DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
In response to Applicant’s claims filed on February 2, 2026, claims 1-22 are now pending for examination in the application.
Response to Arguments
This office action is in response to amendment filed 09/03/2025. In this action 1 Claim(s) 1-2, 4-8, 12-13, 15-19 is/are rejected under 35 U.S.C. 103 as being unpatentable over Crabtree et al. (US Pub. No. 20220012814) and Gourisetti et al. [1] (US Pub. No. 20210110319) in further view of Humphrey et al. (US Pub. No. 20210273961). The Humphrey et al. reference has been added to address the amendment of generating, by the desired data generation module, the one or more evaluation outputs based on differences between the system aspect and the desired data.
Applicant’s arguments:
In regards to claim 1 on Pages 14, applicant argues “On page 10 of the above referenced Office Action, the Examiner states that, "the written description fails to disclose the corresponding structure, material, or acts for performing the entire claimed function and to clearly link the structure, material, or acts to the function. Claim(s) 1-3, 9-14, and 20-22 is interpreted under 35 U.S.C. 112(f) (see above)" The claim element identified by the Examiner is the "Desired Data Generation Module". The Applicant respectfully disagrees.”
Examiner’s Reply:
Applicant's argument on page 16 regarding the 112(f) is not persuasive. The claimed "module(s)", etc. are not recognized terms for structure, material, or acts that perform the claimed functions. They are generic placeholders that act as a substitute for “means.” In the claims, the generic placeholders that are modified by functional language and are not modified by sufficient structure to perform the claimed functions. Thus, 112(f) is invoked.
Applicant’s arguments:
In regards to claim 1 on Pages 9, applicant argues “On page 12 of the above referenced Office Action, the Examiner states that, "The claim land 12 contains subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AIA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention. There is no support for "evaluation ratings metrics". The Applicant respectfully disagrees.”
Examiner’s Reply:
No where in the specification is there support for a specific sequence of rating for evaluation is a defined, therefore there is no support for a procedural valuation rating metric.
Applicant’s arguments:
In regards to claim 1 on Page(s) 17, applicant argues “On page 13 of the above referenced Office Action, the Examiner states that the claimed invention recites an abstract idea falling within the Mental Processes enumerated groupings of abstract ideas stating the limitations recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool. The Applicant respectfully disagrees with this analysis.”
Examiner’s Reply:
The examiner respectfully disagrees and would like to point out that human mind is fully capable of generating and comparing cybersecurity data. The abstract idea recited in the claims is generally linking it to a computer environment.
CLAIM INTERPRETATION
The following is a quotation of 35 U.S.C. 112(f):
(f) Element in Claim for a Combination. – An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The following is a quotation of pre-AIA 35 U.S.C. 112, sixth paragraph:
An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
Claim 1-3, 9-14, and 20-22 contain limitations invoking 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph as detailed in the following:
Claim 1:
“a data input module …”
“a desired data generation module …”
has been interpreted under 35 U.S.C. 112 (f), or pre-AIA 35 U.S.C. 112 sixth paragraph, because it uses a generic placeholder “portion” coupled with functional languages without reciting sufficient structure to achieve the function and equivalents thereof. Furthermore, the generic placeholder is not preceded by a structural modifier.
Since the claim limitation(s) invokes 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, claim 1 have been interpreted to cover the corresponding structure described in the specification that achieves the claimed function, and equivalents thereof.
Claim 2:
“the desired data generation module …”
has been interpreted under 35 U.S.C. 112 (f), or pre-AIA 35 U.S.C. 112 sixth paragraph, because it uses a generic placeholder “portion” coupled with functional languages without reciting sufficient structure to achieve the function and equivalents thereof. Furthermore, the generic placeholder is not preceded by a structural modifier.
Since the claim limitation(s) invokes 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, claim 2 have been interpreted to cover the corresponding structure described in the specification that achieves the claimed function, and equivalents thereof.
Claim 3:
“the desired data generation module …”
has been interpreted under 35 U.S.C. 112 (f), or pre-AIA 35 U.S.C. 112 sixth paragraph, because it uses a generic placeholder “portion” coupled with functional languages without reciting sufficient structure to achieve the function and equivalents thereof. Furthermore, the generic placeholder is not preceded by a structural modifier.
Since the claim limitation(s) invokes 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, claim 3 have been interpreted to cover the corresponding structure described in the specification that achieves the claimed function, and equivalents thereof.
Claim 9:
“the desired data generation module …”
has been interpreted under 35 U.S.C. 112 (f), or pre-AIA 35 U.S.C. 112 sixth paragraph, because it uses a generic placeholder “portion” coupled with functional languages without reciting sufficient structure to achieve the function and equivalents thereof. Furthermore, the generic placeholder is not preceded by a structural modifier.
Since the claim limitation(s) invokes 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, claim 9 have been interpreted to cover the corresponding structure described in the specification that achieves the claimed function, and equivalents thereof.
Claim 10:
“the desired data generation module …”
has been interpreted under 35 U.S.C. 112 (f), or pre-AIA 35 U.S.C. 112 sixth paragraph, because it uses a generic placeholder “portion” coupled with functional languages without reciting sufficient structure to achieve the function and equivalents thereof. Furthermore, the generic placeholder is not preceded by a structural modifier.
Since the claim limitation(s) invokes 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, claim 10 have been interpreted to cover the corresponding structure described in the specification that achieves the claimed function, and equivalents thereof.
Claim 11:
“the desired data generation module …”
has been interpreted under 35 U.S.C. 112 (f), or pre-AIA 35 U.S.C. 112 sixth paragraph, because it uses a generic placeholder “portion” coupled with functional languages without reciting sufficient structure to achieve the function and equivalents thereof. Furthermore, the generic placeholder is not preceded by a structural modifier.
Since the claim limitation(s) invokes 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, claim 11 have been interpreted to cover the corresponding structure described in the specification that achieves the claimed function, and equivalents thereof.
Claim 12:
“a desired data generation module …”
has been interpreted under 35 U.S.C. 112 (f), or pre-AIA 35 U.S.C. 112 sixth paragraph, because it uses a generic placeholder “portion” coupled with functional languages without reciting sufficient structure to achieve the function and equivalents thereof. Furthermore, the generic placeholder is not preceded by a structural modifier.
