DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Status of Claims
The following is a final office action.
Claims 1-20 are currently pending and have been examined on their merits.
Claims 1, 7, 11, 15, 17, and 20 are currently amended see REMARKS December 29, 2025.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-20 are rejected under 35 U.S.C 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1: Claims 1-10 recite a system, Claim 11-19 recites a method (i.e. a series of steps), and claim 20 recite a computer program product and therefore each claim falls within one of the four statutory categories.
Step 2A prong 1 (Is a judicial exception recited?):
The representative claims 1 and 20 recite: identify reference controls of a reference control framework that define respective reference actions that, when performed, cause a cloud service to comply with a first compliance standard, each reference control having a respective first subset of text-based features such that each text-based feature in the respective first subset includes information regarding the reference control; identify custom controls of a custom control framework that define respective custom actions that, when performed, cause the cloud service to comply with a second compliance standard that is different from the first compliance standard, each custom control having a respective second subset of the text-based features such that each text-based feature in the respective second subset includes information regarding the custom control; for each custom control, determine a plurality of scores for the respective reference controls such that the plurality of scores are based at least on respective probabilities that the respective first subsets of the text-based features of the respective reference controls correspond to the second subset of the text-based features of the custom control; generate a compliance map for the cloud service by automatically mapping each custom control of the custom control framework to a respective subset of the reference controls based at least on each reference control in the respective subset of the reference controls having a score in the respective plurality of scores that satisfies a score criterion; and based at least on the compliance map, perform an action that facilities compliance with the second compliance standard.
Claim 11: A method, the method comprising: identifying reference controls of a reference control framework that define respective reference actions that, when performed, cause a cloud service to comply with a first compliance standard, each reference control having a respective first subset of text-based features such that each text-based feature in the respective first subset includes information regarding the reference control; receiving a question pertaining to compliance of the cloud service with a second compliance standard that is different from the first compliance standard, the question having a second subset of the text-based features such that each text-based feature in the second subset includes information regarding the question; determining scores for the respective reference controls such that the scores are based at least on respective probabilities that the respective first subsets of the text-based features of the respective reference controls correspond to the second subset of the text-based features of the question; and generating a compliance map for the cloud service by automatically mapping the question to a subset of the reference controls based at least on each reference control in the subset of the reference controls having a score that satisfies a score criterion; and based at least on the compliance map, performing an action that facilitates compliance with the second standard.
The claims recite a certain method of organizing human activity. The claims recite a certain method of organizing human activity as the disclosure recites commercial or legal interactions. The claims recite a series of steps for mapping custom controls to reference controls to generate a compliance map based on a plurality of scores and the respective probability that the text features of the reference control correspond to the custom controls. The claims merely recite a series of rules or steps to compare custom regulatory requirements and controls created by a user to reference controls to determine if the custom regulations correspond to reference regulations to evaluate if the custom regulations are compliant with industry standards.
Alternatively, the claims recite a mental process. The claims recite a method for determining a plurality of scores based on the probabilities that the reference control correspond to a custom control by mapping each custom control to a respective reference control which can be performed in the human mind or by using simple tools such as pen and paper. The courts have identified concepts such as observation, evaluation, judgement and opinion as reciting a mental process. Therefore, merely receiving and analyzing information by comparing a reference control and a custom control to determine if the custom control corresponds to the reference control is a mental process. A person such as a quality control agent is capable of mentally or with simple tool such as pen and paper of reviewing custom quality control regulations to determine if they correspond and match standard regulations and controls.
Step 2A Prong 2 (Is the exception integrated into a practical application?): The claims additionally recite;
Claim 1: A system comprising: memory; and a processing system coupled to the memory, the processing system configured to: reduce an amount of resources by the computing system, and a supervised natural language processing machine learning model.
Claim 11: implemented by a computing system, reduce an amount of resources by the computing system, and using a supervised natural language processing machine learning model.
Claim 20: A computer program product comprising a computer-readable storage medium having instructions recorded thereon for enabling a processor-based system to perform operations, reduce an amount of resources by the computing system, and using a supervised natural language processing machine learning model.
However, the additional elements merely amount to adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea, as discussed in MPEP 2106.05(f). Merely utilizing generic computer elements such as a computer and a user device to perform basic actions of the abstract idea by receiving, analyzing, and storing information. Furthermore, a method for processing and storing information does not amount to improvements to the functioning of a computer, or to any other technology or technical field, as discussed in MPEP 2106.05(a), applying the judicial exception with, or by use of, a particular machine, as discussed in MPEP 2106.05(b), effecting a transformation or reduction of a particular article to a different state or thing, as discussed in MPEP 2106.05(c), such that the claim as a whole is more than a drafting effort designed to monopolize the exception, as discussed in MPEP 2106.05(e). Accordingly, the additional elements do not integrate the abstract idea into a practical application because they do not impose any meaningful limits on practicing the abstract idea.
Step 2B (Does the claim recite additional elements that amount to significantly more that the judicial exception?): As discussed above, the additional imitations amount to adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea, as discussed in MPEP 2106.05(f). See reasoning for Step 2A prong 2. Therefore, the claims do not amount to significantly more as they do not recite an improvement to a technology or technical field. The claims merely recite “apply it” or applying generic computer elements to receiving and analyze information.
Claims 2-10 and 12-19 are directed to further narrowing the abstract idea of analyzing custom controls and determining a plurality of scores for mapping the custom controls to reference controls as disclosed by the independent claims 1, 11, and 20.
Additional elements recited by the dependent claims include:
Claims 6, 9, 10, 16, and 19: a first user interface and a second user interface
However, these elements are directed to merely “apply it” or applying generic computer elements to perform the abstract idea.
