IP Library Granted Patent US 11,488,085
Granted Patent B2
US 11,488,085 · App. 17/679,715 · Granted Nov 1, 2022

Questionnaire response automation for compliance management

Inventors: Jonathan Blake Brannon (Smyrna, GA); Andrew Clearwater (Brunswick, ME); Brian Philbrook (Atlanta, GA); Trey Hecht (Atlanta, GA); Wesley Johnson (Atlanta, GA); Nicholas Ian Pavlichek (Atlanta, GA); Rajanandini Chennur (Atlanta, GA)
Assignee: OneTrust, LLC
G06Q10/0635G06F15/76G06F21/552G06F21/577G06F21/6245G06Q10/067G06F16/95
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 11,488,085
App. No.
17/679,715
Granted
Nov 1, 2022
Kind
B2
Abstract

Data processing systems and methods, according to various embodiments, are adapted for mapping various questions regarding a data breach from a master questionnaire to a plurality of territory-specific data breach disclosure questionnaires. The answers to the questions in the master questionnaire are used to populate the territory-specific data breach disclosure questionnaires and determine whether disclosure is required in territory. The system can automatically notify the appropriate regulatory bodies for each territory where it is determined that data breach disclosure is required.

Claims (75)

1. A method comprising:

generating a master readiness questionnaire comprising questions;

detecting, on a graphical user interface, a user selection of a first attribute impacting operations of an entity;

responsive to detecting the user selection of the first attribute impacting operations of the entity:

determining, by computing hardware, a first set of regulations or standards based on the first attribute impacting operations of the entity, wherein the first set of regulations or standards is associated with one or more environmental, social, and governance (ESG) frameworks; and

generating, by the computing hardware, a first readiness questionnaire based on the first set of regulations or standards, the first readiness questionnaire comprising questions;

detecting, on the graphical user interface, a user selection of a second attribute impacting operations of the entity;

responsive to detecting the user selection of the second attribute impacting operations of the entity:

determining, by the computing hardware, a second set of regulations or standards based on the second attribute impacting the operations of the entity; and

generating, by the computing hardware, a second readiness questionnaire based on the second set of regulations or standards, the second readiness questionnaire comprises questions;

generating, by the computing hardware, an ontology mapping a first question of the master readiness questionnaire to a first question of the first readiness questionnaire for the first set of regulations or standards and to a first question of the second readiness questionnaire for the second set of regulations or standards, wherein the first question of the master readiness questionnaire solicits information regarding organization policies;

receiving a request to determine an extent of adherence to the first set of regulations or standards;

responsive to receiving the request, generating a prompt to a user requesting an answer to the first question of the master readiness questionnaire;

receiving input from the user indicating the answer to the first question of the master readiness questionnaire;

accessing the ontology;

populating, by the computing hardware, the first question of the first readiness questionnaire for the first set of regulations or standards with the answer to the first question of the master readiness questionnaire using the ontology;

determining, by the computing hardware and based on the answer to the first question of the master readiness questionnaire, the extent of adherence to the first set of regulations or standards, wherein determining the extent of adherence with the first set of regulations or standards comprises determining, based on the answer to the first question from the first readiness questionnaire, that a control from a first set of controls required by the first set of regulations or standards has been implemented;

automatically generating, by the computing hardware, a notification of the extent of adherence to the first set of regulations or standards;

populating, by the computing hardware, the first question of the second readiness questionnaire for the second set of regulations or standards with the answer to the first question of the master readiness questionnaire using the ontology;

determining, by the computing hardware and based on the answer to the first question of the master readiness questionnaire, an extent of adherence to the second set of regulations or standards; and

automatically generating, by the computing hardware, a notification of the extent of adherence to the second set of regulations or standards.

2. The method of claim 1 , wherein determining the extent of adherence with the first set of regulations or standards comprises determining a percentage of answers to the questions in the first readiness questionnaire for the first set of regulations or standards that correspond to adherence answers.

3. The method of claim 1 , wherein the notification of the extent of adherence with the first set of regulations or standards comprises an indication of a percentage of adherence with the first set of regulations or standards.

4. The method of claim 1 , wherein the indication of the extent of adherence with the first set of regulations or standards comprises a percentage of readiness to comply with the first set of regulations or standards.

5. A system comprising:

a non-transitory computer-readable medium storing instructions; and

a processing device communicatively coupled to the non-transitory computer-readable medium,

wherein, the processing device is configured to execute the instructions and thereby perform operations comprising:

generating a graphical user interface based on a master readiness questionnaire for a first set of regulations or standards and a second set of regulations or standards applicable to operations performed by an entity, wherein:

the first set of regulations or standards is associated with one or more environmental, social, and governance (ESG) frameworks; and

generating the graphical user interface comprises:

configuring a first prompt for requesting a first answer to a first master question of the master readiness questionnaire, and

configuring a second prompt for requesting a second answer to a second master question of the master readiness questionnaire;

providing the graphical user interface for display, wherein displaying the graphical user interface involves providing the first prompt requesting the first answer to the first master question and providing the second prompt requesting the second answer to the second master question;

receiving the first answer and the second answer;

accessing an ontology that maps a data structure to the first set of regulations or standards and the second set of regulations or standards, wherein the data structure is configured to be populated via the master readiness questionnaire;

