Granted Patent B2

US 12,563,105 · App. 18/151,335 · Granted Feb 24, 2026

Inventors: Evan Bates (Atlanta, GA); Jason L Sabourin (Dewitt, MI); Kevin Jones (Atlanta, GA); Patrick Glenn Murray (Kula, HI); Carman Kwong (Coquitlam, CA)

Assignee: OneTrust LLC

H04L63/306G06Q10/06311G06Q10/063114G06Q30/0203H04L63/0414G06Q30/018

Abstract

Claims (81)

1 . A method comprising:

extracting, by at least one computer processor utilizing a data extraction software application integrated with a digital data repository to access the digital data repository, attribute values of a plurality of data objects representing functions or infrastructure associated with handling target data for an entity;

determining, by the at least one computer processor and from the digital data repository, a digital representation of a system requirements framework comprising a plurality of controls associated with handling specific data types;

determining, by the at least one computer processor and by comparing the attribute values of the plurality of data objects to system requirement attribute values indicated by a gap rules set associated with the system requirements framework, a plurality of configuration gaps representing a plurality of control actions for installing controls in connection with one or more data assets or one or more data processing operations to match the attribute values to the system requirement attribute values;

generating, by the at least one computer processor for display via a graphical user interface of a computing device associated with the entity, one or more tasks for applying one or more modifications to the one or more data assets or the one or more data processing operations according to the plurality of configuration gaps; and

generating, in response to one or more client device interactions with the one or more tasks via the graphical user interface in connection with applying the one or more modifications to the one or more data assets of the one or more data processing operations, an updated graphical user interface displaying modifications to the one or more tasks.

2 . The method of claim 1 , wherein extracting the attribute values of the plurality of data objects comprises:

integrating the data extraction software application with the digital data repository and a third-party system via an application programming interface associated with the one or more data assets or the one or more data processing operations; and

extracting, utilizing the data extraction software application, the attribute values of the plurality of data objects in response to a selected option to initiate a review of the plurality of controls of the system requirements framework.

3 . The method of claim 1 , further comprising:

determining that a subset of the attribute values of the plurality of data objects correspond to one or more evidence objects indicating that at least a portion of a control of the plurality of controls is installed in connection with the one or more data assets or the one or more data processing operations; and

determining, based on the one or more evidence objects, that the control is installed in connection with the one or more data assets or the one or more data processing operations.

4 . The method of claim 3 , further comprising:

determining that a particular evidence object of the one or more evidence objects corresponds to an additional control of the plurality of controls; and

determining, based on the particular evidence object, that the additional control is installed in connection with the one or more data assets or the one or more data processing operations.

5 . The method of claim 1 , further comprising generating, in response to a selected option to initiate a review of the plurality of controls of the system requirements framework, an initial compliance score based on a percentage of the plurality of controls installed in connection with the one or more data assets or the one or more data processing operations.

6 . The method of claim 1 , wherein determining the attribute values of the plurality of data objects comprises:

detecting a missing attribute value for a data object of the plurality of data objects;

generating, in response to detecting the missing attribute value, an assessment comprising a computer-implemented questionnaire including one or more electronic questions associated with the missing attribute value of the data object;

executing the assessment by providing the assessment for display at one or more client devices; and

determining the missing attribute value for the data object based on a response to the assessment from the one or more client devices.

7 . The method of claim 6 , wherein:

executing the assessment comprises:

determining a first response to a first question of the one or more electronic questions provided to the one or more client devices;

skipping, based on the first response, a second question of the one or more electronic questions;

providing, based on the first response, a third question of the one or more electronic questions to the one or more client devices;

determining a second response to the third question; and

determining the missing attribute value of the data object comprises determining the missing attribute value based on the first response or the second response.

8 . The method of claim 1 , wherein determining the plurality of configuration gaps comprises:

determining a gap rule of the gap rules set based on one or more control actions of the plurality of control actions for installing one or more controls in connection with the one or more data assets or the one or more data processing operations; and

determining a configuration gap by applying the gap rule to the attribute values of the plurality of data objects to determine whether the attribute values comply with the system requirements framework by comparing the attribute values of the plurality of data objects to the system requirement attribute values.

9 . The method of claim 1 , further comprising:

detecting a triggering event comprising a change to the digital representation of the system requirements framework or a change to an attribute value of a data object of the plurality of data objects by monitoring data sources corresponding to the plurality of data objects;

determining automatically, in response to the triggering event, whether the change to the digital representation of the system requirements framework or the change to the attribute value of the data object results in one or more additional configuration gaps; and

generating, for display on the graphical user interface, one or more additional tasks for applying the one or more modifications to the one or more data assets or the one or more data processing operations according to the one or more additional configuration gaps.

10 . The method of claim 1 , wherein determining the plurality of configuration gaps comprises performing a plurality of iterations to process the plurality of data objects in connection with the system requirements framework, wherein an iteration of the plurality of iterations comprises:

determining a set of attribute values of a data object of the plurality of data objects; and

determining a configuration gap in response to determining that the data object does not comply with the system requirements framework based on the set of attribute values of the data object and the gap rules set.

