Enterprise Integrity Content Generation and Utilization

• US 20080082348A1
• Filed: 10/02/2006
• Published: 04/03/2008
• Est. Priority Date: 10/02/2006
• Status: Abandoned Application

• Current Assignee: SAP AG (SAP SE)
• Original Assignee: SAP AG (SAP SE)
• Inventors: Wagner, Guido, Paulus, Sachar M., Bitz, Gunter
• Application Number:
  US11/538,038
• Publication Number:
  US 20080082348A1
• Time in Patent Office: Days
• US Class Current: 705/1
• CPC Class Codes: G06Q 30/0278 Product appraisal
• CPC Class Codes: G06Q 40/06 Asset management; Financial planning or analysis
• CPC Class Codes: G06Q 40/08 Insurance

Abstract

Methods and apparatus, including computer program products, for risk assessment and analysis. In one general aspect, asset data representing a set of assets is received. Threat data representing a set of threats is received. Requirements data representing one or more requirements is received, wherein each requirement requires compliance with a regulation and a failure to satisfy the requirement constitutes a threat additional to the set of threats. Measures data representing a set of measures is received. A current status is calculated using the measures data and the requirements data based on a level of compliance with the requirements, the level of compliance determined by the measures and the additional one or more threats to one or more assets represented by the measures data and the requirements data.

Claims

1. A computer program product, tangibly embodied in an information carrier, for a knowledge processing system, the computer program product being operable to cause data processing apparatus to:

receive asset data representing a set of assets, the asset data including a respective value for each asset in the set of assets having a value;

receive threat data representing a set of threats;

each threat in the set of threats potentially reducing the value of one or more of the assets in the set of assets;

receive requirements data representing one or more requirements, wherein each requirement requires compliance with a regulation and a failure to satisfy the requirement constitutes a threat additional to the set of threats;

receive measures data representing a set of measures;

each measure in the set of measures protecting the value of one or more assets from the additional one or more threats of failing to satisfy the one or more requirements; and

calculate a current status using the measures data and the requirements data based on a level of compliance with the requirements, the level of compliance determined by the measures and the additional one or more threats to one or more assets represented by the measures data and the requirements data.

2. The computer program product of claim 1, the computer program product being further operable to cause data processing apparatus to:

receive project data representing a proposed project, the proposed project modifying the set of measures by adding additional measures to the set of measures or enhancing one or more measures in the set of measures or both;

calculate a return on investment of the proposed project based on the modified set of measures and the additional threat.

3. The computer program product of claim 1, wherein the current status is represented by a percentage value, with 100 percent representing full compliance with the one or more requirements and 0 percent indicating no compliance with the one or more requirements.

4. The computer program product of claim 3, the computer program product being further operable to cause data processing apparatus to:

display the current status graphically, wherein a group of sets of one or more requirements is displayed as a group of corresponding radial spokes from a center, wherein the percentage of compliance for each set of requirements is represented as distance from the center along the corresponding radial spoke.

5. The computer program product of claim 1, the computer program product being further operable to cause data processing apparatus to:

display the current status graphically, wherein the current status is indicated by one of the following colors;

red, indicating no compliance or a low level of compliance;

yellow, indicating a medium level of compliance; and

green, indicating a high level of compliance or full compliance.

6. The computer program product of claim 1, the computer program product being further operable to cause data processing apparatus to:

display the current status graphically, wherein a map of geographic regions is displayed graphically and the current status for each geographic region is indicated by one of the following colors;

red, indicating no compliance or a low level of compliance;

yellow, indicating a medium level of compliance; and

green, indicating a high level of compliance or full compliance.

7. The computer program product of claim 6, the computer program product being further operable to cause data processing apparatus to:

display the current status color for each geographic region in a separate geometric shape, wherein the size of the geometric shape varies according to the relative importance of the geographic region.

8. The computer program product of claim 1, the computer program product being further operable to cause data processing apparatus to:

generate a report, the report indicating the level of compliance with the one or more requirements.

9. The computer program product of claim 8, wherein:

the report is organized by asset.

10. The computer program product of claim 8, wherein:

the report is organized by employees in various countries.

11. A computer program product, tangibly embodied in an information carrier, for a knowledge processing system, the computer program product being operable to cause data processing apparatus to:

receive user input defining specific threat triggers;

receive user input defining a generic threat trigger corresponding to the specific threat triggers; and

receive user input defining specific means by which the generic threat could be carried out.

12. The computer program product of claim 11, the computer program product being further operable to cause data processing apparatus to:

receive user input defining a goal of an intruder utilizing the specific means.

13. A computer-implemented method comprising:

receiving asset data representing a set of assets, the asset data including a respective value for each asset in the set of assets having a value;

receiving threat data representing a set of threats;

each threat in the set of threats potentially reducing the value of one or more of the assets in the set of assets;

receiving requirements data representing one or more requirements, wherein each requirement requires compliance with a regulation and a failure to satisfy the requirement constitutes a threat additional to the set of threats;

receiving measures data representing a set of measures;

each measure in the set of measures protecting the value of one or more assets from the additional one or more threats of failing to satisfy the one or more requirements; and

calculating a current status using the measures data and the requirements data based on a level of compliance with the requirements, the level of compliance determined by the measures and the additional one or more threats to one or more assets represented by the measures data and the requirements data.

14. The method of claim 13, further comprising:

receiving project data representing a proposed project, the proposed project modifying the set of measures by adding additional measures to the set of measures or enhancing one or more measures in the set of measures or both;

calculating a return on investment of the proposed project based on the modified set of measures and the additional threat.

15. The method of claim 13, wherein the current status is represented by a percentage value, with 100 percent representing full compliance with the one or more requirements and 0 percent indicating no compliance with the one or more requirements.

16. The method of claim 13, further comprising:

displaying the current status graphically, wherein the current status is indicated by one of the following colors;

red, indicating no compliance or a low level of compliance;

yellow, indicating a medium level of compliance; and

green, indicating a high level of compliance or full compliance.

17. The method of claim 13, further comprising:

generating a report, the report indicating the level of compliance with the one or more requirements.

18. A system comprising:

means for receiving asset data representing a set of assets, the asset data including a respective value for each asset in the set of assets having a value;

means for receiving threat data representing a set of threats;

each threat in the set of threats potentially reducing the value of one or more of the assets in the set of assets;

means for receiving requirements data representing one or more requirements, wherein each requirement requires compliance with a regulation and a failure to satisfy the requirement constitutes a threat additional to the set of threats;

means for receiving measures data representing a set of measures;

each measure in the set of measures protecting the value of one or more assets from the additional one or more threats of failing to satisfy the one or more requirements; and

means for calculating a current status using the measures data and the requirements data based on a level of compliance with the requirements, the level of compliance determined by the measures and the additional one or more threats to one or more assets represented by the measures data and the requirements data.

19. The system of claim 18, further comprising:

means for receiving project data representing a proposed project, the proposed project modifying the set of measures by adding additional measures to the set of measures or enhancing one or more measures in the set of measures or both;

means for calculating a return on investment of the proposed project based on the modified set of measures and the additional threat.

20. The system of claim 18, wherein the current status is represented by a percentage value, with 100 percent representing full compliance with the one or more requirements and 0 percent indicating no compliance with the one or more requirements.

21. The system of claim 18, further comprising:

means for displaying the current status graphically, wherein the current status is indicated by one of the following colors;

red, indicating no compliance or a low level of compliance;

yellow, indicating a medium level of compliance; and

green, indicating a high level of compliance or full compliance.

22. The system of claim 18, further comprising:

means for generating a report, the report indicating the level of compliance with the one or more requirements.