Therefore, claims 1-20 are rejected under U.S.C. 101.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claim(s) 1-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Shaw (US 2020/0258093) in view of Erwin (US 2023/0316184) further in view of Duchin (US 2020/0143388).
Claims 1, 11, and 20: Shaw discloses a system comprising: memory; and a processing system coupled to the memory, the processing system configured to: identify reference controls of a reference control framework that define respective reference actions that, when performed, cause a cloud service to comply with a first compliance standard, each reference control having a respective first subset of text-based features such that each text-based feature in the respective first subset includes information regarding the reference control (Paragraph [0013-0015]; [0019-0020]; Fig. 1, methods and systems disclosed herein may provide for the mapping of compliance standards to particular products and/or services. When a user would like to know how a product or service measures up against a compliance standard, the user may query the mapped standards and access a report without the need to contact an expert on the compliance standard. A compliance standards mapping system may provide functionality to map standard content, thereby allowing a user to determine whether devices comply with standards. Standard content may include text files. Compliance standards mapping system may receive standards content through a compliance standard input processor. Compliance standard input processor may receive standard content as inputted information in an automated process, whereby the standard content is inputted to compliance standards input processor from an archive of information. Compliance standard input processor may output standards content to a compliance mapping database. Compliance mapping database may include structure that allows standards content to be stored and organized);
Based at least on the compliance map, perform an action that facilitates compliance with the second compliance standard (Paragraph [0013-0015]; [0019-0020]; [0032-0033]; Fig. 1, methods and systems disclosed herein may provide for the mapping of compliance standards to particular products and/or services. When a user would like to know how a product or service measures up against a compliance standard, the user may query the mapped standards and access a report without the need to contact an expert on the compliance standard. A compliance standards mapping system may provide functionality to map standard content, thereby allowing a user to determine whether devices comply with standards. Standard content may include text files. Compliance standards mapping system may receive standards content through a compliance standard input processor. Compliance standard input processor may receive standard content as inputted information in an automated process, whereby the standard content is inputted to compliance standards input processor from an archive of information. Compliance standard input processor may output standards content to a compliance mapping database. Compliance mapping database may include structure that allows standards content to be stored and organized. Compliance report generator may collect information from compliance mapping database and the information may indicate that the product queried by the user does not meet a threshold requirement for one or more standards content. A threshold requirement may refer to a minimally accepted compliance score).
Shaw discloses a system for mapping compliance standards however, Shaw does not specifically disclose the following claim limitations: identify custom controls of a custom control framework that define respective custom actions that, when performed, cause the cloud service to comply with a second compliance standard that is different from the first compliance standard, each custom control having a respective second subset of the text-based features such that each text-based feature in the respective second subset includes information regarding the custom control; for each custom control, determine a plurality of scores for the respective reference controls using a supervised natural language processing machine learning model such that the plurality of scores are based at least on respective probabilities that the respective first subsets of the text-based features of the respective reference controls correspond to the second subset of the text-based features of the custom control; Reduce an amount of resources consumed by the system to generate a compliance map for the cloud service by automatically mapping each custom control of the custom control framework to a respective subset of the reference controls using the supervised natural language processing machine learning model based at least on each reference control in the respective subset of the reference controls having a score in the respective plurality of scores that satisfies a score criterion.
In the same field of endeavor of managing compliance regulations Erwin teaches identify custom controls of a custom control framework that define respective custom actions that, when performed, cause the cloud service to comply with a second compliance standard that is different from the first compliance standard, each custom control having a respective second subset of the text-based features such that each text-based feature in the respective second subset includes information regarding the custom control (Paragraph [0009-0011]; [0014]; [0018-0021]; aspects of the present disclosure relate to managing compliance standards for an organizing, the disclosure relate to dynamically and autonomously identifying and pairing regulations for an organization with benchmarks that can verify objective compliance with said regulations, and therein updating these across various organizations. The controller may identify these benchmarks in a manner such that they can objectively measure whether or not the regulation has been complied with or not. The controller may interface with a system that executes automated and autonomous tests to verify compliance. The controller may use machine learning techniques to learn and improve at the act of identifying benchmarks for compliance. Controller may verify compliance for organizations via a set of benchmarks derived from existing variables from one or more data processing applications and/or one or more record-keeping application of organization. Controller may be fed or otherwise be given access to regulations via one or more repositories of internal regulations of respective organizations. Once controller generates benchmarks that objectively verify compliance of regulations the controller may cause one of compliance systems to execute an automated test using these benchmarks. This automated test may objectively verify compliance of each regulation);
for each custom control, determine a plurality of scores for the respective reference controls using a supervised natural language processing machine learning model such that the plurality of scores are based at least on respective probabilities that the respective first subsets of the text-based features of the respective reference controls correspond to the second subset of the text-based features of the custom control (Paragraph [0009-0011]; [0014]; [0018-0022]; aspects of the present disclosure relate to managing compliance standards for an organizing, the disclosure relate to dynamically and autonomously identifying and pairing regulations for an organization with benchmarks that can verify objective compliance with said regulations, and therein updating these across various organizations. The controller may identify these benchmarks in a manner such that they can objectively measure whether or not the regulation has been complied with or not. The controller may interface with a system that executes automated and autonomous tests to verify compliance. The controller may use machine learning techniques to learn and improve at the act of identifying benchmarks for compliance. Controller may verify compliance for organizations via a set of benchmarks derived from existing variables from one or more data processing applications and/or one or more record-keeping application of organization. Controller may be fed or otherwise be given access to regulations via one or more repositories of internal regulations of respective organizations. Once controller generates benchmarks that objectively verify compliance of regulations the controller may cause one of compliance systems to execute an automated test using these benchmarks. This automated test may objectively verify compliance of each regulation. Once controller causes an automated test to run the controller may send a report to a respective organization, where this report may provide metrics on compliance of the regulations).
