Data processing and scanning systems for assessing vendor risk
Data processing systems and methods, according to various embodiments, are adapted for automatically assessing the level of security and/or privacy risk associated with doing business with a particular vendor or other entity and for generating training material for such vendors. In various embodiments, the systems may automatically obtain and use any suitable information to assess such risk levels including, for example: (1) any security and/or privacy certifications held by the vendor; (2) the terms of one or more contracts between a particular entity and the vendor; (3) the results of one or more privacy impact assessments for the vendor; and/or (4) any other suitable data. The system may be configured to automatically approve or reject a particular vendor based on the assessed risk level associated with the vendor and this information may be automatically communicated to an entity considering doing business with the vendor and/or the vendor itself.
1. A computer-implemented method for determining vendor privacy standard compliance, the method comprising:
receiving, by one or more computer processors, an indication of a first privacy standard and a second privacy standard, wherein the first privacy standard and the second privacy standard are applicable to a particular vendor;
generating, by the one or more computer processors, a compliance questionnaire comprising a plurality of questions, wherein the plurality of questions is included in the compliance questionnaire based on an ontology comprising a mapping of data controls required for compliance with the first privacy standard to the plurality of questions and data controls for compliance with the second privacy standard to the plurality of questions;
providing, by the one or more computer processors, the compliance questionnaire for display to a user on a graphical user interface via a user device;
receiving, by the one or more computer processors, vendor information associated with the particular vendor and originating from the user, the vendor information comprising a response to each of the plurality of questions in the compliance questionnaire;
generating, by the one or more computer processors, a first compliance determination for the first privacy standard based on the response to each of the plurality of questions mapped in the ontology for the data controls required for compliance with the first privacy standard, wherein the first compliance determination indicates an extent the particular vendor is in compliance with the first privacy standard;
generating, by the one or more computer processors, a second compliance determination for the second privacy standard based on the response to each of the plurality of questions mapped in the ontology for the data controls required for compliance with the second privacy standard, wherein the second compliance determination indicates an extent the particular vendor is in compliance with the second privacy standard; and
providing, by the one or more computer processors, the first compliance determination and the second compliance determination for display to the user on the graphical user interface via the user device.
2. The computer-implemented method of claim 1 , wherein the one or more data controls required for compliance with the first privacy standard and the one or more data controls required for compliance with the second privacy standard comprises at least one of controls to access sensitive data, controls on modification of sensitive data, or controls on storing of sensitive data.
3. The computer-implemented method of claim 1 further comprising:
receiving, by the one or more computer processors, data associated with the response provided for at least one of the plurality of questions and originating from the user; and
generating, by the one or more computer processors, a confidence level for the response to the at least one of the plurality of questions based at least in part on the data, wherein:
the data substantiates the response provided for the at least one of the plurality of questions,
the confidence level for the response provided for the at least one of the plurality of questions represents a confidence the particular vendor is in compliance with a data control in the one or more data controls required for compliance with the first privacy standard, and
the first compliance determination is generated based at least in part on the confidence level for the response provided for the at least one of the plurality of questions.
4. The computer-implemented method of claim 1 , wherein generating the compliance questionnaire is performed using at least one of pattern matching or a machine learning technique to identify the plurality of questions to include in the compliance questionnaire.
5. The computer-implemented method of claim 1 further comprising customizing, by the one or more processors, the plurality of questions so that each of the plurality of questions can be presented in a natural language form.
6. The computer-implemented method of claim 1 further comprising:
generating a first confidence score, by the one or more computer processors, for the first compliance determination; and
generating a second confidence score, by the one or more computer processors, for the second compliance determination, wherein the first confidence score and the second confidence score are provided for display on the graphical user interface to the user.
7. A vendor compliance system comprising:
one or more computer processors; and
computer memory including computer-executable instructions configured to, when executed by the one or more computer processors, cause the system to at least:
receive an indication of a particular vendor;
receive an indication of a selection of a first user-selectable control displayed on a graphical user interface, wherein the first user-selectable control identifies a first privacy standard applicable to the particular vendor;
receive an indication of a selection of a second user-selectable control displayed on the graphical user interface, wherein the second user-selectable control identifies a second privacy standard applicable to the particular vendor;
generate a compliance questionnaire comprising a plurality of questions, wherein the plurality of questions is included in the compliance questionnaire based on an ontology comprising a mapping of data controls required for compliance with the first privacy standard to the plurality of questions and data controls for compliance with the second privacy standard to the plurality of questions;
provide the compliance questionnaire for display to a user;
receive a response to each of the plurality of questions originating from the user;
generate a first compliance determination for the first privacy standard based on the response to each of the plurality of questions mapped in the ontology for the data controls required for compliance with the first privacy standard, wherein the first compliance determination indicates an extent the particular vendor is in compliance with the first privacy standard;
generate a second compliance determination for the second privacy standard based on the response to each of the plurality of questions mapped in the ontology for the data controls required for compliance with the second privacy standard, wherein the second compliance determination indicates an extent the particular vendor is in compliance with the second privacy standard; and
provide the first compliance determination and the second compliance determination for display to the user.
8. The vendor compliance system of claim 7 , wherein the one or more data controls required for compliance with the first privacy standard and the one or more data controls required for compliance with the second privacy standard comprises at least one of controls to access sensitive data, controls on modification of sensitive data, or controls on storing of sensitive data.
