IF are sent. On the other hand, when the template update checkbox CB2 is not checked (the option to update common answers is not selected) and an input operation is performed on the submission receiving object OB6, only the new answers entered in the answer input field IF are sent, and the common answers in the answer template are not updated. Note that if no new answers are entered (common answers are not edited), the template update checkbox CB2 may be deactivated.

[0145] <Evaluation Section 115> The evaluation unit 115 is configured to determine an evaluation score based on the evaluator's answers to multiple questions included in the security survey.

[0146] Specifically, the evaluation unit 115 determines the evaluation score by receiving evaluation results from evaluators for the response data registered (created or updated) by the response reception unit 114. The evaluation unit 115 registers the evaluated response data along with the evaluation results in a response database, etc. The evaluation results include at least an evaluation score (security score) indicating the level of security measures (how many or few problems there are in security measures). The evaluation score is calculated based on the score of each individual question.

[0147] "Evaluation" refers to the act of checking for deficiencies or inconsistencies in the responses included in the response data, creating comments on the content of the responses, assessing the content of the responses, and scoring the responses based on predetermined criteria. As described above, evaluation may be carried out by multiple evaluators, and the first evaluator may request the second evaluator to evaluate the registered response data. In that case, the evaluation unit 115 may accept the evaluation from the second evaluator after the evaluation by the first evaluator.

[0148] For example, if the evaluation is conducted in two stages, the initial evaluation (review) involves checking for deficiencies or inconsistencies, and creating points of concern. Subsequently, the response data after the initial evaluation is evaluated based on predetermined criteria, including assessment and scoring of the content (responses), and creation of comments on the entire response data. A report or document (e.g., a security report) containing the results is then created. The report or document is prepared, for example, by the final evaluator. The evaluation results of the response data may be included in the report or document as part of the report or as supplementary information.

[0149] The evaluation unit 115 may calculate an evaluation score for the response data based on the respondent's answers to the questions (response data) and reference information. The reference information includes the correlation between the response data and the evaluation score. The reference information is stored, for example, in the storage unit 12. The reference information may include, for example, a table, function, simple algorithm, etc., that shows the correlation between the response data and the evaluation score. The correlation included in the reference information can be constructed, for example, by statistically analyzing data that records the response data and the corresponding evaluation score.

[0150] The reference information may include a machine learning model or a generative AI evaluation model that is capable of taking response data as input and outputting an evaluation score. In this case, the evaluation unit 115 inputs the response data into the evaluation model and causes the evaluation model to output an evaluation score. This makes it possible to create an evaluation score based on an example of evaluating the response data or based on natural language processing. In the evaluation model, parameters calculated and tuned through learning constitute the correlation of the reference information.

[0151] The evaluation model is included in the artificial intelligence unit 120. The evaluation model, which is trained to output an evaluation score, is trained using, for example, response data and corresponding evaluation score data as training data.

[0152] If the evaluation model is a generative AI including a general-purpose natural language model (large-scale language model), the evaluation unit 115 inputs a prompt to the evaluation model that includes an instruction to take the response data as input and output an evaluation score corresponding to the response data, causing the evaluation model to output the evaluation score. The evaluation unit 115 may also generate a prompt that gives the evaluation model an instruction to calculate the evaluation score and input the prompt to the evaluation model. In addition to the instruction to calculate and output the evaluation score and the response data, the evaluation unit 115 may also input a prompt to the evaluation model that includes, for example, one or more sample response data and one or more sample evaluation scores corresponding to them, as an example, sample, or training data of input and output pairs.

[0153] The evaluation unit 115 may create all or part of an evaluation result (report or report) that includes comments, etc., in addition to an evaluation score, based on the response data and reference information. For example, the evaluation model may be configured to take response data as input and output an evaluation result.

[0154] Evaluation (determination of evaluation score) is typically performed on response data where all questions have been answered. Response data with unanswered questions (questions for which answers have not been registered) is not subject to evaluation, and the evaluation unit 115 does not need to determine an evaluation score or create evaluation results. Alternatively, even if response data contains unanswered questions (questions for which answers have not been registered), only the questions that have been answered may be partially subject to evaluation.