Before the effective filing date of the invention it would be obvious to one of ordinary skill in the art to modify the system of mapping compliance standards as disclosed by Shaw with the system of identify custom controls of a custom control framework that define respective custom actions that, when performed, cause the cloud service to comply with a second compliance standard that is different from the first compliance standard, each custom control having a respective second subset of the text-based features such that each text-based feature in the respective second subset includes information regarding the custom control; for each custom control, determine a plurality of scores for the respective reference controls using a supervised natural language processing machine learning model such that the plurality of scores are based at least on respective probabilities that the respective first subsets of the text-based features of the respective reference controls correspond to the second subset of the text-based features of the custom control as taught by Erwin (Erwin [0043]). With the motivation of verifying the compliance of a software application (Erwin [0001]).
In the same field of endeavor of mapping regulation controls Duchin teaches for each custom control, determine a plurality of scores for the respective reference controls using a supervised natural language processing machine learning model such that the plurality of scores are based at least on respective probabilities that the respective first subsets of the text-based features of the respective reference controls correspond to the second subset of the text-based features of the custom control (Paragraph [0017-0019]; [0026-0027]; [0041-0043]; [0046] Fig. 3, authoritative source (reference control) may comprise a regulation. Control (custom control) refers to electronic content that includes a statement with instructions for an enterprise to comply with one or more authoritative source. Mapping refers to a logic connection between one or more authoritative source and one or more controls. The compliance management platform, on behalf of respective infrastructure tenants each corresponding to one or more users associated with respective client devices, implements a recommendation engine to provide clients with recommendations for mapping between authoritative sources and controls. Users are provided with insights and reasons for a recommended mapping including, for example, similar authoritative sources already mapped to a control, and similar text portions and/or similar intent within text portions between authoritative sources and controls. The compliance management platform may be implemented as part of a cloud infrastructure in the form of a cloud-based system. A similarity computation module computes a final similarity score between the new authoritative source and each existing control. In accordance with an embodiment of the present invention, there are two document corpuses, an authoritative source corpus and a controls corpus. For each corpus a different vector conversion module, which converts text into vectors, is created. For each of the existing controls a final similarity score with respect to the new authoritative source that is above a certain threshold, the candidate selection module selects these existing controls as candidate controls to be recommended to a user for mapping to the new authoritative source. Extracted features for each candidate control are input into a trained mapping classifier which predicts a likelihood that each candidate control will be mapped to the new authoritative source. In accordance with an embodiment of the invention, the likelihood may be expressed as a score between 0 and 1. If this score is above a threshold, the mapping of the candidate control to the authoritative source is recommended);
Reduce an amount of resources consumed by the system to generate a compliance map for the cloud service by automatically mapping each custom control of the custom control framework to a respective subset of the reference controls using the supervised natural language processing machine learning model based at least on each reference control in the respective subset of the reference controls having a score in the respective plurality of scores that satisfies a score criterion (Paragraph [0017-0019]; [0026-0027]; [0041-0043]; [0046] Fig. 3, authoritative source (reference control) may comprise a regulation. Control (custom control) refers to electronic content that includes a statement with instructions for an enterprise to comply with one or more authoritative source. Mapping refers to a logic connection between one or more authoritative source and one or more controls. The compliance management platform, on behalf of respective infrastructure tenants each corresponding to one or more users associated with respective client devices, implements a recommendation engine to provide clients with recommendations for mapping between authoritative sources and controls. Users are provided with insights and reasons for a recommended mapping including, for example, similar authoritative sources already mapped to a control, and similar text portions and/or similar intent within text portions between authoritative sources and controls. The compliance management platform may be implemented as part of a cloud infrastructure in the form of a cloud-based system. A similarity computation module computes a final similarity score between the new authoritative source and each existing control. In accordance with an embodiment of the present invention, there are two document corpuses, an authoritative source corpus and a controls corpus. For each corpus a different vector conversion module, which converts text into vectors, is created. For each of the existing controls a final similarity score with respect to the new authoritative source that is above a certain threshold, the candidate selection module selects these existing controls as candidate controls to be recommended to a user for mapping to the new authoritative source. Extracted features for each candidate control are input into a trained mapping classifier which predicts a likelihood that each candidate control will be mapped to the new authoritative source. In accordance with an embodiment of the invention, the likelihood may be expressed as a score between 0 and 1. If this score is above a threshold, the mapping of the candidate control to the authoritative source is recommended).
Before the effective filing date of the invention it would be obvious to one of ordinary skill in the art to modify the system of mapping compliance standards as disclosed by Shaw with the system of for each custom control, determine a plurality of scores for the respective reference controls using a supervised natural language processing machine learning model such that the plurality of scores are based at least on respective probabilities that the respective first subsets of the text-based features of the respective reference controls correspond to the second subset of the text-based features of the custom control; Reduce an amount of resources consumed by the system to generate a compliance map for the cloud service by automatically mapping each custom control of the custom control framework to a respective subset of the reference controls using the supervised natural language processing machine learning model based at least on each reference control in the respective subset of the reference controls having a score in the respective plurality of scores that satisfies a score criterion as taught by Duchin (Duchin [0046]). With the motivation of helping to updating controls in a cloud-based environment and mapping them to regulations from a regulatory body to confirm they are compliant (Duchin [0004]).