Since the claim limitation(s) invokes 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, claim 12 have been interpreted to cover the corresponding structure described in the specification that achieves the claimed function, and equivalents thereof.
Claim 13:
“the desired data generation module …”
has been interpreted under 35 U.S.C. 112 (f), or pre-AIA 35 U.S.C. 112 sixth paragraph, because it uses a generic placeholder “portion” coupled with functional languages without reciting sufficient structure to achieve the function and equivalents thereof. Furthermore, the generic placeholder is not preceded by a structural modifier.
Since the claim limitation(s) invokes 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, claim 13 have been interpreted to cover the corresponding structure described in the specification that achieves the claimed function, and equivalents thereof.
Claim 14:
“the desired data generation module …”
has been interpreted under 35 U.S.C. 112 (f), or pre-AIA 35 U.S.C. 112 sixth paragraph, because it uses a generic placeholder “portion” coupled with functional languages without reciting sufficient structure to achieve the function and equivalents thereof. Furthermore, the generic placeholder is not preceded by a structural modifier.
Since the claim limitation(s) invokes 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, claim 14 have been interpreted to cover the corresponding structure described in the specification that achieves the claimed function, and equivalents thereof.
Claim 20:
“the desired data generation module …”
has been interpreted under 35 U.S.C. 112 (f), or pre-AIA 35 U.S.C. 112 sixth paragraph, because it uses a generic placeholder “portion” coupled with functional languages without reciting sufficient structure to achieve the function and equivalents thereof. Furthermore, the generic placeholder is not preceded by a structural modifier.
Since the claim limitation(s) invokes 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, claim 20 have been interpreted to cover the corresponding structure described in the specification that achieves the claimed function, and equivalents thereof.
Claim 21:
“the desired data generation module …”
has been interpreted under 35 U.S.C. 112 (f), or pre-AIA 35 U.S.C. 112 sixth paragraph, because it uses a generic placeholder “portion” coupled with functional languages without reciting sufficient structure to achieve the function and equivalents thereof. Furthermore, the generic placeholder is not preceded by a structural modifier.
Since the claim limitation(s) invokes 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, claim 21 have been interpreted to cover the corresponding structure described in the specification that achieves the claimed function, and equivalents thereof.
Claim 22:
“the desired data generation module …”
has been interpreted under 35 U.S.C. 112 (f), or pre-AIA 35 U.S.C. 112 sixth paragraph, because it uses a generic placeholder “portion” coupled with functional languages without reciting sufficient structure to achieve the function and equivalents thereof. Furthermore, the generic placeholder is not preceded by a structural modifier.
Since the claim limitation(s) invokes 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, claim 22 have been interpreted to cover the corresponding structure described in the specification that achieves the claimed function, and equivalents thereof.
A review of the specification shows that the following appears to be the corresponding structure described in the specification for the 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph limitation: NONE. The specification fails to show the corresponding structures of the components.
If applicant wishes to provide further explanation or dispute the examiner’s interpretation of the corresponding structure, applicant must identify the corresponding structure with reference to the specification by page and line number, and to the drawing, if any, by reference characters in response to this Office action.
If applicant does not intend to have the claim limitation(s) treated under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112 , sixth paragraph, applicant may amend the claim(s) so that it/they will clearly not invoke 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, or present a sufficient showing that the claim recites/recite sufficient structure, material, or acts for performing the claimed function to preclude application of 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph.
For more information, see MPEP § 2173 et seq. and Supplementary Examination Guidelines for Determining Compliance With 35 U.S.C. 112 and for Treatment of Related Issues in Patent Applications, 76 FR 7162, 7167 (Feb. 9, 2011).
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-22 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor, or for pre-AIA the applicant regards as the invention.
Claim 1-3, 9-14, and 20-22 invokes 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. However, the written description fails to disclose the corresponding structure, material, or acts for performing the entire claimed function and to clearly link the structure, material, or acts to the function. Claim(s) 1-3, 9-14, and 20-22 is interpreted under 35 U.S.C. 112(f) (see above). Claim(s) 1-3, 9-14, and 20-22 contain placeholders that require corresponding structure(s). It is unclear whether the recited structure, material, or acts in these claims are sufficient for performing the claimed function because the Specification is unclear about the corresponding structure(s). The figures do not provide indications of corresponding structure(s).
Therefore, the claim is indefinite and is rejected under 35 U.S.C. 112(b) or pre-AIA 35 U.S.C. 112, second paragraph.
Applicant may:
(a) Amend the claim so that the claim limitation will no longer be interpreted as a limitation under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph;
(b) Amend the written description of the specification such that it expressly recites what structure, material, or acts perform the entire claimed function, without introducing any new matter (35 U.S.C. 132(a)); or
(c) Amend the written description of the specification such that it clearly links the structure, material, or acts disclosed therein to the function recited in the claim, without introducing any new matter (35 U.S.C. 132(a)).
If applicant is of the opinion that the written description of the specification already implicitly or inherently discloses the corresponding structure, material, or acts and clearly links them to the function so that one of ordinary skill in the art would recognize what structure, material, or acts perform the claimed function, applicant should clarify the record by either:
(a) Amending the written description of the specification such that it expressly recites the corresponding structure, material, or acts for performing the claimed function and clearly links or associates the structure, material, or acts to the claimed function, without introducing any new matter (35 U.S.C. 132(a)); or
(b) Stating on the record what the corresponding structure, material, or acts, which are implicitly or inherently set forth in the written description of the specification, perform the claimed function. For more information, see 37 CFR 1.75(d) and MPEP §§ 608.01(o) and 2181.
Dependent claims 4-8 and 15-19 is/are also rejected for inheriting the deficiencies of the independent & dependent claims from which they depend on.
Claim Rejections - 35 USC § 112
The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
The following is a quotation of the first paragraph of pre-AIA 35 U.S.C. 112:
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor of carrying out his invention.
Claim(s) 1-22 is/are rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement. The claim 1 and 12 contains subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AIA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention. There is no support for “procedural evaluation ratings metrics…”.
Dependent claims 2-11 and 13-22 is/are also rejected for inheriting the deficiencies of the independent claims from which they depend on.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claim 1-22 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Claim 1-22 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. The judicial exception is not integrated into a practical application. The claims do not include additional elements that are sufficient to amount to significantly more than the judicial exception. The eligibility analysis in support of these findings is provided below, in accordance with the 2019 Revised Patent Subject Matter Eligibility Guidance, hereinafter 2019 PEG.
