Compliance Data Model Automation for IT Control

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Manual methods for determining compliance with IT regulations are inefficient, time-consuming, and prone to high error rates, requiring substantial manual effort and expertise, and typically address one authority document at a time.

Innovation Solution

A system and method for generating a compliance data model that automatically determines applicable IT controls based on regulations, using control logic to generate controls, subset logic to identify relevant controls for software technologies, and modeling logic to create a compliance data model specifying control objectives and activity tests, thereby automating compliance assessment and reporting.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If manual methods are used to determine compliance with IT regulations, then compliance assessment can be performed with existing processes, but time consumption and resource requirements increase substantially

Engineering Contradiction:

Improvecompliance assessment accuracyVSAvoidtime consumption

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system enables self-service automation where the compliance assessment process automatically determines applicable controls, generates compliance data models, and produces artifacts without requiring manual human intervention for each assessment task

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

Manual mechanical processes of compliance assessment are replaced with an automated computer-based system that uses algorithms and data processing to determine applicable controls and generate compliance artifacts

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Reliability

If manual compliance determination processes are used, then existing expertise can be utilized, but error rates increase and consistency decreases

Engineering Contradiction:

Improvecompliance determination consistencyVSAvoidcompliance assessment accuracy

Core Design Contradiction:

ReliabilityVSManufacturing precision

Solution Approach 1:

The system incorporates feedback mechanisms where compliance artifacts and data models are automatically generated and can be validated, ensuring consistent application of compliance rules and reducing human error

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The system transforms compliance determination from a manual interpretive process to an automated process with defined parameters and rules, improving precision through systematic data processing

Inventive Principle:

Principle #35Parameter changes

3Measurement precision

If conventional techniques process one authority document at a time, then detailed analysis of each document is possible, but productivity decreases

Engineering Contradiction:

Improvedocument analysis depthVSAvoidcompliance assessment throughput

Core Design Contradiction:

Measurement precisionVSProductivity

Solution Approach 1:

The system merges multiple authority document processing operations into a single automated compliance assessment process, simultaneously gathering data from multiple sources and generating comprehensive compliance artifacts

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The compliance assessment system is designed with multi-functionality to handle various authority documents and generate multiple types of compliance artifacts through a single integrated process

Inventive Principle:

Principle #6Universality (Multi-functionality)

4Productivity

If automated compliance systems are implemented, then time and resource consumption are reduced, but system complexity increases

Engineering Contradiction:

Improvecompliance assessment efficiencyVSAvoidsystem complexity

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The automated compliance system is segmented into distinct functional modules including artifact generation, data model generation, and compliance determination components, making the complex system manageable and maintainable

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS9183528B2Generating a compliance data model for IT control

Publication Date: 2015.11.10 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

Techniques are described herein that are capable of generating a compliance data model for information technology (IT) control. The compliance data model is capable of capturing data from technologies (e.g., software programs, file systems, etc.) and/or developers of those technologies for determining compliance of the technologies with regulations. The compliance data model may be used to automate generation of artifacts. Each artifact is machine-readable code that includes instructions regarding how to implement a control. A control is a software container that is associated with one or more elements, such as a control objective, a control activity, a control activity test, etc. The artifacts are usable by management systems to obtain data regarding installed technologies, settings of the technologies, configurations of the technologies, events that are being utilized by the technologies, etc. The management systems may use the data to generate reports regarding compliance of the technologies with the regulations.