Claims 2 and 12: Modified Shaw discloses the system as per claim 1 and the method as per claim 11. Shaw further discloses wherein the processing system is configured to: convert the text-based features in each second subset into respective embeddings associated with the respective custom control using an input encoder (Paragraph [0013-0015]; [0019-0020]; Fig. 1, methods and systems disclosed herein may provide for the mapping of compliance standards to particular products and/or services. When a user would like to know how a product or service measures up against a compliance standard, the user may query the mapped standards and access a report without the need to contact an expert on the compliance standard. A compliance standards mapping system may provide functionality to map standard content, thereby allowing a user to determine whether devices comply with standards. Standard content may include text files. Compliance standards mapping system may receive standards content through a compliance standard input processor. Compliance standard input processor may receive standard content as inputted information in an automated process, whereby the standard content is inputted to compliance standards input processor from an archive of information. Compliance standard input processor may output standards content to a compliance mapping database. Compliance mapping database may include structure that allows standards content to be stored and organized);
and for each custom control, determine the plurality of scores for the respective reference controls using the input vector associated with the custom control as an input to a multi-label classifier that is included in the supervised natural language processing machine learning model (Paragraph [0013-0015]; [0019-0020]; [0032-0033]; Fig. 1, methods and systems disclosed herein may provide for the mapping of compliance standards to particular products and/or services. When a user would like to know how a product or service measures up against a compliance standard, the user may query the mapped standards and access a report without the need to contact an expert on the compliance standard. A compliance standards mapping system may provide functionality to map standard content, thereby allowing a user to determine whether devices comply with standards. Standard content may include text files. Compliance standards mapping system may receive standards content through a compliance standard input processor. Compliance standard input processor may receive standard content as inputted information in an automated process, whereby the standard content is inputted to compliance standards input processor from an archive of information. Compliance standard input processor may output standards content to a compliance mapping database. Compliance mapping database may include structure that allows standards content to be stored and organized. Compliance report generator may collect information from compliance mapping database and the information may indicate that the product queried by the user does not meet a threshold requirement for one or more standards content. A threshold requirement may refer to a minimally accepted compliance score).
However, Shaw does not disclose concatenate the embeddings associated with each custom control into a respective input vector.
In the same field of endeavor of managing compliance regulations Erwin teaches concatenate the embeddings associated with each custom control into a respective input vector (Paragraph [0009-0011]; [0014]; [0018-0022]; [0043] aspects of the present disclosure relate to managing compliance standards for an organizing, the disclosure relate to dynamically and autonomously identifying and pairing regulations for an organization with benchmarks that can verify objective compliance with said regulations, and therein updating these across various organizations. The controller may identify these benchmarks in a manner such that they can objectively measure whether or not the regulation has been complied with or not. The controller may interface with a system that executes automated and autonomous tests to verify compliance. The controller may use machine learning techniques to learn and improve at the act of identifying benchmarks for compliance. Controller may verify compliance for organizations via a set of benchmarks derived from existing variables from one or more data processing applications and/or one or more record-keeping application of organization. Controller may be fed or otherwise be given access to regulations via one or more repositories of internal regulations of respective organizations. Once controller generates benchmarks that objectively verify compliance of regulations the controller may cause one of compliance systems to execute an automated test using these benchmarks. This automated test may objectively verify compliance of each regulation. Once controller causes an automated test to run the controller may send a report to a respective organization, where this report may provide metrics on compliance of the regulations. Machine learning techniques can include decision tree learning, artificial neural networks, support vector machines, etc.).
Before the effective filing date of the invention it would be obvious to one of ordinary skill in the art to modify the system of mapping compliance standards as disclosed by Shaw with the system of identify custom controls of a custom control framework that define respective custom actions that, when performed, cause the cloud service to comply with a second compliance standard that is different from the first compliance standard, each custom control having a respective second subset of the text-based features such that each text-based feature in the respective second subset includes information regarding the custom control; for each custom control, determine a plurality of scores for the respective reference controls using a supervised natural language processing machine learning model such that the plurality of scores are based at least on respective probabilities that the respective first subsets of the text-based features of the respective reference controls correspond to the second subset of the text-based features of the custom control as taught by Erwin (Erwin [0043]). With the motivation of verifying the compliance of a software application (Erwin [0001]).
Claims 3 and 13: Modified Shaw discloses the system as per claim 1 and the method as per claim 11. However, Shaw does not disclose wherein the processing system is configured to: concatenate the text-based features of each second subset to provide a text- based vector for the respective custom control; convert each text-based vector into an input vector associated with the respective custom control by using an input encoder to embed the text-based features that are concatenated in the text-based vector, and for each custom control, determine the plurality of scores for the respective reference controls using the input vector associated with the custom control as an input to the supervised natural language processing machine learning model.
In the same field of endeavor of managing compliance regulations Erwin teaches wherein the processing system is configured to: concatenate the text-based features of each second subset to provide a text- based vector for the respective custom control; convert each text-based vector into an input vector associated with the respective custom control by using an input encoder to embed the text-based features that are concatenated in the text-based vector (Paragraph [0009-0011]; [0014]; [0018-0022]; [0043] aspects of the present disclosure relate to managing compliance standards for an organizing, the disclosure relate to dynamically and autonomously identifying and pairing regulations for an organization with benchmarks that can verify objective compliance with said regulations, and therein updating these across various organizations. The controller may identify these benchmarks in a manner such that they can objectively measure whether or not the regulation has been complied with or not. The controller may interface with a system that executes automated and autonomous tests to verify compliance. The controller may use machine learning techniques to learn and improve at the act of identifying benchmarks for compliance. Controller may verify compliance for organizations via a set of benchmarks derived from existing variables from one or more data processing applications and/or one or more record-keeping application of organization. Controller may be fed or otherwise be given access to regulations via one or more repositories of internal regulations of respective organizations. Once controller generates benchmarks that objectively verify compliance of regulations the controller may cause one of compliance systems to execute an automated test using these benchmarks. This automated test may objectively verify compliance of each regulation. Once controller causes an automated test to run the controller may send a report to a respective organization, where this report may provide metrics on compliance of the regulations. Machine learning techniques can include decision tree learning, artificial neural networks, support vector machines, etc.).