[0155] <Answer provision section 116> The response provision unit 116 is configured to provide the evaluation user (user terminal 40) with response data, including the answers to the questions provided by the person being evaluated. The response provision unit 116 may also provide the evaluation results created by the evaluation unit 115 to the evaluation user (especially the person who requested the security investigation).

[0156] The response data and evaluation results may be provided to the evaluators, for example, by registering them in a database accessible to the evaluators and notifying them of access information to the response data and evaluation results. Alternatively, the response data and evaluation results may be provided to the evaluators by attaching them to or including them in communication tools such as emails sent to them.

[0157] The response provision unit 116 may update the responses to which the common responses applied to the response data already provided to the evaluation user are applied if those common responses are updated by the person being evaluated. This allows the response data already provided to the evaluation user to be updated with the latest response content when the content of the answers to the questions (common questions) for the first attribute of the person being evaluated (e.g., authentication, system, etc.) changes.

[0158] The updates to the common responses here may be made when responding to a new security investigation request, as described above, or they may be made by editing the response template by the evaluation requester, independently of the response to an individual security investigation.

[0159] Updates to response data already provided to evaluation users are performed, for example, on the database where the response data is registered. The response provision unit 116 may also transmit the updated response data to the user terminal 40.

[0160] The response provision unit 116 notifies the evaluation user (user terminal 40) that a common response applied to the response data already provided to the evaluation user has been updated by the person being evaluated. This allows the evaluation user to be aware when the content of the answers to the questions (common questions) for the first attribute of the person being evaluated changes, and to confirm the updated common response.

[0161] The notification to the evaluation user (the notification message sent to the user terminal 40) may only include that the common answer has been updated, or it may include information indicating the updated common answer (e.g., the question number, item name, etc.), the content of the common answer, etc.

[0162] The response provision unit 116 may notify the evaluation user (user terminal 40) that a response is no longer a common response (it has become an individual response) if the common response applied to the response data already provided to the evaluation user is removed by the person being evaluated (i.e., the attribute of the corresponding question item is changed from the first attribute to the second attribute).

[0163] <Information presentation section 117> The information presentation unit 117 is configured to present analytical information regarding response data, response templates, evaluation scores, etc., to the person being evaluated or the user of the evaluation.

[0164] Specifically, the information presentation unit 117 may present to the person being evaluated (subject terminal 20) or the evaluation user (user terminal 40) first percentage information, which shows the percentage of questions among multiple questions included in the security survey for which a common answer is applied as the answer. This allows the person being evaluated to understand, for example, the degree of consistency of their security quality across multiple survey targets. Similarly, the evaluation user can understand, for example, the percentage of the person being evaluated who has customized their security measures according to the survey target.

[0165] "Questions to which a common answer is applied as the answer" (hereinafter referred to as "specific questions") refers, for example, to questions of the first attribute to which a common answer registered in the answer template is used as the answer as is. Questions to which a new answer has been confirmed as the answer, even if a corresponding common answer is registered, may not be included. In other words, the percentages shown in the first percentage information do not include questions of the first attribute to which a common answer is not applied (i.e., new answers have been entered).

[0166] The first percentage information may be a numerical value representing a percentage (the ratio of common responses to individual responses other than common responses), data illustrating the percentage such as a bar graph, or a combination of these. Furthermore, the display format of the first percentage information on the target terminal 20 and the display format of the first percentage information on the user terminal 40 may differ.

[0167] Furthermore, "individual responses" may include, for example, answers to questions related to the second attribute, and new answers to questions related to the first attribute that differ from the registered common answers.

[0168] The first percentage information may, for example, be presented on the editing screen of the response template displayed on the subject terminal 20. Alternatively, the first percentage information may be displayed on the user terminal 40 together with the response data and / or evaluation results, or it may be displayed on the user terminal 40 as part of the information when displaying information about the person being evaluated (for example, when an evaluation user searches for a person being evaluated).

[0169] The information presentation unit 117 may present to the person being evaluated (subject terminal 20) or the user of the evaluation (user terminal 40) second ratio information, which shows the ratio of the score based on common responses to the score based on individual responses other than common responses, in the evaluation score determined by the evaluation unit 115. This makes it possible to visualize the attributes of the person being evaluated based on the comparison between the score in common responses and the score in individual responses.