Step 1. In accordance with Step 1 of the eligibility inquiry (as explained in MPEP 2106), it is noted that the system, method, and portable device of claims 1-22 are directed to one of the eligible categories of subject matter and therefore satisfy Step 1.
Step 2A. In accordance with Step 2A, prong one of the 2019 PEG, it is noted that the independent claims recite an abstract idea falling within the Mental Processes enumerated groupings of abstract ideas set forth in the 2019 PEG. Examiner is of the position that independent claims 1 and 12 are directed towards the Mental Process Grouping of Abstract Ideas.
Independent claims 1 and 12 recite(s) the following limitations directed towards a Mental Processes:
generating, by a desired data generation module of a data input module of the analysis system, a
normalized model for the system aspect based on normalized model data related to the procedural evaluation rating metric (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to generate a normalized model);
Comparing, by the desired data generation module, the normalized model to the system aspect in light of the desired evaluation viewpoint to identify one or more types of proficiency data (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to compare a normalized model);
generating, by the desired data generation module, source identification parameters for one or more sources for retrieving the one or more types of proficiency data (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to generate source parameters);
generating, by the desired data generation module, proficiency data retrieval parameters based on the one or more types of proficiency data, and the source identification parameters, procedural evaluation rating metric, and the one or more selected evaluation outputs (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to generate retrieval parameters);
analyzing, by the desired data generation module, the proficiency data to determine relevant characteristics of the relevant proficiency data (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to analyze proficiency data); and
generating, by the desired data generation module, desired data based on the relevant characteristics of the relevant proficiency data (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to generate desired data);
generating, by the desired data generation module, the one or more evaluation outputs based on
differences between the system aspect and the desired data (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to analyze proficiency data).
Step 2A. In accordance with Step 2A, prong two of the 2019 PEG, the judicial exception is not integrated into a practical application because of the recitation in claim(s) 1 and 12:
a first memory section for storing operational instructions that, when executed by a data input module of an analysis system (i.e., as a generic processor/component performing a generic computer function; storing);
a second memory section for storing operational instructions that, when executed by a desired
data generation module of the data input module (i.e., as a generic processor/component performing a generic computer function; storing);
a third memory section for storing operational instructions that, when executed by the desired data generation module (i.e., as a generic processor/component performing a generic computer function; storing);
a fourth memory section for storing operational instructions that, when executed by the desired data generation module (i.e., as a generic processor/component performing a generic computer function; storing).
initiating, by an analysis system, a digital communication with a system for an analysis regarding a system aspect of the system, wherein the analysis is in regard to proficiency of one or more computing entities of the system in executing operational tasks of the system aspect (recites insignificant extra solution activity that amounts to mere data communication);
obtaining, by the analysis system, data gathering parameters indicating one or more system aspects of a desired evaluation viewpoint of one or more evaluation aspects for the analysis, a procedural evaluation rating metric for the analysis, and one or more evaluation outputs for the analysis (recites insignificant extra solution activity that amounts to mere data gathering);
establishing a digital connection, by the desired data generation module, proficiency data from the identified one or more sources based on the proficiency data retrieval parameters (recites insignificant extra solution activity that amounts to mere data gathering);
Step 2B. Similar to the analysis under 2A Prong Two, the claim(s) does/do not include additional elements that are sufficient to amount to significantly more than the judicial exception. Because the additional elements of the independent claims amount to insignificant extra solution activity and/or mere instructions, the additional elements do not add significantly more to the judicial exception such that the independent claims as a whole would be patent eligible.
Therefore, independent claims 1 and 12 are rejected under 35 U.S.C. 101.
With respect to claim(s) 2 and 13:
Step 2A, prong one of the 2019 PEG:
wherein the analyzing the proficiency data further comprises:
evaluating, by the desired data generation module, the proficiency data based on a range of analysis levels to determine whether the proficiency data is trustworthy (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to evaluate proficiency data); and
when the proficiency data is trustworthy:
generating, by the desired data generation module, the desired data (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to generate desired data).
Step 2A Prong Two Analysis:
This judicial exception is not integrated into a practical application because the claim as drafted recites insignificant extrasolution activity of generating desired data.
Step 2B Analysis:
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. The claim is not patent eligible.
With respect to claim(s) 3 and 14:
Step 2A, prong one of the 2019 PEG:
when the proficiency data is not trustworthy:
modifying, by the desired data generation module, the source identification parameters to produce updated proficiency data retrieval parameters (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to modify parameters).
Step 2A Prong Two Analysis:
This judicial exception is not integrated into a practical application because the claim as drafted recites insignificant extrasolution activity of generating desired data.
Step 2B Analysis:
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. The claim is not patent eligible.
With respect to claim(s) 4 and 15:
Step 2A, prong one of the 2019 PEG:
wherein the system aspect includes:
at least one system element of the system for the evaluation (The limitation recites a mental process of observation and/or evaluation capable of being performed by the human mind by using computer as a tool to evaluate );
at least one system criteria of the system for the evaluation (mental step of observing and/or evalutation of desired data on a computer screen, computer is being used as a generic tool); and at least one system mode of the system for the evaluation (mental step of observing and/or evalutation of desired data on a computer screen, computer is being used as a generic tool).
Step 2A Prong Two Analysis:
This judicial exception is not integrated into a practical application because the claim as drafted recites insignificant extrasolution activity of generating desired data.
Step 2B Analysis:
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. The claim is not patent eligible.
With respect to claim(s) 5 and 16:
Step 2A, prong one of the 2019 PEG:
Examiner is of the position the dependent claim is directed toward additional elements.
Step 2A Prong Two Analysis:
a system element of the at least one system element includes an enterprise identifier, an organization identifier, a division identifier, a department identifier, a group identifier, a subgroup identifier, a device identifier, a software identifier, or an internet protocol address identifier (insignificant extrasolution activity of receiving desired data information);
a system criteria of the at least one system criteria being system guidelines, system requirements, system design, system build, or resulting system (insignificant extrasolution activity of receiving desired data information); and
a system mode of the at least one system mode being assets, system functions, or system security (insignificant extrasolution activity of receiving desired data information).
