Risk information processing device, risk information provision system, risk information processing method, risk information provision method, and program

Claims

1. In cybersecurity guidelines for management, a parameter selection means selects parameters that affect the company's management indicators from among parameters that indicate the actions and factors necessary to achieve the requirements for ensuring cybersecurity, and Risk function acquisition means for acquiring a function for calculating a business risk value, which is a value indicating the state of a risk item that is an item indicating business risk in corporate management, based on the values ​​of at least some of the selected parameters, A business risk calculation means that calculates the business risk value based on the values ​​of the parameters and the function, Information output means for outputting display information for displaying a list of at least a portion of the calculated business risk values ​​side by side, A risk information processing device equipped with the following features.

2. The aforementioned function calculates the difference between the target risk value set as an objective for a business risk item in corporate management and the aforementioned business risk value. The information output means outputs display information for displaying the difference. The risk information processing device according to claim 1.

3. The function calculates the weighted sum of the parameters using the weights set for each parameter as the business risk value. The risk information processing device according to claim 1.

4. The aforementioned weights are the parameters, the weights of the parameters set in multiple companies, and the weights calculated using a machine learning model that uses the correct data of the management risk values. The risk information processing device according to claim 3.

5. The system further includes a degree of satisfaction calculation means that calculates a degree of satisfaction indicating the degree to which the overall parameters necessary to achieve the requirements are satisfied, using the degree of achievement calculated based on the current value and target value of the parameters. The risk function acquisition means acquires the function used to calculate at least some of the business risk values, which is the function used to calculate the business risk values ​​based on the degree of sufficiency. The business risk calculation means calculates at least some of the business risk values ​​based on the parameter values, the degree of sufficiency, and the function. The risk information processing device according to claim 1.

6. The information output means outputs display information for displaying a warning about the business risk value that has become higher than the risk threshold. The risk information processing device according to claim 1.

7. A risk information processing device according to any one of claims 1 to 6, A terminal device that outputs the function for calculating the business risk value to the risk information processing device, A display device that displays a list of at least some of the business risk values ​​output by the risk information processing device, A risk information provision system equipped with the following features.

8. In cybersecurity guidelines for management, from among the parameters that indicate the actions and factors necessary to achieve the requirements for ensuring cybersecurity, the parameters that affect the company's management indicators are selected. A function is obtained to calculate a business risk value, which is a value indicating the state of a risk item that represents a business risk in corporate management, based on the values ​​of at least some of the selected parameters. Based on the values ​​of the parameters and the function, the business risk value is calculated. Outputs display information for displaying a list of at least some of the calculated business risk values ​​side by side. Risk information processing method.

9. The risk information processing device performs the risk information processing method described in claim 8, The terminal device outputs the function for calculating the business risk value to the risk information processing device. The display device displays a list of at least some of the business risk values ​​output by the risk information processing device. Methods for providing risk information.

10. In cybersecurity guidelines for management, the process involves selecting parameters that affect a company's management indicators from among the parameters that indicate the actions and factors necessary to achieve the requirements for ensuring cybersecurity. A process for obtaining a function for calculating a business risk value, which is a value indicating the state of a risk item that is an item indicating business risk in corporate management, based on the values ​​of at least some of the selected parameters, A process for calculating the business risk value based on the values ​​of the parameters and the function, A process to output display information for displaying a list of at least some of the calculated business risk values ​​side by side, A program that causes a computer to execute something.