[0170] The "score based on common responses" is, for example, the sum of evaluation scores for questions in which common responses were entered. The "score based on individual responses" is, for example, the sum of evaluation scores for questions in which individual responses were entered.

[0171] The second proportion information may be a numerical value representing a proportion (the ratio of the score for common responses to the score for individual responses), data illustrating the proportion such as a bar graph, or a combination of these. Furthermore, the display format of the second proportion information on the target terminal 20 and the display format of the second proportion information on the user terminal 40 may differ.

[0172] The second percentage information may be displayed, for example, as part of the evaluation results of the response data displayed on the target terminal 20 or user terminal 40.

[0173] The information display unit 117 may present the first statistical score for each answer template registered by one evaluator to the evaluator (evaluator terminal 20) or the evaluation user (user terminal 40). The "first statistical score" indicates the statistical value of the evaluation score for each of the multiple security surveys in which the answer template was used. This allows the evaluator or evaluation user to understand the trend of evaluation scores for each answer template with different question attributes and / or common answers.

[0174] The "multiple security surveys" included in the first statistical score may include only security surveys requested by a single evaluator (requester), or security surveys requested by multiple evaluators (requesters), and typically include all security surveys using a single response template. Furthermore, "statistical values" include the mean, maximum value, minimum value, and deviation.

[0175] The information display unit 117 may present a second statistical score for each person being evaluated to the person being evaluated (person terminal 20) or the evaluation user (user terminal 40). The second statistical score shows the statistical value of the first statistical score for each of the multiple response templates registered by the person being evaluated. This allows the person being evaluated or the evaluation user to grasp the trend of their overall evaluation score.

[0176] The "multiple response templates" used for the second statistical score may include only the response templates used in security surveys requested by a single evaluator (requester), or they may include the response templates used in security surveys requested by multiple evaluators (requesters), and typically include all response templates registered by the person being evaluated.

[0177] The first and second statistical scores may be numerical values ​​representing the statistical values ​​themselves, data illustrating the magnitude of the statistical values ​​such as bar graphs, or score distribution data (for example, a distribution table showing the distribution of each score, a histogram, etc.). Furthermore, the display format of the first and second statistical scores on the target terminal 20 may differ from the display format of the first and second statistical scores on the user terminal 40.

[0178] The first and second statistical scores may be presented, for example, on the editing screen of the response template displayed on the participant terminal 20. Alternatively, the first and second statistical scores may be presented as part of the information when displaying the information of the person being evaluated (for example, when an evaluator searches for a person being evaluated).

[0179] Figure 11 shows an example of how the first and second statistical scores are displayed on the target terminal 20 or user terminal 40. In the example in Figure 11A, the first statistical scores (minimum, maximum, and average) for each of the two response templates (template A and template B) are displayed as numerical values ​​and bar graphs. In the example in Figure 11B, the second statistical score (average) is displayed as a numerical value, along with its breakdown (first statistical score for each response template).

[0180] <Artificial Intelligence Department 120> The artificial intelligence unit 120 is configured to receive input from each functional unit and return the instructed output. The artificial intelligence used by each functional unit of the server device 10 may be common to all units, or it may be prepared individually for each functional unit.

[0181] The artificial intelligence unit 120 may be an AI (Artificial Intelligence) equipped with learning models such as transformers including GPT (Generative Pretrained Transformer, including GPT-1 to GPT-5), BERT (Bidirectional Encoder Representations from Transformers), BART (Bidirectional and Auto-regressive Transformer), and language models such as recurrent neural networks (RNNs). The artificial intelligence unit 120 may also be a generative AI or an AI agent, for example, including a large-scale language model. A large-scale language model is a type of generative AI and includes models provided by services such as OpenAI's GPT, Google's Gemini, and Microsoft's Azure AI Studio. A generative AI may be, for example, a text generation AI, an image generation AI, or a multimodal generation AI. A learning model may also be called an artificial intelligence model, a machine learning model, a trained model, or a deep learning model. In addition, the artificial intelligence unit 120 can include any learning model.

[0182] The language model is an example of a learning model using a machine learning algorithm. Specific machine learning algorithms include nearest neighbors, naive Bayes, decision trees, support vector machines, and deep learning using neural networks. The artificial intelligence unit 120 can apply the above algorithms as appropriate.

