Compliance as a service for an organization
The present disclosure relates to system(s) and method(s) to provide compliance as a service for one or more organization. The system further facilitates identifying one or more causes involved to provide compliance as a service by analyzing compliance documents. The system and method also provides conversion of clauses into appropriate controls. The system and method also assists in defining control that can perform a specific task on a system. The system and method further provides mapping of compliance using control.
1. A method to determine a compliance of a target system, the method comprising:
parsing a compliance document to determine a set of clauses present in the compliance document, wherein the set of clauses are classified into:
a simple clause, wherein only a compulsory pattern is checked to identify the compliance of the target system with respect to the simple clause;
a complex clause, wherein the compulsory pattern and an optional pattern are checked to identify the compliance of the target system with respect to the complex clause;
a citation specific clause, wherein a specified pattern is checked in specific citation to identify the compliance of the target system with respect to the citation specific clause; and
a composite clause, wherein pre-requisites are checked in a citation to check the compliance of the target system with respect the composite clause;
identifying a plurality of attributes associated with each clause, wherein the plurality of attributes comprises the compulsory pattern, the optional pattern, the citation, a control pre-requisite, a risk level, a control type and a profile applicability;
generating first set controls from the set of clauses based upon the plurality of attributes;
remotely analyzing the target system to identify a second set of controls applicable to the target system based on an element associated with the target system, wherein the second set of controls is a subset of the first set of controls;
calibrating the second set of controls based on a) a profile associated with the element, wherein the profile associated with the element comprise information associated with security, element management, logs, version, path management, authentication and authorization and b) a set of industrial standards applicable to the profile;
comparing a configuration of the target system with the second set of controls so calibrated to determine the compliance of the target system; and
generating a compliance report of the target system based upon the comparison of the configuration of the target system with the second set of controls.
2. The method of claim 1 , wherein the target system and the compliance document are associated with a domain of information technology.
3. The method of claim 1 , wherein the control is modelled as a standard template, wherein the standard template stores at least one attribute captures from the clause.
4. The method of claim 1 , wherein the set of industrial standards associated with the profile is identified from the compliance document.
5. The method of claim 1 , wherein the element is at least one of a network layer, an operating system, a database, a middleware's, and an applications layer.
6. The method of claim 1 , wherein the profile associated with the element is based on a role of the element performed in the target system.
7. The method of claim 1 , wherein the citation is further classified as a citation start and a citation end, wherein the citation start and the citation end define a boundary for checking the compulsory pattern and the optional pattern based upon the configuration of the target system.
8. A system to determine a compliance of a target system, the system comprising:
a memory and a processor coupled to the memory, wherein the processor is configured to perform the steps of:
parsing a compliance document to determine a set of clauses present in the compliance document, wherein the set of clauses are classified into:
a simple clause, wherein only a compulsory pattern is checked to identify the compliance of the target system with respect to the simple clause;
a complex clause, wherein the compulsory pattern and an optional pattern are checked to identify the compliance of the target system with respect to the complex clause;
a citation specific clause, wherein a specified pattern is checked in specific citation to identify the compliance of the target system with respect to the citation specific clause; and
a composite clause, wherein pre-requisites are checked in a citation to check the compliance of the target system with respect the composite clause;
identifying a plurality of attributes associated with each clause, wherein the plurality of attributes comprises the compulsory pattern, the optional pattern, the citation, a control pre-requisite, a risk level, a control type and a profile applicability;
generating first set controls from the set of clauses based upon the plurality of attributes;
remotely analyzing the target system to identify a second set of controls applicable to the target system based on an element associated with the target system, wherein the second set of controls is a subset of the first set of controls;
calibrating the second set of controls based on a) a profile associated with the element, wherein the profile associated with the element comprise information associated with security, element management, logs, version, path management, authentication and authorization and b) a set of industrial standards applicable to the profile;
comparing a configuration of the target system with the second set of controls so calibrated to determine the compliance of the target system; and
generating a compliance report of the target system based upon the comparison of the configuration of the target system with the second set of controls.
9. The system of claim 8 , wherein the target system and the compliance document are associated with a domain of information technology.
10. The system of claim 8 , wherein the control is modelled as a standard template, wherein the standard template stores at least one attribute captures from the clause.
11. The system of claim 8 , wherein the set of industrial standards associated with the profile is identified from the compliance document.
12. The system of claim 8 , wherein the element is at least one of a network layer, an operating system, databases, a middleware's, and an applications layer.
13. The system of claim 8 , wherein the profile associated with the element is based on a role of the element performed in the target system.
14. The system of claim 8 , wherein the citation is further classified as a citation start and a citation end, wherein the citation start and the citation end define a boundary for checking the compulsory pattern and the optional pattern based upon the configuration of the target system.
15. A non-transitory computer readable medium embodying a program product having embodied thereon a computer program to determine executable in a computing device for determining a compliance of a target system, the computer program product comprising:
a program code for parsing a compliance document to determine a set of clauses present in the compliance document, wherein the set of clauses are classified into:
a simple clause, wherein only a compulsory pattern is checked to identify the compliance of the target system with respect to the simple clause;
a complex clause, wherein the compulsory pattern and an optional pattern are checked to identify the compliance of the target system with respect to the complex clause;
a citation specific clause, wherein a specified pattern is checked in specific citation to identify the compliance of the target system with respect to the citation specific clause; and
a composite clause, wherein pre-requisites are checked in a citation to check the compliance of the target system with respect the composite clause;
a program code for identifying a plurality of attributes associated with each clause, wherein the plurality of attributes comprises the compulsory pattern, the optional pattern, the citation, a control pre-requisite, a risk level, a control type and a profile applicability;
a program code for generating first set controls from the set of clauses based upon the plurality of attributes;
a program code for remotely analyzing the target system to identify a second set of controls applicable to the target system based on an element associated with the target system, wherein the second set of controls is a subset of the first set of controls;
a program code for calibrating the second set of controls based on a) a profile associated with the element, wherein the profile associated with the element comprise information associated with security, element management, logs, version, path management, authentication and authorization and b) a set of industrial standards applicable to the profile;
a program code for comparing a configuration of the target system with the second set of controls so calibrated to determine the compliance of the target system; and
a program code for generating a compliance report of the target system based upon the comparison of the configuration of the target system with the second set of controls.