Mapping regulations and frameworks to policies using control statements
View Patent ↗A method, system and apparatus for mapping of internal corporate policies to operational guidelines, such as regulations, best practice frameworks, and standards, through the use of control statements are provided. In one embodiment, a set of normalized control statements are linked to best practice framework control objectives and regulations pertinent to an organization. The control statements are also linked to an organization's policies; thereby providing a mapping via the control statements between the regulations and best practices those policies are intended to satisfy. Other embodiments provide for a mechanism for organizing, maintaining, tracking, and displaying control statements and the associated operational guidelines.
1. A computer-implemented method comprising:
storing a control statement in a computer-readable storage medium of a computer system;
linking a policy to the control statement by creating a link between the policy and the control statement, wherein
the link comprises a mapping between the policy and the control statement, and
the policy is configured to implement the control statement;
storing the policy and an identifier of the link in the computer-readable storage medium, wherein
the identifier comprises a record in a relational database;
mapping the control statement to an operational guideline of a plurality of operational guidelines, wherein
the control statement is configured to operate as an interface between the operational guideline and the policy,
the operational guideline comprises at least one of a regulation, best practice, or a standard, and
the control statement is one of a set of control statements formulated to ensure compliance with the operational guideline;
defining the control statement, wherein said defining the control statement further comprises
reducing the at least one regulation, best practice, or standard to one or more basic concepts comprising the at least one regulation, best practice or standard, and
expressing the one or more basic concepts in an atomic form; and
displaying a list of control statements linked to the policy on a display of the computer system, wherein
the list of control statements comprises the control statement.
2. The method of claim 1 further comprising:
defining the policy in response to the control statement, wherein said defining the policy further comprises
determining a presence of an asset implicated by the control statement, and
expressing an implementation of the control statement for the asset.
3. The method of claim 1 further comprising:
tracking an indication of members of the set of control statements that are not linked to a corresponding policy.
4. The method of claim 3 further comprising:
displaying an indication of each control statement not linked to the corresponding policy.
5. The method of claim 3 further comprising:
for each of the members, displaying an indication of a corresponding operational guideline of the plurality of operational guidelines.
6. A system comprising:
a first memory wherein the first memory is configured to store a control statement;
a second memory wherein the second memory is configured to store a policy;
a processor, coupled to the first memory and the second memory, and configured to execute instructions for
linking the policy to the control statement by creating a link between the policy and the control statement, wherein
the link comprises a mapping between the policy and the control statement, and
the policy is configured to implement the control statement,
storing the policy and an identifier of the link, wherein the identifier comprises a record in a relational database, and
mapping the control statement to an operational guideline of a plurality of operational guidelines, wherein
the control statement is configured to operate as an interface between the operational guideline and the policy,
the operational guideline comprises at least one of a regulation, best practice, or a standard, and
the control statement is one of a set of control statements formulated to ensure compliance with the operational guideline;
defining the control statement, wherein said defining the control statement further comprises
reducing the at least one regulation, best practice, or standard to one or more basic concepts comprising the at least one regulation, best practice or standard, and
expressing the one or more basic concepts in an atomic form; and
a display configured to display a list of control statements linked to the policy, wherein the list of control statements comprises the control statement.
7. The system of claim 6 wherein said instructions for storing the indication of the link further comprise:
instructions for storing the indication of the link in the second memory.
8. The system of claim 6 wherein the processor is further configured to execute instructions comprising:
defining the policy in response to the control statement, wherein said instructions for defining the policy further comprise instructions for
determining a presence of an asset implicated by the control statement, and
expressing an implementation of the control statement for the asset.
9. The system of claim 6 wherein the processor is further configured to execute instructions comprising:
tracking an indication of members of the set of control statements that are not linked to a corresponding policy.
10. The system of claim 9 wherein the processor is further configured to execute instructions comprising:
displaying an indication of each control statement not linked to the corresponding policy.
11. The system of claim 9 wherein the processor is further configured to execute instructions comprising:
for each member, displaying an indication of a corresponding operational guideline of the plurality of operational guidelines.
12. An apparatus comprising:
means for storing a control statement in a computer-readable storage medium of a computer system;
means for linking a policy to the control statement by creating a link between the policy and the control statement, wherein
the link comprises a mapping between the policy and the control statement, and
the policy is configured to implement the control statement;
means for storing the policy and an identifier of the link in the computer-readable storage medium, wherein
the identifier comprises a record in a relational database;
means for mapping the control statement to an operational guideline of a plurality of operational guidelines, wherein
the control statement is configured to operate as an interface between the operational guideline and the policy,
the operational guideline comprises at least one of a regulation, best practice, or a standard, and
the control statement is one of a set of control statements formulated to ensure compliance with the operational guideline;
means for defining the control statement, wherein said defining the control statement further comprises
reducing the at least one regulation, best practice, or standard to one or more basic concepts comprising the at least one regulation, best practice or standard, and
expressing the one or more basic concepts in an atomic form; and
means for displaying a list of control statements linked to the policy on a display of the computer system, wherein
the list of control statements comprises the control statement.
13. The apparatus of claim 12 further comprising:
means for defining the policy in response to the control statement, wherein said means for defining the policy further comprises
means for determining a presence of an asset implicated by the control statement, and
means for expressing an implementation of the control statement for the asset.
14. The apparatus of claim 12 further comprising:
means for tracking an indication of members of the set of control statements that are not linked to a corresponding policy.
15. The apparatus of claim 14 further comprising:
means for displaying an indication of each control statement not linked to the corresponding policy.
16. The apparatus of claim 14 further comprising:
means for displaying, for each member, an indication of a corresponding operational guideline of the plurality of operational guidelines.
17. The method of claim 1 further comprising:
mapping the control statement to a second operational guideline.