[0183] The artificial intelligence unit 120 may have a trained model constructed by a learning method such as supervised learning, unsupervised learning, or self-supervised learning. In supervised learning, machine learning is performed using training data. Training data consists of pairs of input data and output data (correct answer data) for training. Furthermore, the language model may not only be one trained for a specific task, but also a general-purpose model that can be used universally for a wide range of tasks.

[0184] The artificial intelligence unit 120 may include a natural language model as artificial intelligence, or it may be a general-purpose pre-trained model for natural language processing, such as a Large Language Model (LLM). An LLM is a pre-trained model that has learned a large amount of data in advance, consisting of text data, etc. (for example, (i) web content on the internet, or (ii) data stored in a predetermined database), and can perform various language processing tasks by being given a task. It can perform a wide range of natural language processing tasks, such as understanding sentence patterns and context, responding to questions, and generating sentences, according to the given prompt. Such a general-purpose pre-trained model may include language models that can handle various tasks without fine-tuning using One-shot Learning or Few-shot Learning. Furthermore, the general-purpose pre-trained model may also be configured to handle various tasks using Zero-shot Learning. The artificial intelligence used in each functional unit of the control unit 11 may be a separate pre-trained model, or it may be a common general-purpose pre-trained model. In addition, the artificial intelligence unit 120 may include a small-scale language model or a medium-scale language model, which is smaller in scale than a large-scale language model, as a pre-trained model. Small-scale and medium-scale language models are natural language processing models that are trained on less data (and constructed with fewer parameters) compared to large-scale language models.

[0185] The learning models included in the artificial intelligence unit 120 (such as evaluation score calculation models and other learning models used in each functional unit) can undergo additional learning using methods such as transfer learning and fine-tuning. For example, whenever new data is registered, the artificial intelligence unit 120 may perform additional learning and fine-tuning using this new data as training data. This improves the accuracy of the information output from the learning model.

[0186] The learning model included in the artificial intelligence unit 120 may be a learning model (distilled model) obtained by knowledge distillation using the original learning model. In knowledge distillation, a pre-trained model, such as a large-scale language model, is used as the teacher model, and the parameters of the student model are adjusted so that the output loss of the student model (distilled model) relative to the output (Soft Target Loss) of the teacher model is small. The student model is then trained, and this student model becomes the distilled model. Alternatively, the student model may be trained so that the output loss of the student model relative to the correct labels (Hard Target) of the teacher data (combinations of input and output data of the learning model) is small. Compared to the original learning model (teacher model), the distilled model has similar performance to the original learning model, but with fewer parameters and a lower processing load. Therefore, using a distilled model can reduce the cost of the information processing system 1.

[0187] An AI agent (also called an autonomous agent) is a model that, upon input of a goal (objective, purpose, etc.) such as "Teach me about XX" or a task such as "Output XX," breaks down the processes necessary to reach the goal or accomplish the task into subtasks, actions, etc., and performs necessary data collection and analysis, program generation and execution, etc. The AI ​​agent takes the information and instructions input by the user as its goal, autonomously selects and executes tasks and actions according to the goal, outputs information according to the goal, and does not require user intervention (operation input). Furthermore, the AI ​​agent may autonomously plan and execute, evaluate the execution results itself, and autonomously learn in order to aim for goal achievement. For example, the AI ​​agent may autonomously update itself based on the execution results of subtasks (e.g., collected information, results of information analysis, etc.).

[0188] For example, the learning model used in each functional unit may be a distilled model that has been trained using combinations of input and output data from a large-scale language model as training data. Alternatively, when the information processing system 1 is introduced, a large-scale language model may be used as the learning model in each functional unit, and once training data from the large-scale language model has been accumulated, the distilled model obtained by knowledge distillation using that training data may be used as the learning model in each functional unit.

[0189] <Display> The display unit 211 of the subject terminal 20, the display unit 311 of the evaluator terminal 30, and the display unit 411 of the user terminal 40 each display the screen indicated by the screen data transmitted from the server device 10.