Step 2B Analysis:
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. The claim is not patent eligible.
With respect to claim(s) 6 and 17:
Step 2A, prong one of the 2019 PEG:
Examiner is of the position the dependent claim is directed toward additional elements.
Step 2A Prong Two Analysis:
wherein the one or more types of proficiency data include one or more of: products regarding the system aspect; services regarding the system aspect (insignificant extrasolution activity of receiving desired data information);
requirements regarding the system aspect; regulations regarding the system aspect; standards regarding the system aspect (insignificant extrasolution activity of receiving desired/proficiency data); and
protocols regarding the system aspect (insignificant extrasolution activity of receiving desired data information).
Step 2B Analysis:
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. The claim is not patent eligible.
With respect to claim(s) 7 and 18:
Step 2A, prong one of the 2019 PEG:
Examiner is of the position the dependent claim is directed toward additional elements.
Step 2A Prong Two Analysis:
wherein one or more sources for retrieving the one or more types of proficiency data include one or more of: one or more databases of the analysis system (insignificant extrasolution activity of receiving desired/proficiency data);
one or more computing devices associated with one or more systems; one or more product suppliers (insignificant extrasolution activity of receiving desired/proficiency data);
one or more service suppliers; one or more governmental bodies; one or more standards bodies (insignificant extrasolution activity of receiving desired/proficiency data);
one or more forums (insignificant extrasolution activity of receiving desired/proficiency data); and
one or more industry publications (insignificant extrasolution activity of receiving desired/proficiency data).
Step 2B Analysis:
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. The claim is not patent eligible.
With respect to claim(s) 8 and 19:
Step 2A, prong one of the 2019 PEG:
Examiner is of the position the dependent claim is directed toward additional elements.
Step 2A Prong Two Analysis:
wherein the relevant characteristics of the proficiency data include one or more of:
one or more product manual information regarding the system aspect (insignificant extrasolution activity of receiving desired/proficiency data);
one or more service manual information regarding the system aspect; government laws regarding the system aspect (insignificant extrasolution activity of receiving desired/proficiency data);
government regulations regarding the system aspect (insignificant extrasolution activity of receiving desired/proficiency data);
government standards regarding the system aspect; industry standards regarding the system aspect (insignificant extrasolution activity of receiving desired/proficiency data); and
industry protocols regarding the system aspect (insignificant extrasolution activity of receiving desired/proficiency data).
Step 2B Analysis:
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. The claim is not patent eligible.
With respect to claim(s) 9 and 20:
Step 2A, prong one of the 2019 PEG:
wherein the comparing the normalized model to the system aspect in light of the desired evaluation viewpoint to identify the one or more types of proficiency data further comprises:
determining, by the desired data generation module, whether the one or more types of proficiency data are general or situational (mental step of observing and/or evalutation of desired data on a computer screen, computer is being used as a generic tool).
Step 2A Prong Two Analysis:
This judicial exception is not integrated into a practical application because the claim as drafted recites insignificant extrasolution activity of generating desired data.
Step 2B Analysis:
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. The claim is not patent eligible.
With respect to claim(s) 10 and 21:
Step 2A, prong one of the 2019 PEG:
when the one or more types of proficiency data are general:
identifying, by the desired data generation module, one or more types of general proficiency data regarding the system aspect and the desired evaluation viewpoint (mental step of observing and/or evalutation of desired data on a computer screen, computer is being used as a generic tool);
identifying, by the desired data generation module, one or more general proficiency data sources for retrieving the one or more types of general proficiency data to produce general proficiency source identification parameters (mental step of observing and/or evalutation of desired data on a computer screen, computer is being used as a generic tool);
establishing, by the desired data generation module, general proficiency data retrieval parameters based on the one or more types of general proficiency data and the general proficiency source identification parameters (mental step of observing and/or evalutation of desired data on a computer screen, computer is being used as a generic tool);
evaluating, by the desired data generation module, the general proficiency data (mental step of observing and/or evalutation of desired data on a computer screen, computer is being used as a generic tool); and
when the general proficiency data is trustworthy: generating, by the desired data generation module, general desired data for the system aspect from the general proficiency data (mental step of observing and/or evalutation of desired data on a computer screen, computer is being used as a generic tool).
Step 2A Prong Two Analysis:
obtaining, by the desired data generation module, general proficiency data based on the general proficiency data retrieval parameters (insignificant extrasolution activity of receiving desired/proficiency data).
Step 2B Analysis:
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. The claim is not patent eligible.
With respect to claim(s) 11 and 22:
Step 2A, prong one of the 2019 PEG:
when the one or more types of proficiency data are situational:
identifying, by the desired data generation module, one or more types of situational proficiency data regarding the system aspect and the desired evaluation viewpoint (mental step of observing and/or evalutation of desired data on a computer screen, computer is being used as a generic tool);
identifying, by the desired data generation module, one or more situational proficiency data sources for retrieving the one or more types of situational proficiency data to produce situational proficiency source identification parameters (mental step of observing and/or evalutation of desired data on a computer screen, computer is being used as a generic tool);
establishing, by the desired data generation module, situational proficiency data retrieval parameters based on the one or more types of situational proficiency data and the situational proficiency source identification parameters (mental step of observing and/or evalutation of desired data on a computer screen, computer is being used as a generic tool);
evaluating, by the desired data generation module, the situational proficiency data (mental step of observing and/or evalutation of desired data on a computer screen, computer is being used as a generic tool); and
when the situational proficiency data is trustworthy:
generating, by the desired data generation module, situational desired data for the system aspect from the situational proficiency data (mental step of observing and/or evalutation of desired data on a computer screen, computer is being used as a generic tool).
Step 2A Prong Two Analysis:
obtaining, by the desired data generation module, situational proficiency data based on the situational proficiency data retrieval parameters (insignificant extrasolution activity of receiving desired/proficiency data).
Step 2B Analysis:
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. The claim is not patent eligible.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-2, 4-8, 12-13, 15-19 is/are rejected under 35 U.S.C. 103 as being unpatentable over Crabtree et al. (US Pub. No. 20220012814) and Gourisetti et al. [1] (US Pub. No. 20210110319) in further view of Humphrey et al. (US Pub. No. 20210273961).
