DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Status of Claims
The following is a final office action.
Claims 1-9 and 11-21 are currently pending and have been examined on their merits.
Claims 1-9, and 11-20 are currently amended see REMARKS July 23, 2026.
Claim 10 is newly cancelled see REMARKS July 23, 2026.
Claim 21 is newly added see REMARKS July 23, 2026.
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on July 23, 2026 has been entered.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-9 and 11-21 are rejected under 35 U.S.C 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1: Claims 1-9 and 21 recite a system, Claim 11-19 recites a method (i.e. a series of steps), and claim 20 recite a computer program product and therefore each claim falls within one of the four statutory categories.
Step 2A prong 1 (Is a judicial exception recited?):
The representative claims 1 and 20 recite: identify reference controls of a reference control framework that define respective reference actions that, when performed, cause a cloud service to comply with a first compliance standard, a reference control having a respective first subset of text-based features such that a text-based feature in the respective first subset includes information regarding the reference control; identify custom controls of a custom control framework that define respective custom actions that, when performed, cause the cloud service to comply with a second compliance standard that is different from the first compliance standard, each custom control having a respective second subset of the text-based features such that each text-based feature in the respective second subset includes information regarding the custom control; generate an input vector for the custom control of the custom control framework, the input vector representing the respective second subset of the text-based features associated with the custom control; process the input vector by generating an output vector having dimensions corresponding respectively to the reference controls, the dimensions including respective probabilities that the respective first subsets of the text-based features of the reference controls correspond to the respective second subset of the text-based features associated with the custom control; determine a plurality of scores for the reference controls by calculating the plurality of scores form the respective probabilities included in the dimensions of the output vector; generate a compliance map for the cloud service by assigning the custom control of the custom control framework to a subset of the reference controls for which the plurality of scores satisfy a score criterion; control operation of a compliance application by causing the compliance application to access the compliance map and identify, for the custom control of the custom control framework, the subset of the reference controls to which the custom control is assigned; and identify an additional control that is configured to enable the cloud service to further comply with the second compliance standard regarding security of data and provide a recommendation recommending addition of the additional control to the custom control framework.
Claim 11: A method, the method comprising: identifying reference controls of a reference control framework that define respective reference actions that, when performed, cause a cloud service to comply with a first compliance standard, a reference control having a respective first subset of text-based features such that a text-based feature in the respective first subset includes information regarding the reference control; receiving a question pertaining to compliance of the cloud service with a second compliance standard regarding security of data that is different from the first compliance standard, the question having a second subset of the text-based features such that each text-based feature in the second subset includes information regarding the question; generating an input vector that represents the second subset of the text-based features associated with the question; processing the input vector by generating an output vector having dimensions corresponding respectively to the reference controls, the dimensions including respective probabilities that the respective first subsets of the text-based features of the reference controls correspond to the second subset associated with the text-based features of the question; process the input vector by generating an output vector having dimensions corresponding respectively to the reference controls, the dimensions including respective probabilities that the respective first subsets of the text-based features of the reference controls correspond to the respective second subset of the text-based features associated with the custom control; determine a plurality of scores for the reference controls by calculating the plurality of scores form the respective probabilities included in the dimensions of the output vector; generate a compliance map for the cloud service by assigning the custom control of the custom control framework to a subset of the reference controls for which the plurality of scores satisfy a score criterion; control operation of a compliance application by causing the compliance application to access the compliance map and identify, for the custom control of the custom control framework, the subset of the reference controls to which the custom control is assigned; and identify an additional control that is configured to enable the cloud service to further comply with the second compliance standard regarding security of data and provide a recommendation recommending addition of the additional control to the custom control framework..
The claims recite a certain method of organizing human activity. The claims recite a certain method of organizing human activity as the disclosure recites commercial or legal interactions. The claims recite a series of steps for mapping custom controls to reference controls to generate a compliance map based on a plurality of scores and the respective probability that the text features of the reference control correspond to the custom controls. The claims merely recite a series of rules or steps to compare custom regulatory requirements and controls created by a user to reference controls to determine if the custom regulations correspond to reference regulations to evaluate if the custom regulations are compliant with industry standards.
Alternatively, the claims recite a mental process. The claims recite a method for determining a plurality of scores based on the probabilities that the reference control correspond to a custom control by mapping each custom control to a respective reference control which can be performed in the human mind or by using simple tools such as pen and paper. The courts have identified concepts such as observation, evaluation, judgement and opinion as reciting a mental process. Therefore, merely receiving and analyzing information by comparing a reference control and a custom control to determine if the custom control corresponds to the reference control is a mental process. A person such as a quality control agent is capable of mentally or with simple tool such as pen and paper of reviewing custom quality control regulations to determine if they correspond and match standard regulations and controls.