[0190] <Operation acquisition part> The operation acquisition unit 212 of the target terminal 20 receives operations from the person being evaluated using the target terminal 20. The operation acquisition unit 312 of the evaluator terminal 30 receives operations from the evaluator using the evaluator terminal 30. The operation acquisition unit 412 of the user terminal 40 receives operations from the user being evaluated using the user terminal 40.

[0191] 3. Information Processing Methods This section describes the information processing method of the server device 10. In this information processing method, each part of the server device 10 is executed by a computer as a step.

[0192] This information processing comprises a registration step, a survey request acceptance step, a response acceptance step, an evaluation step, and a response provision step. In the registration step, the attributes of the questions included in the security survey for the person to be evaluated are registered. In the survey request acceptance step, a request for a security survey for the person to be evaluated is received from the requester. In the response acceptance step, responses to the questions for the first attribute (common attributes and business attributes) and the questions for the second attribute are received from the person to be evaluated through the respective response input fields. In the evaluation step, an evaluation score is determined based on the person to be evaluated's answers to multiple questions included in the security survey. In the response provision step, response data, including the person to be evaluated's answers to the questions, is provided to the evaluation user.

[0193] Figure 12 is an activity diagram showing an example of the flow of information processing (security investigation processing) performed by information processing system 1. The information processing will be explained below in accordance with each activity in this activity diagram.

[0194] The security survey process begins with the evaluator setting the attributes of the questions included in the security survey. The evaluator sets the attributes of the questions on the evaluator terminal 20, for example, by creating an answer template (Activity A101). The server device 10 registers the attributes of the questions entered on the evaluator terminal 20 (Activity A102). Note that the evaluator may omit setting the attributes. In other words, the setting and registration of attributes may be done when the evaluator enters their answers to the security survey.

[0195] After registering the attributes, the evaluation user (evaluation requestor) enters a request for a security investigation on the user terminal 40 (Activity A103). The server device 10 receives the request for a security investigation from the user terminal 40 (Activity A104). Subsequently, the server device 10 outputs an answer input form with common answers pre-filled for the questions regarding the first attribute (common attribute or business attribute) to the target terminal 20 of the person being evaluated who is the subject of the security investigation (Activity A105). As a result, the answer input form is displayed on the target terminal 20 (Activity A106).

[0196] The person being evaluated enters their answers into the answer input form displayed on the participant terminal 20 (Activity A107). The server device 10 receives the answers entered on the participant terminal 20 as answer data (Activity A108). Next, the server device 10 performs an evaluation of the answer data, including determining an evaluation score (Activity A109). Furthermore, the server device 10 outputs the answer data and evaluation results to the user terminal 40 (Activity A110). As a result, the answer data and evaluation results are displayed on the user terminal 40 (Activity A111).

[0197] 4. Effect The operation of this embodiment can be summarized as follows: In other words, by displaying pre-registered common answers to common questions in security surveys, the survey subjects can efficiently answer the security survey.

[0198] Although embodiments of the present invention have been described above, the present invention is not limited thereto and can be modified as appropriate without departing from the technical spirit of the invention.

[0199] 5. Others In the above embodiment, the server device 10 performed various storage and control functions, but instead of the server device 10, multiple external devices may be used. That is, various information and programs may be stored in a distributed manner across multiple external devices using blockchain technology or the like. In particular, the artificial intelligence unit 120 may be an external configuration of the server device 10. In that case, the external artificial intelligence unit 120 may be provided by, for example, an artificial intelligence service server, and is configured to receive input from each functional unit of the server device 10, receive requests to execute artificial intelligence services, and return the instructed output as a processing result to the server device 10. The artificial intelligence service server may be a server that provides services using a language model as a learning model, or a server that executes language processing tasks using a language model. The artificial intelligence service server may be constructed using an LLM. The artificial intelligence service server receives prompt input in the form of text, images, audio, etc., and generates and responds with answers to the prompts.

[0200] The control unit 11 does not necessarily have to include an information presentation unit 117. In other words, the information processing system 1 does not necessarily have to present analytical information (first percentage information, second percentage information, first statistical score, second statistical score, etc.) related to response data, response templates, evaluation scores, etc.

[0201] The embodiments of this model are not limited to the information processing system 1, but may also be an information processing method or a program. In the information processing method, the information processing device executes each step of the information processing system 1. In the program, the computer causes a computer to execute each step of the information processing system 1.