Before the effective filing date of the invention it would be obvious to one of ordinary skill in the art to modify the system of mapping compliance standards as disclosed by Shaw with the system of identify custom controls of a custom control framework that define respective custom actions that, when performed, cause the cloud service to comply with a second compliance standard that is different from the first compliance standard, each custom control having a respective second subset of the text-based features such that each text-based feature in the respective second subset includes information regarding the custom control; for each custom control, determine a plurality of scores for the respective reference controls using a supervised natural language processing machine learning model such that the plurality of scores are based at least on respective probabilities that the respective first subsets of the text-based features of the respective reference controls correspond to the second subset of the text-based features of the custom control as taught by Erwin (Erwin [0043]). With the motivation of verifying the compliance of a software application (Erwin [0001]).
In the same field of endeavor of mapping regulation controls Duchin teaches and for each custom control, determine the plurality of scores for the respective reference controls using the input vector associated with the custom control as an input to the supervised natural language processing machine learning model (Paragraph [0017-0019]; [0026-0027]; [0041-0043]; [0046] Fig. 3, authoritative source (reference control) may comprise a regulation. Control (custom control) refers to electronic content that includes a statement with instructions for an enterprise to comply with one or more authoritative source. Mapping refers to a logic connection between one or more authoritative source and one or more controls. The compliance management platform, on behalf of respective infrastructure tenants each corresponding to one or more users associated with respective client devices, implements a recommendation engine to provide clients with recommendations for mapping between authoritative sources and controls. Users are provided with insights and reasons for a recommended mapping including, for example, similar authoritative sources already mapped to a control, and similar text portions and/or similar intent within text portions between authoritative sources and controls. The compliance management platform may be implemented as part of a cloud infrastructure in the form of a cloud-based system. A similarity computation module computes a final similarity score between the new authoritative source and each existing control. In accordance with an embodiment of the present invention, there are two document corpuses, an authoritative source corpus and a controls corpus. For each corpus a different vector conversion module, which converts text into vectors, is created. For each of the existing controls a final similarity score with respect to the new authoritative source that is above a certain threshold, the candidate selection module selects these existing controls as candidate controls to be recommended to a user for mapping to the new authoritative source. Extracted features for each candidate control are input into a trained mapping classifier which predicts a likelihood that each candidate control will be mapped to the new authoritative source. In accordance with an embodiment of the invention, the likelihood may be expressed as a score between 0 and 1. If this score is above a threshold, the mapping of the candidate control to the authoritative source is recommended).
Before the effective filing date of the invention it would be obvious to one of ordinary skill in the art to modify the system of mapping compliance standards as disclosed by Shaw with the system of for each custom control, determine a plurality of scores for the respective reference controls using a supervised natural language processing machine learning model such that the plurality of scores are based at least on respective probabilities that the respective first subsets of the text-based features of the respective reference controls correspond to the second subset of the text-based features of the custom control; Reduce an amount of resources consumed by the system to generate a compliance map for the cloud service by automatically mapping each custom control of the custom control framework to a respective subset of the reference controls using the supervised natural language processing machine learning model based at least on each reference control in the respective subset of the reference controls having a score in the respective plurality of scores that satisfies a score criterion as taught by Duchin (Duchin [0046]). With the motivation of helping to updating controls in a cloud-based environment and mapping them to regulations from a regulatory body to confirm they are compliant (Duchin [0004]).
Claims 4 and 14: Modified Shaw discloses the system as per claim 1 and the method as per claim 11. Shaw further discloses wherein the processing system is further configured to: based at least on receipt of a user-specified rule, which indicates a maximum number of reference controls to be included in each subset of the reference controls to which a respective custom control is to be mapped, define each subset of the reference controls to which a respective custom control is to be mapped to include no more than the maximum number of reference controls (Paragraph [0013-0015]; [0019-0020]; [0032-0033]; Fig. 1, methods and systems disclosed herein may provide for the mapping of compliance standards to particular products and/or services. When a user would like to know how a product or service measures up against a compliance standard, the user may query the mapped standards and access a report without the need to contact an expert on the compliance standard. A compliance standards mapping system may provide functionality to map standard content, thereby allowing a user to determine whether devices comply with standards. Standard content may include text files. Compliance standards mapping system may receive standards content through a compliance standard input processor. Compliance standard input processor may receive standard content as inputted information in an automated process, whereby the standard content is inputted to compliance standards input processor from an archive of information. Compliance standard input processor may output standards content to a compliance mapping database. Compliance mapping database may include structure that allows standards content to be stored and organized. Compliance report generator may collect information from compliance mapping database and the information may indicate that the product queried by the user does not meet a threshold requirement for one or more standards content. A threshold requirement may refer to a minimally accepted compliance score).
