Granted Patent B2

US 12,641,108 · App. 18/275,910 · Granted May 26, 2026

Inventors: Subramanian Viswanathan (San Ramon, CA); Milap Shah (Bengaluru, IN)

Assignee: OneTrust, LLC

H04L63/1433G06F21/60

Abstract

Claims (66)

1 . A system comprising:

a server computing system comprising a non-transitory computer-readable medium storing instructions and processing hardware communicatively coupled to the non-transitory computer readable medium, wherein the processing hardware is configured to execute the instructions and thereby perform operations comprising:

accessing tenant computing system risk data for third party computing system functionality to be integrated with or invoked by a first party computing system, the tenant computing system risk data comprising risk data for each of a plurality of tenant computing systems that have previously integrated or invoked the third party computing system functionality;

identifying particular risks for integrating or invoking the third party computing system functionality based on the tenant computing system risk data, each of the particular risks having a respective normalized risk score for each tenant computing system of the plurality of tenant computing systems;

accessing tenant computing system control data for the particular risks identified for integrating or invoking the third party computing system functionality;

determining, based on the tenant computing system control data, a common control set implemented by the plurality of tenant computing systems to mitigate the particular risks for integrating or invoking the third party computing system functionality;

determining a mitigation weight of each control in the common control set based on the respective normalized risk score for each of the particular risks and the tenant computing system control data; and

processing the common control set and the mitigation weight using at least one of a rules-based model or a machine-learning model to generate a control recommendation, the control recommendation comprising at least one control from the common control set; and

the first party computing system communicatively coupled to the server computing system, wherein the first party computing system is configured to facilitate implementation of the at least one control identified by the control recommendation related to integrating the third party computing system functionality into the first party computing system or invocation of the third party computing system functionality by the first party computing system.

2 . The system of claim 1 , wherein the operations further comprise modifying the tenant computing system control data to include new control data for the first party computing system, the new control data indicating the at least one control identified by the control recommendation as a control implemented by the first party computing system for at least one of the particular risks.

3 . The system of claim 1 , wherein:

the operations further comprise determining a residual risk rating for each of the particular risks based on the respective normalized risk score for each of the particular risks and the mitigation weight of each control in the common control set; and

generating the control recommendation further comprises processing the residual risk rating using at least one of the rules-based model or the machine-learning model to generate the control recommendation.

4 . The system of claim 1 , wherein:

the operations further comprise determining a control mitigation score for the third party computing system functionality based on a respective tenant control mitigation score for each tenant computing system of the plurality of tenant computing systems; and

generating the control recommendation further comprises processing the control mitigation score for the third party computing system functionality using at least one of the rules-based model or the machine-learning model to generate the control recommendation.

5 . The system of claim 1 , wherein:

the tenant computing system control data defines:

for a first tenant computing system of the plurality of tenant computing systems:

a first risk, a first risk score for the first risk, a first control for the first risk, and a first control score for the first control; and

for a second tenant computing system of the plurality of tenant computing systems: a second risk, a second risk score for the second risk, a second control for the second risk, and a second control score for the second control;

determining the mitigation weight of each control in the common control set based on the respective normalized risk score for each of the particular risks and the tenant computing system control data comprises comparing the first risk score to the first control score and the second risk score to the second control score to determine a relative control mitigation score between the first control and the second control; and

processing the common control set and the mitigation weight using at least one of the rules-based model or the machine-learning model to generate the control recommendation comprises using the rules-based model to select the control recommendation from the first control or the second control based on the relative control mitigation score.

6 . The system of claim 1 , wherein:

processing the common control set and the mitigation weight comprises using the rules-based model to generate the control recommendation; and

the rules-based model comprises a set of rules that selects the control recommendation from the common control set based on at least one of a relative mitigation weight of each control in the common control set or a relative adoption rate of each control in the common control set.

7 . The system of claim 1 , wherein facilitating implementation of the at least one control identified by the control recommendation comprises at least one of facilitating modification of the third party computing system functionality or facilitating disabling of the third party computing system functionality.

8 . A method comprising:

identifying, by computing hardware providing a multi-tenant environment, functionality provided by a third party computing system to be integrated into or invoked by a first party computing system authorized to access a tenant of the multi-tenant environment;

identifying, by the computing hardware, particular risks for integrating or invoking the functionality provided by the third party computing system;

accessing, by the computing hardware, tenant computing system control data for the particular risks identified for integrating or invoking the functionality provided by the third party computing system, the tenant computing system control data comprising indicating controls implemented by a plurality of additional computing systems that are authorized to access additional tenants of the multi -tenant environment and that have previously integrated the functionality provided by the third party computing system;

determining, by the computing hardware, a respective normalized risk score for each of the particular risks for each additional computing system of the plurality of additional computing systems;

determining, by the computing hardware based on the tenant computing system control data, a common control set implemented by the plurality of additional computing systems to mitigate risks for integrating or invoking the functionality provided by the third party computing system;

determining, by the computing hardware, a mitigation weight of each control in the common control set based on the respective normalized risk score for each of the particular risks and the tenant computing system control data; and

causing, by the computing hardware, at least one of a rules-based model or a machine -learning model to process the common control set and the mitigation weight to generate a control recommendation, the control recommendation comprising at least one control from the common control set, wherein the at least one control identified by the control recommendation is implemented in relation to integrating the functionality provided by the third party computing system into the first party computing system or invoking the third party computing system functionality by the first party computing system.

