Methods and systems of assessing and managing information security risks in a computer system

1. A computerized method useful for assessing and managing information security risks in a computer system comprising:

receiving a customer security assessment, wherein the customer security assessment comprises a set of digitally answered questions answer by an information technology security expert in an entity, and wherein the set of digital answered questions comprises a set of MaxDiff or Choice-Based Conjoint questions;

obtaining a set of already-answered security assessment questions, wherein the set of already-answered security assessment questions comprises a set of security assessments from other vendors that have been answered in the past;

determining a relative rank between a question in the customer security assessment and the set of already-answered security assessment questions;

applying one or more machine learning methods to generate a strength of one or more similarities scores, wherein the one or more similarity scores map a set of already-answered security assessment questions with another set of questions in a customer security assessment;

automatically populating one or more direct mappings between the set of already-answered security assessment questions with the other set of questions in a customer security assessment;

using the strength of the one or more similarities scores to set a baseline for the score that can evolve over time via a set of overrides;

setting the baseline score for the one or more direct mappings to already-answered security assessment questions to a set of answered questions in the customer security assessment by using the strength of one or more similarities scores;

ranking the one or more direct mappings according to a set of baseline scores; and

based on the ranking, automatically populating one or more non-direct mappings between the set of already-answered security assessment questions with the other set of questions in a customer security assessment.

2. The computerized method of claim 1 further comprising the step of:

following up with a survey to determine a relative rank between a question and other similar already answered questions in the customer security assessment.

3. A computer system useful for assessing and managing information security risks in a computer system comprising:

a processor;

a memory containing instructions when executed on the processor, causes the processor to perform operations that:

receive a customer security assessment, wherein the customer security assessment comprises a set of digitally answered questions answer by an information technology security expert in an entity, and wherein the set of digital answered questions comprises a set of MaxDiff or Choice-Based Conjoint questions;

obtain a set of already-answered security assessment questions, wherein the set of already-answered security assessment questions comprises a set of security assessments from other vendors that have been answered in the past;

determine a relative rank between a question in the customer security assessment and the set of already-answered security assessment questions;

apply one or more machine learning methods to generate a strength of one or more similarities scores, wherein the one or more similarity scores map a set of already-answered security assessment questions with another set of questions in a customer security assessment;

automatically populate one or more direct mappings between the set of already-answered security assessment questions with the other set of questions in a customer security assessment;

use the strength of the one or more similarities scores to set a baseline for the score that can evolve over time via a set of overrides;

set a baseline score for the one or more direct mappings to already-answered security assessment questions to a set of answered questions in the customer security assessment by using the strength of one or more similarities scores;

rank the one or more direct mappings according to a set of baseline scores; and

based on the ranking, automatically populate one or more non-direct mappings between the set of already-answered security assessment questions with the other set of questions in a customer security assessment.

4. The computerized system of claim 3 , wherein the memory containing instructions when executed on the processor, causes the processor to perform operations that:

following up with a survey to determine a relative rank between a question and other similar already answered questions in the customer security assessment.