Claims 5 and 15: Modified Shaw discloses the system as per claim 1 and the method as per claim 11. Shaw further discloses wherein the processing system is configured to: for each custom control, determine confidences in the respective probabilities on which the plurality of respective scores are based; and generate the compliance map for the cloud service by automatically mapping each custom control of the custom control framework to the respective subset of the reference controls using the supervised natural language processing machine learning model further based at least on the confidence in the probability associated with each reference control in the respective subset of the reference controls being greater than or equal to a confidence threshold (Paragraph [0013-0015]; [0019-0020]; [0032-0033]; Fig. 1, methods and systems disclosed herein may provide for the mapping of compliance standards to particular products and/or services. When a user would like to know how a product or service measures up against a compliance standard, the user may query the mapped standards and access a report without the need to contact an expert on the compliance standard. A compliance standards mapping system may provide functionality to map standard content, thereby allowing a user to determine whether devices comply with standards. Standard content may include text files. Compliance standards mapping system may receive standards content through a compliance standard input processor. Compliance standard input processor may receive standard content as inputted information in an automated process, whereby the standard content is inputted to compliance standards input processor from an archive of information. Compliance standard input processor may output standards content to a compliance mapping database. Compliance mapping database may include structure that allows standards content to be stored and organized. Compliance report generator may collect information from compliance mapping database and the information may indicate that the product queried by the user does not meet a threshold requirement for one or more standards content. A threshold requirement may refer to a minimally accepted compliance score).
Claims 6 and 16: Modified Shaw discloses the system as per claim 1 and the method as per claim 11. Shaw further discloses wherein the processing system is further configured to: for each custom control, cause an identifier that is associated with each reference control in the subset of the reference controls that is mapped to the custom control and the score for the respective reference control to be presented via a first user interface (Paragraph [0013-0015]; [0019-0020]; [0032-0033]; Fig. 1, methods and systems disclosed herein may provide for the mapping of compliance standards to particular products and/or services. When a user would like to know how a product or service measures up against a compliance standard, the user may query the mapped standards and access a report without the need to contact an expert on the compliance standard. A compliance standards mapping system may provide functionality to map standard content, thereby allowing a user to determine whether devices comply with standards. Standard content may include text files. Compliance standards mapping system may receive standards content through a compliance standard input processor. Compliance standard input processor may receive standard content as inputted information in an automated process, whereby the standard content is inputted to compliance standards input processor from an archive of information. Compliance standard input processor may output standards content to a compliance mapping database. Compliance mapping database may include structure that allows standards content to be stored and organized. Compliance report generator may collect information from compliance mapping database and the information may indicate that the product queried by the user does not meet a threshold requirement for one or more standards content. A threshold requirement may refer to a minimally accepted compliance score);
for each custom control, identify a user-selected control that is selected via a second user interface from the respective subset of the reference controls that is mapped to the custom control (Paragraph [0013-0015]; [0019-0020]; [0032-0033]; Fig. 1, methods and systems disclosed herein may provide for the mapping of compliance standards to particular products and/or services. When a user would like to know how a product or service measures up against a compliance standard, the user may query the mapped standards and access a report without the need to contact an expert on the compliance standard. A compliance standards mapping system may provide functionality to map standard content, thereby allowing a user to determine whether devices comply with standards. Standard content may include text files. Compliance standards mapping system may receive standards content through a compliance standard input processor. Compliance standard input processor may receive standard content as inputted information in an automated process, whereby the standard content is inputted to compliance standards input processor from an archive of information. Compliance standard input processor may output standards content to a compliance mapping database. Compliance mapping database may include structure that allows standards content to be stored and organized. Compliance report generator may collect information from compliance mapping database and the information may indicate that the product queried by the user does not meet a threshold requirement for one or more standards content. A threshold requirement may refer to a minimally accepted compliance score).
However, Shaw does not disclose and train the supervised natural language processing machine learning model by providing sample input-output pairs to the supervised natural language processing machine learning model, each sample input-output pair including a respective input that represents a respective custom control of the custom control framework and a respective output that represents the user-selected control that is selected via the second user interface from the respective subset of the reference controls that is mapped to the respective custom control.
In the same field of endeavor of managing compliance regulations Erwin teaches and train the supervised natural language processing machine learning model by providing sample input-output pairs to the supervised natural language processing machine learning model, each sample input-output pair including a respective input that represents a respective custom control of the custom control framework and a respective output that represents the user-selected control that is selected via the second user interface from the respective subset of the reference controls that is mapped to the respective custom control (Paragraph [0009-0011]; [0014]; [0018-0022]; [0043] aspects of the present disclosure relate to managing compliance standards for an organizing, the disclosure relate to dynamically and autonomously identifying and pairing regulations for an organization with benchmarks that can verify objective compliance with said regulations, and therein updating these across various organizations. The controller may identify these benchmarks in a manner such that they can objectively measure whether or not the regulation has been complied with or not. The controller may interface with a system that executes automated and autonomous tests to verify compliance. The controller may use machine learning techniques to learn and improve at the act of identifying benchmarks for compliance. Controller may verify compliance for organizations via a set of benchmarks derived from existing variables from one or more data processing applications and/or one or more record-keeping application of organization. Controller may be fed or otherwise be given access to regulations via one or more repositories of internal regulations of respective organizations. Once controller generates benchmarks that objectively verify compliance of regulations the controller may cause one of compliance systems to execute an automated test using these benchmarks. This automated test may objectively verify compliance of each regulation. Once controller causes an automated test to run the controller may send a report to a respective organization, where this report may provide metrics on compliance of the regulations. Machine learning techniques can include decision tree learning, artificial neural networks, support vector machines, etc.).
Before the effective filing date of the invention it would be obvious to one of ordinary skill in the art to modify the system of mapping compliance standards as disclosed by Shaw with the system of identify custom controls of a custom control framework that define respective custom actions that, when performed, cause the cloud service to comply with a second compliance standard that is different from the first compliance standard, each custom control having a respective second subset of the text-based features such that each text-based feature in the respective second subset includes information regarding the custom control; for each custom control, determine a plurality of scores for the respective reference controls using a supervised natural language processing machine learning model such that the plurality of scores are based at least on respective probabilities that the respective first subsets of the text-based features of the respective reference controls correspond to the second subset of the text-based features of the custom control as taught by Erwin (Erwin [0043]). With the motivation of verifying the compliance of a software application (Erwin [0001]).