[0202] The product may be provided in any of the following embodiments.

[0203] (1) An information processing system comprising at least one processor, wherein the processor is configured to perform the following steps by reading a program, wherein in the registration step, attributes of questions included in a security survey for a person under evaluation are registered, where the attributes include a common attribute indicating a first common question for which a first common answer can be set that can be used by the person under evaluation for multiple targets of the security survey regardless of the type of business subject to the security survey, and a business attribute indicating a second common question for which a second common answer can be set that can be used by the person under evaluation for multiple targets of the security survey for each type of business, wherein in the response reception step, the system receives input from the person under evaluation of answers to the questions of the common attribute and the questions of the business attribute from the respective response input fields for the questions, wherein the first common answer pre-registered for the question is initially displayed in the response input field for the question of the common attribute, and the second common answer pre-registered for the question is initially displayed in the response input field for the question of the business attribute, according to the type of business.

[0204] (2) An information processing system as described in (1) above, wherein the business type includes at least one of the following: the content of the business, the location where the business is performed, and the environment in which the business is performed.

[0205] (3) An information processing system as described in (1) or (2) above, wherein in the answer input field of the question item in which both the common attribute and the business attribute are registered as attributes, an integrated answer formed by integrating the first common answer and the second common answer is initially displayed.

[0206] (4) An information processing system as described in (3) above, wherein the integrated response is the union of the first common response and the second common response.

[0207] (5) An information processing system described in any one of (1) to (4) above, wherein in the answer input field of the question item in which both the common attribute and the business attribute are registered as attributes, the answer with the higher predetermined priority among the first common answer and the second common answer is initially displayed.

[0208] (6) An information processing system described in any one of (1) to (5) above, wherein in the answer input field of the question item in which both the common attribute and the business attribute are registered as attributes, the answer selected by the person being evaluated from among the first common answer and the second common answer is initially displayed.

[0209] (7) An information processing system according to any one of (1) to (6) above, wherein in the registration step, the system receives input of answers to the questions from the person being evaluated, registers the answers as the second common answers to the questions, registers the business attributes as the attributes of the questions, and further registers the common attributes as the attributes of the questions specified by the person being evaluated from among the questions for which the business attributes have been registered, and registers the second common answers to those questions as the first common answers.

[0210] (8) An information processing system according to any one of (1) to (7) above, wherein in the registration step, multiple business response templates are registered for each type of business, and the business response template includes the second common response to each of the multiple business attribute questions included in the security survey, and in the response reception step, the system receives a designation from the person being evaluated to use the business response template to answer the questions.

[0211] (9) An information processing system according to any one of (1) to (8) above, wherein the attribute further includes an individual attribute indicating an individual question that requires an individual response for each subject of the security survey of the person being evaluated, and in the response reception step, the information processing system receives input of answers to the questions of the individual attribute from the person being evaluated through the answer input field for the questions.

[0212] (10) An information processing system according to any one of (1) to (9) above, wherein in the registration step, the information processing system receives the specification of the attribute for the question from the person to be evaluated.

[0213] (11) An information processing system according to any one of (1) to (10) above, comprising a server device having the processor and a terminal that can access the server device.

[0214] (12) An information processing method wherein an information processing device performs each step of the information processing system described in any one of (1) to (11) above.

[0215] (13) A program that causes a computer to perform each step of the information processing system described in any one of (1) to (11) above. Of course, this is not always the case.

[0216] Finally, while various embodiments relating to this disclosure have been described, these are presented as examples only and are not intended to limit the scope of the invention. These novel embodiments can be implemented in a variety of other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their variations are included in the scope and spirit of the invention, as well as in the claims and their equivalents. [Explanation of symbols]