9. The vendor compliance system of claim 7 , wherein the computer-executable instructions are configured to, when executed by the one or more computer processors, cause the system to at least:
receive data associated with the response provided for at least one of the plurality of questions and originating from the user; and
generate a confidence level for the response to the at least one of the plurality of questions based at least in part on the data, wherein:
the data substantiates the response provided for the at least one of the plurality of questions,
the confidence level for the response provided for the at least one of the plurality of questions represents a confidence the particular vendor is in compliance with a data control in the one or more data controls required for compliance with the first privacy standard, and
the first compliance determination is generated based at least in part on the confidence level for the response provided for the at least one of the plurality of questions.
10. The vendor compliance system of claim 7 , wherein the computer-executable instructions are configured to, when executed by the one or more computer processors, cause the system to at least generate the compliance questionnaire by performing at least one of pattern matching or a machine learning technique to identify the plurality of questions to include in the compliance questionnaire.
11. The vendor compliance system of claim 7 , wherein the computer-executable instructions are configured to, when executed by the one or more computer processors, cause the system to at least customize the plurality of questions so that each of the plurality of questions can be presented in a natural language form.
12. The vendor compliance system of claim 7 , wherein the computer-executable instructions are configured to, when executed by the one or more computer processors, cause the system to at least:
generate a first confidence score for the first compliance determination; and
generate a second confidence score for the second compliance determination, wherein the first confidence score and the second confidence score are provided for display on the graphical user interface to the user.
13. A non-transitory computer-readable medium storing computer-executable instructions for determining vendor privacy standard compliance, the computer-executable instructions configured to, when executed by one or more computer processors, cause the one or more computer processors to:
receive an indication of a first privacy standard and a second privacy standard, wherein the first privacy standard and the second privacy standard are applicable to a particular vendor;
generate a compliance questionnaire comprising a plurality of questions, wherein the plurality of questions is included in the compliance questionnaire based on an ontology comprising a mapping of data controls required for compliance with the first privacy standard to the plurality of questions and data controls for compliance with the second privacy standard to the plurality of questions;
receive vendor information associated with the particular vendor, the vendor information comprising a response to each of the plurality of questions in the compliance questionnaire;
generate a first compliance determination for the first privacy standard based on the response to each of the plurality of questions mapped in the ontology for the data controls required for compliance with the first privacy standard, wherein the first compliance determination indicates an extent the particular vendor is in compliance with the first privacy standard;
generate a second compliance determination for the second privacy standard based on the response to each of the plurality of questions mapped in the ontology for the data controls required for compliance with the second privacy standard, wherein the second compliance determination indicates an extent the particular vendor is in compliance with the second privacy standard; and
provide the first compliance determination and the second compliance determination for display to a user on a graphical user interface.
14. The non-transitory computer-readable medium of claim 13 , wherein the one or more data controls required for compliance with the first privacy standard and the one or more data controls required for compliance with the second privacy standard comprises at least one of controls to access sensitive data, controls on modification of sensitive data, or controls on storing of sensitive data.
15. The non-transitory computer-readable medium of claim 13 , wherein the computer-executable instructions configured to, when executed by the one or more computer processors, cause the one or more computer processors to:
receive data associated with the response provided for at least one of the plurality of questions and originating from the user; and
generate a confidence level for the response to the at least one of the plurality of questions based at least in part on the data, wherein:
the data substantiates the response provided for the at least one of the plurality of questions,
the confidence level for the response provided for the at least one of the plurality of questions represents a confidence the particular vendor is in compliance with a data control in the one or more data controls required for compliance with the first privacy standard, and
the first compliance determination is generated based at least in part on the confidence level for the response provided for the at least one of the plurality of questions.
16. The non-transitory computer-readable medium of claim 13 , wherein the computer-executable instructions configured to, when executed by the one or more computer processors, cause the one or more computer processors to generate the compliance questionnaire by performing at least one of pattern matching or a machine learning technique to identify the plurality of questions to include in the compliance questionnaire.
17. The non-transitory computer-readable medium of claim 13 , wherein the computer-executable instructions configured to, when executed by the one or more computer processors, cause the one or more computer processors to customize the plurality of questions so that each of the plurality of questions can be presented in a natural language form.
18. The non-transitory computer-readable medium of claim 13 , wherein the computer-executable instructions configured to, when executed by the one or more computer processors, cause the one or more computer processors to:
generate a first confidence score for the first compliance determination; and
generate a second confidence score for the second compliance determination, wherein the first confidence score and the second confidence score are provided for display on the graphical user interface to the user.
19. A vendor compliance system comprising:
vendor information receiving means for receiving a first privacy standard and a second privacy standard originating, wherein the first privacy standard and the second privacy standard are applicable to a particular vendor;
questionnaire generating means for:
generating a compliance questionnaire comprising a plurality of questions, wherein the plurality of questions is included in the compliance questionnaire based on an ontology comprising a mapping of data controls required for compliance with the first privacy standard to the plurality of questions and data controls for compliance with the second privacy standard to the plurality of questions; and
receiving vendor information associated with the particular vendor, the vendor information comprising a response to each of plurality of questions in the compliance assessment questionnaire;
compliance determination means for:
generating a first compliance determination for the first privacy standard based on the response to each of the plurality of questions mapped in the ontology for the data controls required for compliance with the first privacy standard, wherein the first compliance determination indicates an extent the particular vendor is in compliance with the first privacy standard; and
generating a second compliance determination for the second privacy standard based on the response to each of the plurality of questions mapped in the ontology for the data controls required for compliance with the second privacy standard, wherein the second compliance determination indicates an extent the particular vendor is in compliance with the second privacy standard; and
presentation means for providing the first compliance determination and the second compliance determination to display to a user on a graphical user interface.