updating a first element of the data structure for the entity with the first answer, wherein the ontology maps the first element to a first regulation or standard of the first set of regulations or standards and a first regulation or standard of the second set of regulations or standards;

updating a second element of the data structure for the entity with the second answer, wherein the ontology maps the second element to a second regulation or standard of the first set of regulations or standards and a second regulation or standard of the second set of regulations or standards;

determining a first adherence with the first set of regulations or standards based on the first element of the data structure that has been updated with the first answer and the second element of the data structure that has been updated with the second answer;

determining a second adherence with the second set of regulations or standards based on the first element of the data structure that has been updated with the first answer, the second element of the data structure that has been updated with the second answer;

updating the graphical user interface to present a first indication of the first adherence and a second indication of the second adherence;

receiving supporting data associated with the first answer; and

determining a confidence level for the first answer based on a source of the supporting data, wherein:

the supporting data substantiates the first answer,

the confidence level for the first answer represents a confidence that the entity adheres with at least one of the first regulation or standard of the first set of regulations or standards or the first regulation or standard of the second set of regulations or standards, and

at least one of the first adherence or the second adherence is determined based on the confidence level for the first answer.

6. The system of claim 5 , wherein the first adherence comprises a first percentage of adherence with the first set of regulations or standards and the second adherence comprises a second percentage of adherence with the second set of regulations or standards.

7. The system of claim 5 , wherein the graphical user interface is configured with a list of sets of regulations or standards and the operations further comprises:

receiving a first indication of a selection of the first set of regulations or standards from the list of sets of regulations or standards; and

receiving a second indication of a selection of the second set of regulations or standards from the list of sets of regulations or standards.

8. The system of claim 5 , wherein the supporting data comprises at least one of unsubstantiated data provided by the entity, substantiated data based on a remote interview with the entity, or substantiated data based on an audit of the entity.

9. A non-transitory computer-readable medium having program code that is stored thereon, the program code executable by one or more processing devices for performing operations comprising:

generating a master readiness questionnaire comprising questions;

receiving a first indication of a user selection, on a graphical user interface, of a first attribute impacting operations of an entity;

responsive to receiving the first indication:

determining a first set of regulations or standards based on the first attribute impacting the operations of the entity, wherein the first set of regulations or standards is associated with one or more environmental, social, and governance (ESG) frameworks; and

generating a first readiness questionnaire based on the first set of regulations or standards, the first readiness questionnaire comprising questions;

receiving a second indication of a user selection, on the graphical user interface, of a second attribute impacting the operations of the entity;

responsive to receiving the second indication:

determining a second set of regulations or standards based on the second attribute impacting the operations of the entity; and

generating a second readiness questionnaire based on the second set of regulations or standards, the second readiness questionnaire comprises questions;

generating an ontology mapping a first question of the master readiness questionnaire to a first question of the first readiness questionnaire for the first set of regulations or standards and to a first question of the second readiness questionnaire for the second set of regulations or standards wherein the first question of the master readiness questionnaire solicits information regarding organization policies;

receiving a request to determine an extent of adherence to the first set of regulations or standards;

responsive to receiving the request, generating a prompt to a user requesting an answer to the first question of the master readiness questionnaire;

receiving input from the user indicating the answer to the first question of the master readiness questionnaire;

accessing the ontology;

populating the first question of the first readiness questionnaire for the first set of regulations or standards with the answer to the first question of the master readiness questionnaire using the ontology;

determining, based on the answer to the first question of the master readiness questionnaire, the extent of adherence to the first set of regulations or standards by determining, based on the answer to the first question from the first readiness questionnaire, that a control from a first set of controls required by the first set of regulations or standards has been implemented; and

automatically generating a notification of the extent of adherence.

10. The non-transitory computer-readable medium of claim 9 , wherein the operations further comprise:

populating the first question of the second readiness questionnaire for the second set of regulations or standards with the answer to the first question of the master readiness questionnaire using the ontology;

determining, based on the answer to the first question of the master readiness questionnaire, an extent of adherence to the second set of regulations or standards; and

automatically generating a notification of the extent of adherence to the second set of regulations or standards.

11. The non-transitory computer-readable medium of claim 9 , wherein determining the extent of adherence with the first set of regulations or standards comprises determining a percentage of answers to the questions in the first readiness questionnaire for the first set of regulations or standards that correspond to adherence answers.

12. The non-transitory computer-readable medium of claim 9 , wherein the notification of the extent of adherence with the first set of regulations or standards comprises a percentage of readiness to comply with the first set of regulations or standards.

Assignments (3)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Apr 26, 2024
From: PATEL, AAKASH; SHETH, HARDIK; THIELOVÁ, LINDA; SHAH, MILAP; VISWANATHAN, SUBRAMANIAN
To: ONETRUST, LLC
Reel/Frame 067238/0588 →
SECURITY INTEREST Recorded Jul 5, 2022
From: ONETRUST LLC
To: KEYBANK NATIONAL ASSOCIATION, AS ADMINISTRATIVE AGENT
Reel/Frame 060573/0001 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Feb 24, 2022
From: BRANNON, JONATHAN BLAKE; CLEARWATER, ANDREW; PHILBROOK, BRIAN; HECHT, TREY; JOHNSON, WESLEY; PAVLICHEK, NICHOLAS IAN; CHENNUR, RAJANANDINI
To: ONETRUST, LLC
Reel/Frame 059092/0704 →