9 . The method of claim 8 , wherein:

the method further comprises determining, by the computing hardware, a control mitigation score for the functionality provided by the third party computing system based on a respective tenant control mitigation score for each tenant computing system of the plurality of additional computing systems; and

generating the control recommendation further comprises processing the control mitigation score for the functionality provided by the third party computing system using at least one of the rules-based model or the machine-learning model to generate the control recommendation.

10 . The method of claim 8 , further comprising modifying the tenant computing system control data to include new control data for the first party computing system, the new control data indicating the control recommendation as a control implemented by the first party computing system for at least one of the particular risks.

11 . The method of claim 8 , wherein:

the method further comprises determining, by the computing hardware, a residual risk rating for each of the particular risks based on the respective normalized risk score for each of the particular risks and mitigation weight of each control in the common control set; and

generating the control recommendation further comprises processing the residual risk rating using at least one of the rules-based model or the machine-learning model to generate the control recommendation.

12 . The method of claim 8 , wherein the rules-based model comprises a set of rules that selects the control recommendation from the common control set based on a relative mitigation weight of each control in the common control set.

13 . The method of claim 8 , wherein implementation of the at least one control identified by the control recommendation comprises at least one of modification of the functionality provided by the third party computing system, disabling of the functionality provided by the third party computing system, or generating a user interface that includes the at least one control and providing the user interface for display on a user device.

14 . The method of claim 8 , further comprising modifying, by the computing hardware, the tenant computing system control data to include new control data, the new control data indicating the control recommendation as a control has been implemented by the first party computing system for at least one of the particular risks.

15 . A system comprising:

a non-transitory computer-readable medium storing instructions; and

processing hardware communicatively coupled to the non-transitory computer-readable medium;

wherein, the processing hardware is configured to execute the instructions and thereby perform operations comprising:

identifying functionality provided by a third party computing system that is to be integrated into or invoked by a first party computing system;

accessing tenant computing system risk data for the functionality provided by the third party computing system, the tenant computing system risk data comprising risk data indicating a first set of risks identified for a first tenant computing system and a second set of risks identified for a second tenant computing system that have previously integrated or invoked the functionality provided by the third party computing system;

accessing tenant computing system control data for the first set of risks and the second set of risks, the tenant computing system control data comprising a first set of controls for the first set of risks and a second set of controls for the second set of risks;

determining, based on the first set of risks and the second set of risks, a common control set implemented by the first tenant computing system and the second tenant computing system to mitigate the first set of risks and the second set of risks;

determining a mitigation weight of each control in the common control set based on a first risk score for the first set of risks, a second risk score for the second set of risks, and the tenant computing system control data;

processing the common control set and the mitigation weight of each control using a rules-based model to generate a control recommendation, the control recommendation comprising at least one control from the common control set; and

facilitating implementation of at least one control identified by the control recommendation related to integrating or invoking the functionality provided by the third party computing system into the first party computing system.

16 . The system of claim 15 , wherein:

the first set of controls and the second set of controls comprise a first common control;

determining the mitigation weight of each control in the common control set comprises determining a first mitigation score for mitigation of the first set of risks by the first common control and a second mitigation score for mitigation of the second set of risks by the first common control; and

processing the common control set and the mitigation weight of each control using the rules-based model to generate the control recommendation comprises applying a set of rules defining a rule to select the first common control as the control recommendation for the first set of risks or the second set of risks based on the first mitigation score and the second mitigation score.

17 . The system of claim 15 , wherein the rules-based model comprises a set of rules that selects the control recommendation from the common control set based on a relative mitigation weight of each control in the common control set.

18 . The system of claim 15 , wherein:

the operations further comprise generating a graphical user interface by configuring a display element for displaying the control recommendation and at least one of the first set of risks and the second set of risks; and

facilitating implementation of the at least one control identified by the control recommendation related to integrating or invoking the functionality provided by the third party computing system into the first party computing system comprises providing the graphical user interface for display on a user device.

19 . The system of claim 15 , wherein the operations further comprise modifying the tenant computing system control data to include new control data for the first party computing system, the new control data indicating the control recommendation as a control implemented by the first party computing system for at least one of the first set of risks or the second set of risks.

20 . The system of claim 15 , wherein facilitating implementation of the at least one control identified by the control recommendation comprises at least one of facilitating modification of the functionality provided by the third party computing system or facilitating disabling of the functionality provided by the third party computing system.

Assignments (1)

Continuity (2)

References Cited (400)