With respect to claim 1, Crabtree et al. discloses a method comprises:
obtaining, by the analysis system, data gathering parameters indicating one or more system aspects of a desired evaluation viewpoint of one or more evaluation aspects for the analysis, a procedural evaluation rating metric for the analysis, and one or more evaluation outputs for the analysis (Paragraph 8 discloses displaying the multi-risk model for viewing by a human user; and (h) updating the displayed models during a viewing session by a user, to reflect the user's actions and interactions in real-time);
generating, by a desired data generation module of a data input module of the analysis system, a normalized model for the system aspect based on normalized model data related to the procedural evaluation rating metric (Paragraph 8 discloses normalizing the results of the analysis and predictive simulations for use in risk modeling; (e) applying a plurality of predictive algorithms to the normalized data to produce a hazard model and a multi-peril model);
comparing, by the desired data generation module, the normalized model to the system aspect in light of the desired evaluation viewpoint to identify one or more types of proficiency data (Paragraphs 49-50 discloses possibility of expert opinion data 215 should be available to the system during analysis and prediction of desirability recommendations and premiums changed at step 218);
generating, by the desired data generation module, the one or more evaluation outputs based on differences between the system aspect and the desired data (Paragraph 54 discloses output of system generated analyses and simulations such as estimated risk tolerances, underwriting guides, capital sourcing recommendations among many others known to those knowledgeable in the art may then be sent directly to dedicated displays or formatted by the connector module 135 and distributed to existing or existing legacy infrastructure solutions to optimize enterprise unit interaction with new, advanced cross functional decision recommendations at step 404). Crabtree et al. does not disclose generating, by the desired data generation module, source identification parameters for one or more sources for retrieving the one or more types of proficiency data.
However, Gourisetti et al. teaches generating, by the desired data generation module, source identification parameters for one or more sources for retrieving the one or more types of proficiency data (Paragraph 88 discloses attack models and attack trees can be identified, e.g., after the set of critical assets and asset groups is identified);
generating, by the desired data generation module, proficiency data retrieval parameters based on the one or more types of proficiency data, and the source identification parameters, procedural evaluation rating metric, and the one or more selected evaluation outputs (Paragraph 23 discloses the identified business processes and functions can be determined based on regulatory functional requirements (such as through the federal energy regulatory commission (FERC)). The impacts on business continuity can be captured through the impacts on business processes and functions, using quantitative risk metrics);
establish a digital connection, by the desired data generation module, to the identified one or more sources to obtain
proficiency data based on the proficiency data retrieval parameters (Paragraph 23 discloses the identified business processes and functions can be determined based on regulatory functional requirements (such as through the federal energy regulatory commission (FERC)). The impacts on business continuity can be captured through the impacts on business processes and functions, using quantitative risk metrics);
analyzing, by the desired data generation module, the proficiency data to determine relevant
characteristics of the relevant proficiency data (Paragraph 82 discloses all relevant business functions can be identified and the business process can be related to the business functions such that each identified business function is an input to the business process);
generating, by the desired data generation module, desired data based on the relevant characteristics of the relevant proficiency data (Paragraph 5 discloses generate a new output, identifying all relevant business functions and relate the business process to the business functions such that each identified business function is an input to the business process).
Therefore, it would have been obvious at the time the invention was made to a person having ordinary skill in the art to modify Crabtree et al. with Gourisetti et al. [1] to include analyzing, by a desired data generation module of the data input module, the system aspect in light of the desired evaluation viewpoint to identify one or more types of proficiency data. This would have facilitated improved system analysis. See Gourisetti et al. [1] Paragraph(s) 5-9.
Crabtree et al. as modified by Gourisetti et al. does not disclose initiating, by an analysis system, a digital communication with a system for an analysis regarding a system aspect of the system, wherein the analysis is in regard to proficiency of one or more computing entities of the system in executing operational tasks of the system aspect.
However, Humphrey et al. discloses initiating, by an analysis system, a digital communication with a system for an analysis regarding a system aspect of the system, wherein the analysis is in regard to proficiency of one or more computing entities of the system in executing operational tasks of the system aspect (Paragraph 15 discloses an artificial intelligence based analyst investigation, where the interface is configured to work with at least one of: artificial intelligence models trained on how to conduct an investigation; and scripts on how to conduct an investigation, in order to determine whether a chain of related low level abnormalities associated with one or more of the entities should be determined to be one or more incidents worthy of generating a notification to a human user for possible further investigation and/or worthy of being determined as an actual cyber-threat, and thus, trigger an autonomous response from an autonomous response module to mitigate the cyber-threat)
Therefore, it would have been obvious at the time the invention was made to a person having ordinary skill in the art to modify Crabtree et al. and Gourisetti et al. [1] with Humphrey et al. to include disclose initiating, by an analysis system, a digital communication with a system for an analysis regarding a system aspect of the system, wherein the analysis is in regard to proficiency of one or more computing entities of the system in executing operational tasks of the system aspect. This would have facilitated improved system analysis. See Humphrey et al. Paragraph(s) 4-11.
The Crabtree et al. as modified by Gourisetti et al. [1] and Humphrey et al. teaches all the limitations of claim 1. With respect to claim 2, Gourisetti et al. [1] does not disclose the method of claim 1, wherein the analyzing the proficiency data further comprises:
evaluating, by the desired data generation module, the proficiency data based on a range of analysis levels to determine whether the proficiency data is trustworthy (Paragraph 40 discloses a unified scalar value is determined for the overall network or system under a predefined scale, such as a scale ranging from 1 to 10 where 1 is the lowest associated risk and 10 is the highest associated risk); and
when the proficiency data is trustworthy: generating, by the desired data generation module, the desired data (Paragraph 108 discloses a unified scalar value is determined for the overall network or system under a predefined scale, such as a scale ranging from 1 to 10 where 1 is the lowest associated risk and 10 is the highest associated risk). The motivation to combine statement previously provided in the rejection of independent claim 1 provided above, combining the Crabtree et al. reference and the Gourisetti et al. [1] reference is applicable to dependent claim 2.
