Method and system for automatically testing information technology control

• US 20060277080A1
• Filed: 06/03/2005
• Published: 12/07/2006
• Est. Priority Date: 06/03/2005
• Status: Abandoned Application

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: DeMartine, Amy Lynette, Gilstrap, Carrie Jean, DeMartine, Patrick, Horner, Damian
• Application Number:
  US11/144,364
• Publication Number:
  US 20060277080A1
• Time in Patent Office: Days
• US Class Current: 705/7
• CPC Class Codes: G06Q 10/04 Forecasting or optimisation specially adapted for administrative or management purposes, e.g. linear programming or "cutting stock problem" market predictions or forecasting for commercial activities G06Q30/0202
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/0637 Strategic management or analysis, e.g. setting a goal or target of an organisation; Planning actions based on goals; Analysis or evaluation of effectiveness of goals
• CPC Class Codes: G06Q 40/08 Insurance

Abstract

A method and system for automatically testing information technology control. The method includes automatically accessing a plurality of data results pertinent to a plurality of process-based leading indicators and a plurality of symptomatic lagging indicators, wherein the plurality of process-based leading indicators is correlated with the plurality of symptomatic lagging indicators. In addition, the method includes automatically aggregating at least a portion of the plurality of data results into at least one process control indicator for providing an overview picture of the IT control and the emerging risk for at least one process control area.

Claims

1. A method for automatically testing information technology control, said method comprising:

automatically accessing a plurality of data results pertinent to a plurality of process-based leading indicators and a plurality of symptomatic lagging indicators, wherein said plurality of process-based leading indicators is correlated with said plurality of symptomatic lagging indicators; and

automatically aggregating at least a portion of said plurality of data results into at least one process control indicator for providing an overview picture of said IT control and said emerging risk for at least one process control area.

2. The method as recited in claim 1 further comprising:

storing in a database, where relevant, a threshold value for said data pertinent to each of said plurality of process-based leading indicators and said plurality of symptomatic lagging indicators, said threshold value indicating a level for potentially imminent risk;

trending said data;

predicting a future status of said data based on an extrapolation of said trending; and

generating an alert message when said data attains a predetermined value relative to said threshold value.

3. The method as recited in claim 1 wherein said process control area includes control areas selected from the group consisting of:

availability management, information security management, incidental management, change management, configuration management and release management.

4. The method as recited in claim 1 further comprising:

continuously updating said aggregating of said at least a portion of said plurality of data results into said at least one process control indicator for providing a continuously updated overview picture of said IT control and said emerging risk for said at least one process control area.

5. The method as recited in claim 1 further comprising:

establishing a key control indicator (KCI) as a threshold metric, said KCI threshold crossed when a deficiency within said at least one process control area is present.

6. The method as recited in claim 5 further comprising:

storing said KCI for said at least one process control area for historical reporting.

7. The method as recited in claim 1 further comprising:

establishing a key risk indicator (KRI) as a threshold metric, said KRI threshold crossed when an emerging material risk to said at least one process control area is realized.

8. The method as recited in claim 7 further comprising:

storing said KRI for said at least one process control area for historical reporting.

9. An automatic process control area tracker for tracking information technology (IT) control and emerging risk comprising:

a database accessor for automatically accessing a database comprising a plurality of data results pertinent to a plurality of process-based leading indicators and a plurality of symptomatic lagging indicators, wherein said plurality of process-based leading indicators is correlated with said plurality of symptomatic lagging indicators; and

an aggregator for automatically aggregating at least a portion of said plurality of data results into at least one process control indicator for providing an overview picture of said IT control and said emerging risk for at least one process control area.

10. The automatic process control area tracker of claim 9 further comprising:

storing in a database, where relevant, a threshold value for said data pertinent to each of said plurality of process-based leading indicators and said plurality of symptomatic lagging indicators, said threshold value indicating a level for potentially imminent risk;

trending said data;

predicting a future status of said data based on an extrapolation of said trending; and

generating an alert message when said data attains a predetermined value relative to said threshold value.

11. The automatic process control area tracker of claim 9 wherein said process control area includes control areas selected from the group consisting of:

availability management, information security management, incidental management, change management, configuration management and release management.

12. The automatic process control area tracker of claim 9 further comprising:

continuously updating said aggregating of said at least a portion of said plurality of data results into said at least one process control indicator for providing a continuously updated overview picture of said IT control and said emerging risk for said at least one process control area.

13. The automatic process control area tracker of claim 9 further comprising:

establishing a key control indicator (KCI) as a threshold metric, said KCI threshold crossed when a deficiency within said at least one process control area is present.

14. The automatic process control area tracker of claim 13 further comprising:

storing said KCI for said at least one process control area for historical reporting.

15. The automatic process control area tracker of claim 9 further comprising:

establishing a key risk indicator (KRI) as a threshold metric, said KRI threshold crossed when an emerging material risk to said at least one process control area is realized.

16. The automatic process control area tracker of claim 15 further comprising:

storing said KRI for said at least one process control area for historical reporting.

17. A computer-usable medium having computer-readable code embodied therein for causing a computer system to perform a method for automatically testing information technology (IT) control and emerging risk of at least one process control area in a system, comprising:

automatically accessing a plurality of data results pertinent to a plurality of process-based leading indicators and a plurality of symptomatic lagging indicators, wherein said plurality of process-based leading indicators is correlated with said plurality of symptomatic lagging indicators; and

automatically aggregating at least a portion of said plurality of data results into at least one process control indicator for providing an overview picture of said IT control and said emerging risk for at least one process control area.

18. The computer-usable medium of claim 17 further comprising:

storing in a database, where relevant, a threshold value for said data pertinent to each of said plurality of process-based leading indicators and said plurality of symptomatic lagging indicators, said threshold value indicating a level for potentially imminent risk;

trending said data;

predicting a future status of said data based on an extrapolation of said trending; and

generating an alert message when said data attains a predetermined value relative to said threshold value.

19. The computer-usable medium of claim 17 wherein said process control area includes control areas selected from the group consisting of:

availability management, information security management, incidental management, change management, configuration management and release management.

20. The computer-usable medium of claim 17 further comprising:

continuously updating said aggregating of said at least a portion of said plurality of data results into said at least one process control indicator for providing a continuously updated overview picture of said IT control and said emerging risk for said at least one process control area.

21. The computer-usable medium of claim 17 further comprising:

establishing a key control indicator (KCI) as a threshold metric, said KCI threshold crossed when a deficiency within said at least one process control area is present.

22. The computer-usable medium of claim 21 further comprising:

storing said KCI for said at least one process control area for historical reporting.

23. The computer-usable medium of claim 17 further comprising:

establishing a key risk indicator (KRI) as a threshold metric, said KRI threshold crossed when an emerging material risk to said at least one process control area is realized.

24. The computer-usable medium of claim 23 further comprising:

storing said KRI for said at least one process control area for historical reporting.

25. A method for automatically testing information technology control, said method comprising:

selecting means for automatically selecting a plurality of data results pertinent to a plurality of process-based leading indicators and a plurality of symptomatic lagging indicators, wherein said plurality of process-based leading indicators is correlated with said plurality of symptomatic lagging indicators; and

a combining means for automatically combining at least a portion of said plurality of data results into at least one process control area having a means for providing an overview picture of said IT control for at least one process control area.