[0217] 1: Information Processing System 2: Communication lines 10: Server device 11: Control Unit 111: Basic Display Control Unit 112: Registration Department 113: Investigation Request Reception Department 114: Response Reception Department 115: Evaluation Department 116:Answer provision department 117: Information presentation section 120: Artificial Intelligence Department 12: Storage section 13: Communications Department 14: Communications bus 20: Target user's device 21: Control Unit 211:Display section 212: Operation acquisition section 22: Storage section 23: Communications Department 24: Input section 25: Output section 26: Communications bus 30: Evaluator terminal 31: Control Unit 311: Display section 312: Operation acquisition section 32: Storage section 33: Communications Department 34: Input section 35: Output section 36: Communications bus 40: User terminal 41: Control Unit 411: Display section 412: Operation acquisition section 42: Storage section 43: Communications Department 44: Input section 45: Output section 46: Communications bus CA:Content display area CB1: Display toggle checkbox CB2: Template update checkbox FD: Answer input screen IA: Answer input area IF:Answer input field JM: Judgment Message OB1: Template Selection Object OB2: First Start Instructor Object OB3: Second Start Instructor Object OB4: Evaluation Request Acceptance Object OB5: Template display object OB6: Sending Reception Object OB7: Restoration Request Object OB8: Object that refused to be saved OB9: Save Acceptance Object PA: Progress display area QA1: 1st question area QA2: 2nd question area QI: Questions RD: Request display screen SA: Side panel area SD:Details display screen SF: Selection input field TD: Template Update Screen TI: Template Information

Claims

1. An information processing system, Equipped with at least one processor, The aforementioned processor is configured to perform the following steps by reading a program: In the registration step, the attributes of the questions included in the security survey for the person being evaluated are registered, wherein the attributes include a common attribute indicating a first common question for which a first common answer is set that can be used by the person being evaluated for multiple subjects of the security survey regardless of the type of work subject to the security survey, and a business attribute indicating a second common question for which a second common answer is set that can be used by the person being evaluated for multiple subjects of the security survey for each type of work. In the response reception step, the system receives the selection of the type of work from the person to be evaluated, and further receives the input of answers to the questions for the common attributes and the questions for the work attributes from the person to be evaluated through the answer input fields for each of the questions, wherein the first common answer, which has been pre-registered for the question, is initially displayed in the answer input field for the question for the common attributes, and the second common answer, which has been pre-registered for the question, is initially displayed in the answer input field for the question for the work attributes, according to the type of work selected by the person to be evaluated.

2. In the information processing system described in claim 1, The aforementioned business type is an information processing system that includes at least one of the following: the content of the business, the location where the business is performed, and the environment in which the business is performed.

3. In the information processing system described in claim 1, An information processing system in which, in the answer input field of the question item in which both the common attribute and the business attribute are registered as attributes, the answer with the higher predetermined priority among the first common answer and the second common answer is initially displayed for each answer.

4. In the information processing system described in claim 1, An information processing system in which, among the first common answer and the second common answer, which are displayed together with the answer input field of the question item in which both the common attribute and the business attribute are registered as attributes, the answer selected by the person being evaluated is initially displayed in the answer input field.

5. In the information processing system described in claim 1, In the aforementioned registration step, The system receives input of answers to the aforementioned questions from the person being evaluated, registers the answers as the second common answers to the aforementioned questions, and registers the aforementioned business attributes as the attributes of the aforementioned questions. Furthermore, an information processing system that registers the common attributes as attributes for the questions specified by the person being evaluated, among the questions for which the business attributes have been registered, and registers the second common answer to the question as the first common answer.

6. In the information processing system described in claim 1, In the registration step, multiple business response templates are registered for each type of business, and each business response template includes the second common response to each of the questions for each of the multiple business attributes included in the security survey. An information processing system that, in the response reception step, receives from the person being evaluated the designation of the business response template to be used to answer the questions.

7. In the information processing system described in claim 1, The aforementioned attributes further include individual attributes indicating individual questions that require individual responses for each subject of the security survey by the person being evaluated, In the response reception step, the information processing system receives input from the person being evaluated for the questions regarding the individual attributes of the person being evaluated, through the input field for the answer to the question.

8. In the information processing system described in claim 1, The registration step involves an information processing system that receives the specification of the attributes for the questions from the person being evaluated.

9. In the information processing system described in claim 1, A server device having the aforementioned processor, A terminal that can access the aforementioned server device, An information processing system equipped with the following features.

10. Information processing method, An information processing method comprising an information processing device performing each step of the information processing system described in any one of claims 1 to 9.

11. It is a program, A program for causing a computer to perform each step of the information processing system described in any one of claims 1 to 9.

Images