The Crabtree et al. as modified by Gourisetti et al. [1] and Humphrey et al. teaches all the limitations of claim 1. With respect to claim 4, Gourisetti et al. [1] does not disclose the method of claim 1, wherein the system aspect includes:
at least one system element of the system for the evaluation (Paragraph 69 discloses identifying interdependencies between the different assets and components. For example, systems or components in an operations layer, could be connected across the layer as well as in an upstream and downstream direction to other layers. Additional mappings can be obtained across different classes of assets to construct a complete map for an organization);
at least one system criteria of the system for the evaluation (Paragraph 69 discloses identifying interdependencies between the different assets and components. For example, systems or components in an operations layer, could be connected across the layer as well as in an upstream and downstream direction to other layers. Additional mappings can be obtained across different classes of assets to construct a complete map for an organization); and
at least one system mode of the system for the evaluation (Paragraph 69 discloses identifying interdependencies between the different assets and components. For example, systems or components in an operations layer, could be connected across the layer as well as in an upstream and downstream direction to other layers. Additional mappings can be obtained across different classes of assets to construct a complete map for an organization). The motivation to combine statement previously provided in the rejection of independent claim 1 provided above, combining the Crabtree et al. reference and the Gourisetti et al. [1] reference is applicable to dependent claim 3.
The Crabtree et al. as modified by Gourisetti et al. [1] and Humphrey et al. teaches all the limitations of claim 4. With respect to claim 5, Gourisetti et al. [1] does not disclose the method of claim 4 further comprises:
a system element of the at least one system element includes an enterprise identifier, an organization identifier, a division identifier, a department identifier, a group identifier, a subgroup identifier, a device identifier, a software identifier, or an internet protocol address identifier (Paragraph 91 discloses business functions, groupings 304 of business processes (only one process labeled with numeral identifier for simplicity) that are associated with the business functions, a grouping 306 of engineering applications, a grouping 308 of assets, a grouping 310 engineering consequences associated with the engineering applications, a grouping 312 of business consequences associated with the business functions, a grouping of facilities 314, and a grouping 316 of responsible entities);
a system criteria of the at least one system criteria being system guidelines, system requirements, system design, system build, or resulting system (Paragraph 62 discloses Some consequences extracted from the NESCOR failure scenario help determine the impact ranking criteria or scoring methodology); and
a system mode of the at least one system mode being assets, system functions, or system security (Paragraph 69 discloses identifying interdependencies between the different assets and components. For example, systems or components in an operations layer, could be connected across the layer as well as in an upstream and downstream direction to other layers. Additional mappings can be obtained across different classes of assets to construct a complete map for an organization). The motivation to combine statement previously provided in the rejection of dependent claim 4 provided above, combining the Humphrey et al. reference and the Gourisetti et al. [1] reference is applicable to dependent claim 5.
The Crabtree et al. as modified by Gourisetti et al. [1] and Humphrey et al. teaches all the limitations of claim 4. With respect to claim 6, Gourisetti et al. [1] does not disclose the method of claim 1, wherein the one or more types of proficiency data include one or more of:
products regarding the system aspect (Paragraph 88 discloses consequence scores can correspond to a product of asset and application criticalities, to produce singular scalar consequence values that can correspond to objective values of consequences);
services regarding the system aspect;
requirements regarding the system aspect;
regulations regarding the system aspect;
standards regarding the system aspect; and
protocols regarding the system aspect.
The motivation to combine statement previously provided in the rejection of independent claim 1 provided above, combining the Crabtree et al. reference and the Gourisetti et al. [1] reference is applicable to dependent claim 6.
The Crabtree et al. as modified by Gourisetti et al. [1] and Humphrey et al. teaches all the limitations of claim 1. With respect to claim 7, Gourisetti et al. [1] does not disclose the method of claim 1, wherein the one or more sources for retrieving the one or more types of proficiency data include one or more of:
one or more databases of the analysis system;
one or more computing devices associated with one or more systems;
one or more product suppliers;
one or more service suppliers;
one or more governmental bodies (Paragraph 48 discloses survey and review mostly highlighted the set of guidelines, best practices, security tools, and new technologies developed by government agencies and industry associations);
one or more standards bodies;
one or more forums; and
one or more industry publications.
The motivation to combine statement previously provided in the rejection of independent claim 1 provided above, combining the Crabtree et al. reference and the Gourisetti et al. [1] reference is applicable to dependent claim 7.
The Crabtree et al. as modified by Gourisetti et al. [1] and Humphrey et al. teaches all the limitations of claim 1. With respect to claim 8, Gourisetti et al. [1] does not disclose the method of claim 1, wherein the relevant characteristics of the proficiency
data include one or more of:
one or more product manual information regarding the system aspect;
one or more service manual information regarding the system aspect;
government laws regarding the system aspect;
government regulations regarding the system aspect;
government standards regarding the system aspect (Paragraph 48 discloses survey and review mostly highlighted the set of guidelines, best practices, security tools, and new technologies developed by government agencies and industry associations);
industry standards regarding the system aspect; and
industry protocols regarding the system aspect.
The motivation to combine statement previously provided in the rejection of independent claim 1 provided above, combining the Humphrey et al. reference and the Gourisetti et al. [1] reference is applicable to dependent claim 8.
With respect to claim 12, Humphrey et al. teaches a non-transitory computer readable memory comprises:
a first memory section for storing operational instructions that, when executed by an analysis system, cause the analysis system to:
obtain data gathering parameters indicating one or more system aspects of a desired evaluation viewpoint of one or more evaluation aspects for the analysis, a procedural evaluation rating metric for the analysis, and one or more evaluation outputs for the analysis (Paragraph 8 discloses displaying the multi-risk model for viewing by a human user; and (h) updating the displayed models during a viewing session by a user, to reflect the user's actions and interactions in real-time);
a second memory section for storing operational instructions that, when executed by a desired data generation module of a data input module of an analysis system, cause the desired data generation module to:
generate a normalized model for the system aspect based on normalized model data related to the procedural evaluation rating metric (Paragraph 8 discloses normalizing the results of the analysis and predictive simulations for use in risk modeling; (e) applying a plurality of predictive algorithms to the normalized data to produce a hazard model and a multi-peril model);
comparing the normalized model to the system aspect in light of the desired evaluation viewpoint to identify one or more types of proficiency data (Paragraphs 49-50 discloses possibility of expert opinion data 215 should be available to the system during analysis and prediction of desirability recommendations and premiums changed at step 218);
generate the one or more evaluation outputs based on differences between the system aspect and the desired data (Paragraph 54 discloses output of system generated analyses and simulations such as estimated risk tolerances, underwriting guides, capital sourcing recommendations among many others known to those knowledgeable in the art may then be sent directly to dedicated displays or formatted by the connector module 135 and distributed to existing or existing legacy infrastructure solutions to optimize enterprise unit interaction with new, advanced cross functional decision recommendations at step 404). Crabtree et al. does not disclose generating, by the desired data generation module, source identification parameters for one or more sources for retrieving the one or more types of proficiency data.