Claims 7 and 17: Modified Shaw discloses the system as per claim 1 and the method as per claim 11. Shaw further discloses wherein the processing system is further configured to: train the NLP ML model using labels, which includes causing the NLP ML model to take into consideration dependencies between the labels by optimizing weights associated with the respective reference controls simultaneously for each custom control; and wherein each of the labels indicates a mapping of a custom control to a reference control.
In the same field of endeavor of managing compliance regulations Erwin teaches wherein the processing system is further configured to: train the NLP ML model using labels, which includes causing the NLP ML model to take into consideration dependencies between the labels by optimizing weights associated with the respective reference controls simultaneously for each custom control; and wherein each of the labels indicates a mapping of a custom control to a reference control (Paragraph [0009-0011]; [0014]; [0018-0022]; [0043] aspects of the present disclosure relate to managing compliance standards for an organizing, the disclosure relate to dynamically and autonomously identifying and pairing regulations for an organization with benchmarks that can verify objective compliance with said regulations, and therein updating these across various organizations. The controller may identify these benchmarks in a manner such that they can objectively measure whether or not the regulation has been complied with or not. The controller may interface with a system that executes automated and autonomous tests to verify compliance. The controller may use machine learning techniques to learn and improve at the act of identifying benchmarks for compliance. Controller may verify compliance for organizations via a set of benchmarks derived from existing variables from one or more data processing applications and/or one or more record-keeping application of organization. Controller may be fed or otherwise be given access to regulations via one or more repositories of internal regulations of respective organizations. Once controller generates benchmarks that objectively verify compliance of regulations the controller may cause one of compliance systems to execute an automated test using these benchmarks. This automated test may objectively verify compliance of each regulation. Once controller causes an automated test to run the controller may send a report to a respective organization, where this report may provide metrics on compliance of the regulations. Machine learning techniques can include decision tree learning, artificial neural networks, support vector machines, etc.).
Before the effective filing date of the invention it would be obvious to one of ordinary skill in the art to modify the system of mapping compliance standards as disclosed by Shaw with the system of identify custom controls of a custom control framework that define respective custom actions that, when performed, cause the cloud service to comply with a second compliance standard that is different from the first compliance standard, each custom control having a respective second subset of the text-based features such that each text-based feature in the respective second subset includes information regarding the custom control; for each custom control, determine a plurality of scores for the respective reference controls using a supervised natural language processing machine learning model such that the plurality of scores are based at least on respective probabilities that the respective first subsets of the text-based features of the respective reference controls correspond to the second subset of the text-based features of the custom control as taught by Erwin (Erwin [0043]). With the motivation of verifying the compliance of a software application (Erwin [0001]).
Claims 8 and 18: Modified Shaw discloses the system as per claim 1 and the method as per claim 11. Shaw further discloses wherein the first subset of text-based features of each reference control indicates at least one of the following: a control type in which the reference control is categorized; a title of the reference control; a description of functionality of the reference control; a manner in which the reference control is implemented (Paragraph [0013-0015]; [0019-0020]; [0032-0033]; Fig. 1, methods and systems disclosed herein may provide for the mapping of compliance standards to particular products and/or services. When a user would like to know how a product or service measures up against a compliance standard, the user may query the mapped standards and access a report without the need to contact an expert on the compliance standard. A compliance standards mapping system may provide functionality to map standard content, thereby allowing a user to determine whether devices comply with standards. Standard content may include text files. Compliance standards mapping system may receive standards content through a compliance standard input processor. Compliance standard input processor may receive standard content as inputted information in an automated process, whereby the standard content is inputted to compliance standards input processor from an archive of information. Compliance standard input processor may output standards content to a compliance mapping database. Compliance mapping database may include structure that allows standards content to be stored and organized. Compliance report generator may collect information from compliance mapping database and the information may indicate that the product queried by the user does not meet a threshold requirement for one or more standards content. A threshold requirement may refer to a minimally accepted compliance score).
Claims 9 and 19: Modified Shaw discloses the system as per claim 1 and the method as per claim 11. Shaw further discloses wherein the processing system is further configured to: cause a user interface to be presented, the user interface specifying each reference control in each subset of the reference controls that is mapped to a respective custom control of the custom control framework, the user interface enabling a user to perform the following actions for each subset of the reference controls: approve inclusion of each reference control in the subset of the reference controls; remove each reference control from the subset of the reference controls; and add a reference control to the subset of the reference controls (Paragraph [0013-0015]; [0019-0020]; [0032-0033]; Fig. 1, methods and systems disclosed herein may provide for the mapping of compliance standards to particular products and/or services. When a user would like to know how a product or service measures up against a compliance standard, the user may query the mapped standards and access a report without the need to contact an expert on the compliance standard. A compliance standards mapping system may provide functionality to map standard content, thereby allowing a user to determine whether devices comply with standards. Standard content may include text files. Compliance standards mapping system may receive standards content through a compliance standard input processor. Compliance standard input processor may receive standard content as inputted information in an automated process, whereby the standard content is inputted to compliance standards input processor from an archive of information. Compliance standard input processor may output standards content to a compliance mapping database. Compliance mapping database may include structure that allows standards content to be stored and organized. Compliance report generator may collect information from compliance mapping database and the information may indicate that the product queried by the user does not meet a threshold requirement for one or more standards content. A threshold requirement may refer to a minimally accepted compliance score).