11 . A non-transitory computer readable medium comprising instructions that, when executed by at least one processor, cause the at least one processor to:

extract, by utilizing a data extraction software application integrated with a digital data repository to access the digital data repository, attribute values of a plurality of data objects representing functions or infrastructure associated with handling target data for an entity;

determine, from the digital data repository, a digital representation of a system requirements framework comprising a plurality of controls associated with handling specific data types;

determine, by comparing the attribute values of the plurality of data objects to system requirement attribute values indicated by a gap rules set associated with the system requirements framework, a plurality of configuration gaps representing a plurality of control actions for installing controls in connection with one or more data assets or one or more data processing operations to match the attribute values to the system requirement attribute values;

generate, for display via a graphical user interface of a computing device associated with the entity, one or more tasks for applying one or more modifications to the one or more data assets or the one or more data processing operations according to the plurality of configuration gaps; and

track progress of the one or more tasks by monitoring changes to the one or more data assets or the one or more data processing operations in connection with the system requirements framework by generating, in response to one or more client device interactions with the one or more tasks via the graphical user interface in connection with applying the one or more modifications to the one or more data assets of the one or more data processing operations, an updated graphical user interface displaying modifications to the one or more tasks.

12 . The non-transitory computer readable medium of claim 11 , wherein the instructions that, when executed by the at least one processor, cause the at least one processor to determine the plurality of configuration gaps by:

determining a plurality of attribute values based on the gap rules set; and

determining the plurality of configuration gaps by comparing the attribute values of the plurality of data objects to the plurality of attribute values corresponding to the gap rules set.

13 . The non-transitory computer readable medium of claim 11 , wherein the instructions that, when executed by the at least one processor, cause the at least one processor to:

determine the attribute values of the plurality of data objects by:

integrate the data extraction software application with the digital data repository and a third-party computing system via an application programming interface associated with the one or more data assets or the one or more data processing operations; and

extracting, utilizing the data extraction software application, the attribute values of the plurality of data objects in response to a selected option to initiate a review of the plurality of controls of the system requirements framework; and

determine that a control of the plurality of controls is installed in connection with the one or more data assets or the one or more data processing operations in response to determining that a subset of the attribute values of the plurality of data objects correspond to one or more evidence objects associated with the control.

14 . A system comprising:

one or more non-transitory computer readable media comprising a digital data repository; and

at least one processor configured to cause the system to:

perform a plurality of iterations to process a plurality of data objects representing functions or infrastructure associated with handling target data for an entity by:

extracting, by utilizing a data extraction software application integrated with the digital data repository to access the digital data repository, attribute values of the plurality of data objects;

determining, from the digital data repository, a digital representation of a system requirements framework comprising a plurality of controls associated with handling specific data types; and

determining, by comparing the attribute values of the plurality of data objects to system requirement attribute values indicated by a gap rules set associated with the system requirements framework, a plurality of configuration gaps representing a plurality of control actions for installing controls in connection with one or more data assets or one or more data processing operations to match the attribute values to the system requirement attribute values;

determine one or more tasks associated with correcting the plurality of configuration gaps by matching the attribute values to the system requirement attribute values;

provide the one or more tasks for display via a graphical user interface of a computing device associated with the entity; and

generate, in response to one or more client device interactions with the one or more tasks via the graphical user interface in connection with applying one or more modifications to the one or more data assets of the one or more data processing operations in response to a client device interaction with the one or more tasks for display, an updated graphical user interface displaying modifications to the one or more tasks.

15 . The system of claim 14 , wherein the at least one processor is further configured to cause the system to extract the attribute values of the plurality of data objects in response to a selected option to initiate a review of the plurality of controls of the system requirements framework.

16 . The system of claim 14 , wherein the at least one processor is further configured to cause the system to:

detect, based on a subset of the attribute values of the plurality of data objects, a plurality of evidence objects corresponding to a control of the plurality of controls; and

determine, based on the plurality of evidence objects, that the control is installed in connection with the one or more data assets or the one or more data processing operations.

17 . The system of claim 14 , wherein the at least one processor is further configured to cause the system to:

generate, based on the gap rules set associated with the system requirements framework, an initial compliance score based on a percentage of the plurality of controls installed in connection with the one or more data assets or the one or more data processing operations; and

provide the initial compliance score with the one or more tasks for display via the graphical user interface of the computing device associated with the entity.

18 . The system of claim 14 , wherein the at least one processor is further configured to cause the system to determine the attribute values of the plurality of data objects by:

detecting, by the data extraction software application integrated with the digital data repository, a missing attribute value for a data object of the plurality of data objects;

generating, by an assessment software application in response to detecting the missing attribute value, an assessment comprising a computer-implemented questionnaire including one or more electronic questions associated with the missing attribute value of the data object;

executing the assessment by providing the assessment for display at a client device; and

determining the missing attribute value for the data object based on a response to the assessment from the client device.

19 . The system of claim 14 , wherein the at least one processor is further configured to cause the system to determine the plurality of configuration gaps by:

determining a gap rule corresponding to an attribute value for a data object of the plurality of data objects; and

determining a configuration gap by comparing one or more attribute values of the plurality of data objects to the gap rule.

20 . The system of claim 14 , wherein the at least one processor is further configured to cause the system to:

detect a triggering event comprising a change to the digital representation of the system requirements framework or a change to an attribute value of a data object of the plurality of data objects;

determine automatically a configuration gap in response to the triggering event; and

generate, for display on the graphical user interface, one or more tasks for applying the one or more modifications to the one or more data assets or the one or more data processing operations according to the configuration gap.

Assignments (1)

Continuity (6)

References Cited (109)