However, Gourisetti et al. teaches generate source identification parameters for one or more sources for retrieving the one or more types of proficiency data (Paragraph 88 discloses attack models and attack trees can be identified, e.g., after the set of critical assets and asset groups is identified);
generate proficiency data retrieval parameters based on the one or more types of proficiency data, the source identification parameters, the procedural evaluation rating metric, and the one or more selected evaluation outputs (Paragraph 23 discloses the identified business processes and functions can be determined based on regulatory functional requirements (such as through the federal energy regulatory commission (FERC)). The impacts on business continuity can be captured through the impacts on business processes and functions, using quantitative risk metrics);
a third memory section for storing operational instructions that, when executed by the desired data generation module, cause the desired data generation module to:
establish a digital connection, to the identified one or more sources to obtain proficiency data based on the proficiency data retrieval parameters (Paragraph 23 discloses the identified business processes and functions can be determined based on regulatory functional requirements (such as through the federal energy regulatory commission (FERC)). The impacts on business continuity can be captured through the impacts on business processes and functions, using quantitative risk metrics);
a fourth memory section for storing operational instructions that, when executed by the desired data generation module, cause the desired data generation module to:
analyze the proficiency data to determine relevant be identified and the business process can be related to the business functions such that each identified business function is an input to the business process);
generate desired data based on the relevant characteristics of the relevant proficiency data (Paragraph 5 discloses generate a new output, identifying all relevant business functions and relate the business process to the business functions such that each identified business function is an input to the business process).
Therefore, it would have been obvious at the time the invention was made to a person having ordinary skill in the art to modify Crabtree et al. with Gourisetti et al. [1] to include analyzing, by a desired data generation module of the data input module, the system aspect in light of the desired evaluation viewpoint to identify one or more types of proficiency data. This would have facilitated improved system analysis. See Gourisetti et al. [1] Paragraph(s) 5-9.
Crabtree et al. as modified by Gourisetti et al. does not disclose initiating, by an analysis system, a digital communication with a system for an analysis regarding a system aspect of the system, wherein the analysis is in regard to proficiency of one or more computing entities of the system in executing operational tasks of the system aspect.
However, Humphrey et al. discloses initiating, by an analysis system, a digital communication with a system for an analysis regarding a system aspect of the system, wherein the analysis is in regard to proficiency of one or more computing entities of the system in executing operational tasks of the system aspect (Paragraph 15 discloses an artificial intelligence based analyst investigation, where the interface is configured to work with at least one of: artificial intelligence models trained on how to conduct an investigation; and scripts on how to conduct an investigation, in order to determine whether a chain of related low level abnormalities associated with one or more of the entities should be determined to be one or more incidents worthy of generating a notification to a human user for possible further investigation and/or worthy of being determined as an actual cyber-threat, and thus, trigger an autonomous response from an autonomous response module to mitigate the cyber-threat)
Therefore, it would have been obvious at the time the invention was made to a person having ordinary skill in the art to modify Crabtree et al. and Gourisetti et al. [1] with Humphrey et al. to include disclose initiating, by an analysis system, a digital communication with a system for an analysis regarding a system aspect of the system, wherein the analysis is in regard to proficiency of one or more computing entities of the system in executing operational tasks of the system aspect. This would have facilitated improved system analysis. See Humphrey et al. Paragraph(s) 4-11.
With respect to claim 13, it is rejected on grounds corresponding to above rejected claim 2, because claim 13 is substantially equivalent to claim 2.
With respect to claim 15, it is rejected on grounds corresponding to above rejected claim 4, because claim 15 is substantially equivalent to claim 4.
With respect to claim 16, it is rejected on grounds corresponding to above rejected claim 5, because claim 16 is substantially equivalent to claim 5.
With respect to claim 17, it is rejected on grounds corresponding to above rejected claim 6, because claim 17 is substantially equivalent to claim 6.
With respect to claim 18, it is rejected on grounds corresponding to above rejected claim 7, because claim 18 is substantially equivalent to claim 7.
With respect to claim 19, it is rejected on grounds corresponding to above rejected claim 8, because claim 19 is substantially equivalent to claim 8.
Claim(s) 3, 9-11, 14 and 20-22 is/are rejected under 35 U.S.C. 103 as being unpatentable over Crabtree et al. (US Pub. No. 20220012814) and Gourisetti et al. [1] (US Pub. No. 20210110319) and Humphrey et al. (US Pub. No. 20210273961) in further view of Gourisetti et al. [2] (US Pub. No. 20200356678).
The Crabtree et al. reference as modified by Gourisetti et al. [1] and Humphrey et al.teaches all the limitations of claim 1. With respect to claim 3, Crabtree et al. as modified by Gourisetti et al. [1] and Humphrey et al.does not disclose modifying, by the desired data generation module, the source identification parameters to produce updated proficiency data retrieval parameters.
However, Gourisetti et al. [2] discloses the method of claim 2 further comprises: when the proficiency data is not trustworthy: modifying, by the desired data generation module, the source identification parameters to produce updated proficiency data retrieval parameters (Paragraph 46 discloses system modifications include organizational and policy level modifications such as performing inventory management, qualitative and quantitative risk assessment, supply chain management, development of business continuity planning, disaster recovery plans, performing business impact analysis, ensuring policies and point-of-contact are in place for critical cyber-organizational processes, etc).
Therefore, it would have been obvious at the time the invention was made to a person having ordinary skill in the art to modify Crabtree et al. and Gourisetti et al. [1] and Humphrey et al.with Gourisetti et al. [2] to include modifying, by the desired data generation module, the source identification parameters to produce updated proficiency data retrieval parameters. This would have facilitated improved system analysis. See Gourisetti et al. [2] Paragraph 15.
The Crabtree et al. reference as modified by Gourisetti et al. [1] and Humphrey et al.reference teaches all the limitations of claim 1. With respect to claim 9, Crabtree et al. as modified by Gourisetti et al. [1] does not disclose determining, by the desired data generation module, whether the one or more types of proficiency data are general or situational.