Claim 10: Modified Shaw discloses the system as per claim 1. Shaw further discloses wherein the processing system is further configured to: identify an additional control that is configured to enable the cloud service to further comply with the second compliance standard; and cause a recommendation to be provided via a user interface, the recommendation recommending addition of the additional control to the custom control framework (Paragraph [0013-0015]; [0019-0020]; [0032-0033]; [0068]; Fig. 1, methods and systems disclosed herein may provide for the mapping of compliance standards to particular products and/or services. When a user would like to know how a product or service measures up against a compliance standard, the user may query the mapped standards and access a report without the need to contact an expert on the compliance standard. A compliance standards mapping system may provide functionality to map standard content, thereby allowing a user to determine whether devices comply with standards. Standard content may include text files. Compliance standards mapping system may receive standards content through a compliance standard input processor. Compliance standard input processor may receive standard content as inputted information in an automated process, whereby the standard content is inputted to compliance standards input processor from an archive of information. Compliance standard input processor may output standards content to a compliance mapping database. Compliance mapping database may include structure that allows standards content to be stored and organized. Compliance report generator may collect information from compliance mapping database and the information may indicate that the product queried by the user does not meet a threshold requirement for one or more standards content. A threshold requirement may refer to a minimally accepted compliance score. In one or more examples, systems and methods disclosed herein may be used to suggest alternative products when a request product does not meet a required standards content).
Therefore, claims 1-20 are rejected under U.S.C. 103.
Response to arguments
Applicant’s arguments, see REMARKS, filed December 29, 2025, with respect to the rejections of Claim(s) 1-20 is/are rejected under 35 U.S.C. 101 are considered and not persuasive.
Claims 1, 11, and 20: Representative argues that the amended claims do not recite an abstract idea as they recite “reducing an amount of resources consumed by the system to generate a compliance map and perform an action that facilitates compliance with the second compliance standard.” However, the examiner respectfully disagrees as the claims recite identifying reference controls, receiving a question pertaining to a compliance of the cloud service with a second compliance standard that is different from the first compliance standard, determining scores for the respective reference controls, generate a compliance map by mapping the question to a subset of reference controls, and based on the compliance map, performing an action that facilitates compliance with the second compliance standard. The examiner finds that merely having a plurality of reference controls or regulations, receiving a question or a query pertaining to a second compliance standard is different from the first, and determining a response by determining scores based on the probabilities that the first subset of text based features of the reference control correspond to a second subset of text based features of the question, generating a compliance map, and performing an action based on the compliance map are a mental process. As a person is capable of mentally, or with simple tools such as pen and paper, of receiving a question pertaining to a new compliance standard and determining the possibility that the text of the new compliance standard matches the text features of a first reference control and subsequently mapping the question to a subset of reference controls to determine an action that can be performed in compliance with the controls. The claims merely recite a series of steps of receiving and analyzing text-based information by comparing textual features and mapping the elements based on the probability that the text-based features correspond. Therefore, the claims recite an abstract idea.
The representative further argues that the additional elements are directed to a practical application. However, the examiner respectfully disagrees as the additional elements of a computing system and a supervised natural language processing machine learning model to receive and process information to generate a probability score and generate a compliance map are directed to merely “apply it” or applying generic computer elements to perform that abstract idea. The claims do not recite an improvement to a technology or technical field but merely using generic computer elements to receive and analyze information and determine a result.
Therefore, the examiner maintains the current 101 rejection.
Claims 2-10 and 12-19 were dependent on claims 1, 11, and 20 Therefore, they are also rejected under the same rejection as above.
Applicant’s arguments, see REMARKS, filed December 29, 2025, with respect to the rejections of 1-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Shaw (US 2020/0258093) in view of Erwin (US 2023/0316184) further in view of Duchin (US 2020/0143388) are not persuasive as the claims were amended which required further search and consideration and new art was applied.
Claims 1, 11, and 20: Applicant argues that the current prior art does not disclose the newly amended claim limitations. However, upon further search and consideration the examiner finds that the combination of Shaw, Erwin, and Duchin disclose the newly amended claim limitations. Shaw discloses a system of mapping compliance standards by receiving new standard content from a user and using a model to map the new standard to compliance standards in a database. While Erwin teaches a system of receiving a request to automatically generate a compliance verification framework to receive a plurality of organization regulations and determine if they match industry standards. The current prior art can be further combined with Duchin to disclose the current claim limitations as Duchin teaches a system of mapping regulation controls. Duchin teaches a system of receiving a plurality of new controls and using a machine learning model to generate a vector representation of the new controls and compare them to existing controls to determine a likelihood that the new control relates to and can be mapped to an existing control. Therefore, the current combination of prior art teaches the newly amended claim limitations.
Therefore, claim 1, 11, and 20 are newly rejected under U.S.C. 103.
Claims 2-10 and 12-19 were dependent on claims 1, 11, and 20. Therefore, they are also newly rejected under the same rejection as above.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant’s disclosure:
Adebayo (US 2023/0229812) AI-assisted compliance mapping.
Wells (US 2021/0295351) Automated construction of compliant cloud environments.
Phoenix (US 2020/0073782) Determining compliance of software applications to compliance standards based on mapped application capabilities.
Ravi (US 2014/0026131) Automatic deployment of software applications to meet regulatory compliance requirements.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to COREY RUSS whose telephone number is (571)270-5902. The examiner can normally be reached on M-F 7:30-4:30.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Lynda Jasmin can be reached on 5712726782. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be
obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/COREY RUSS/Primary Examiner, Art Unit 3629
Prosecution Insights