However, Gourisetti et al. [2] discloses the method of claim 1, wherein the identifying the one or more types of proficiency data further comprises:
determining, by the desired data generation module, whether the one or more types of proficiency data are general or situational (Paragraph 278 discloses vulnerability assessment module can additionally use attack graphs or similar graph structures (e.g., Petri nets, Bayes nets, and Markov models) outside the module that can provide situational awareness information on demand and/or at the trigger of an event).
Therefore, it would have been obvious at the time the invention was made to a person having ordinary skill in the art to modify Crabtree et al. and Gourisetti et al. [1] and Humphrey et al.with Gourisetti et al. [2] to include modifying, by the desired data generation module, the source identification parameters to produce updated proficiency data retrieval parameters. This would have facilitated improved system analysis. See Gourisetti et al. [2] Paragraph 15.
The Crabtree et al. reference as modified by Gourisetti et al. [1] and Humphrey et al.and Gourisetti et al. [2] teaches all the limitations of claim 9. With respect to claim 10, Gourisetti et al. [2] teaches the method of claim 9 further comprises:
when the one or more types of proficiency data are general: identifying, by the desired data generation module, one or more types of general proficiency data regarding the system aspect and the desired evaluation viewpoint (Paragraph 278 discloses situational awareness information on demand and/or at the trigger of an event);
identifying, by the desired data generation module, one or more general proficiency data sources for retrieving the one or more types of general proficiency data to produce general proficiency source identification parameters (Paragraph 278 discloses situational awareness information on demand and/or at the trigger of an event);
establishing, by the desired data generation module, general proficiency data retrieval parameters based on the one or more types of general proficiency data and the general proficiency source identification parameters (Paragraph 278 discloses situational awareness information on demand and/or at the trigger of an event);
obtaining, by the desired data generation module, general proficiency data based on the general proficiency data retrieval parameters (Paragraph 275 discloses the system 2300 can be adapted by changing an operating parameter of a component of the system 2300 based on the vulnerability assessments); and
evaluating, by the desired data generation module, the general proficiency data (Paragraph 275 discloses the system 2300 can be adapted by changing an operating parameter of a component of the system 2300 based on the vulnerability assessments); and
when the general proficiency data is trustworthy:
generating, by the desired data generation module, general desired data for the system aspect from the general proficiency data (Paragraph 281 discloses generating a data visualization representing the selected solution candidate, the data visualization illustrating target maturity levels for security controls to reach the cybersecurity maturity goal for the system). The motivation to combine statement previously provided in the rejection of independent claim 1 provided above, combining the Humphrey et al. reference and the Gourisetti et al. [2] reference is applicable to dependent claim 10.
The Crabtree et al. reference as modified by Gourisetti et al. [1] and Humphrey et al.and Gourisetti et al. [2] teaches all the limitations of claim 9. With respect to claim 11, Gourisetti et al. [2] teaches the method of claim 9 further comprises:
when the one or more types of proficiency data are situational:
identifying, by the desired data generation module, one or more types of situational proficiency data regarding the system aspect and the desired evaluation viewpoint (Paragraph 278 discloses situational awareness information on demand and/or at the trigger of an event);
identifying, by the desired data generation module, one or more situational proficiency data sources for retrieving the one or more types of situational proficiency data to produce situational proficiency source identification parameters (Paragraph 278 discloses situational awareness information on demand and/or at the trigger of an event);
establishing, by the desired data generation module, situational proficiency data retrieval parameters based on the one or more types of situational proficiency data and the situational proficiency source identification parameters (Paragraph 278 discloses situational awareness information on demand and/or at the trigger of an event);
obtaining, by the desired data generation module, situational proficiency data based on the situational proficiency data retrieval parameters (Paragraph 275 discloses the system 2300 can be adapted by changing an operating parameter of a component of the system 2300 based on the vulnerability assessments); and
evaluating, by the desired data generation module, the situational proficiency data (Paragraph 275 discloses the system 2300 can be adapted by changing an operating parameter of a component of the system 2300 based on the vulnerability assessments); and
when the situational proficiency data is trustworthy:
generating, by the desired data generation module, situational desired data for the system aspect from the situational proficiency data (Paragraph 281 discloses generating a data visualization representing the selected solution candidate, the data visualization illustrating target maturity levels for security controls to reach the cybersecurity maturity goal for the system). The motivation to combine statement previously provided in the rejection of independent claim 1 provided above, combining the Crabtree et al. [1] reference and the Gourisetti et al. [2] reference is applicable to dependent claim 10.
With respect to claim 14, it is rejected on grounds corresponding to above rejected claim 3, because claim 14 is substantially equivalent to claim 3.
With respect to claim 20, it is rejected on grounds corresponding to above rejected claim 9, because claim 20 is substantially equivalent to claim 9.
With respect to claim 21, it is rejected on grounds corresponding to above rejected claim 10, because claim 21 is substantially equivalent to claim 10.
With respect to claim 22, it is rejected on grounds corresponding to above rejected claim 11, because claim 22 is substantially equivalent to claim 11.
Relevant Prior Art
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
US PG-PUB 20210294902 is directed to EVALUATION RATING OF A SYSTEM OR PORTION THEREOF [0161] The analysis system 10 is operable to evaluate a system 11-13, or portion thereof, in a variety of ways. For example, the analysis system 10 evaluates system A 11, or a portion thereof, by testing the organization's understanding of its system, or portion thereof; by testing the organization's implementation of its system, or portion thereof; and/or by testing the system's, or portion thereof; operation. As a specific example, the analysis system 10 tests the organization's understanding of its system requirements for the implementation and/or operation of its system, or portion thereof. As another specific example, the analysis system 10 tests the organization's understanding of its software maintenance policies and/or procedures. As another specific example, the analysis system 10 tests the organization's understanding of its cybersecurity policies and/or procedures.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to NICHOLAS E ALLEN whose telephone number is (571)270-3562. The examiner can normally be reached Monday through Thursday 830-630.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Boris Gorney can be reached at (571) 270-5626. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/N.E.A/Examiner, Art Unit 2154
/BORIS GORNEY/Supervisory Patent Examiner, Art Unit 2154
Prosecution Insights