Step 2A Prong 2 (Is the exception integrated into a practical application?): The claims additionally recite;
Claim 1: A system comprising: memory; and a processing system coupled to the memory, the processing system configured to: and a supervised natural language processing machine learning model.
Claim 11: implemented by a computing system, reduce an amount of resources by the computing system, and using a supervised natural language processing machine learning model.
Claim 20: A computer program product comprising a computer-readable storage medium having instructions recorded thereon for enabling a processor-based system to perform operations, and using a supervised natural language processing machine learning model.
However, the additional elements merely amount to adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea, as discussed in MPEP 2106.05(f). Merely utilizing generic computer elements such as a computer and a user device to perform basic actions of the abstract idea by receiving, analyzing, and storing information. Furthermore, a method for processing and storing information does not amount to improvements to the functioning of a computer, or to any other technology or technical field, as discussed in MPEP 2106.05(a), applying the judicial exception with, or by use of, a particular machine, as discussed in MPEP 2106.05(b), effecting a transformation or reduction of a particular article to a different state or thing, as discussed in MPEP 2106.05(c), such that the claim as a whole is more than a drafting effort designed to monopolize the exception, as discussed in MPEP 2106.05(e). Accordingly, the additional elements do not integrate the abstract idea into a practical application because they do not impose any meaningful limits on practicing the abstract idea.
Step 2B (Does the claim recite additional elements that amount to significantly more that the judicial exception?): As discussed above, the additional imitations amount to adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea, as discussed in MPEP 2106.05(f). See reasoning for Step 2A prong 2. Therefore, the claims do not amount to significantly more as they do not recite an improvement to a technology or technical field. The claims merely recite “apply it” or applying generic computer elements to receiving and analyze information.
Claims 2-9 and 12-19, and 21 are directed to further narrowing the abstract idea of analyzing custom controls and determining a plurality of scores for mapping the custom controls to reference controls as disclosed by the independent claims 1, 11, and 20.
Additional elements recited by the dependent claims include:
Claims 6, 9, 16, and 19: a first user interface and a second user interface
However, these elements are directed to merely “apply it” or applying generic computer elements to perform the abstract idea.
Therefore, claims 1-20 are rejected under U.S.C. 101.
Response to arguments
Applicant’s arguments, see REMARKS, filed July 23, 2026, with respect to the rejections of Claim(s) 1-9 and 10-21 is/are rejected under 35 U.S.C. 101 are considered and not persuasive.
Claims 1, 11, and 20: Representative argues that the amended claims do not recite an abstract idea as they recite a specific machine-learning architecture that generates input vectors, output vectors, probabilities, scores, and compliance maps, and that controls operation of a compliance application using the generated compliance maps. However, the examiner respectfully disagrees as the claims recite identifying reference controls, receiving a question pertaining to a compliance of the cloud service with a second compliance standard that is different from the first compliance standard, generating an input vector representing a subset of text based features, generating an output vector corresponding to the reference controls including respective probabilities that the subset of text based features of a reference control correspond to a subset of text based features associated with the custom controls, determining scores for the respective reference controls, generate a compliance map by mapping the question to a subset of reference controls, and based on the compliance map, performing an action that facilitates compliance with the second compliance standard. The examiner finds that merely having a plurality of reference controls or regulations, receiving a question or a query pertaining to a second compliance standard is different from the first, and determining a response by determining scores based on the probabilities that the first subset of text based features of the reference control correspond to a second subset of text based features of the question, generating a compliance map, and performing an action based on the compliance map are a mental process. As a person is capable of mentally, or with simple tools such as pen and paper, of receiving a question pertaining to a new compliance standard and determining the possibility that the text of the new compliance standard matches the text features of a first reference control based on comparing vector representations of the text of the compliance standard and the reference control and subsequently mapping the question to a subset of reference controls to determine an action that can be performed in compliance with the controls. The claims merely recite a series of steps of receiving and analyzing text-based information by comparing textual features and mapping the elements based on the probability that the text-based features correspond. Therefore, the claims recite an abstract idea.
The representative further argues that the additional elements are directed to a practical application. However, the examiner respectfully disagrees as the additional elements of a computing system and a supervised natural language processing machine learning model to receive and process information to generate a probability score and generate a compliance map are directed to merely “apply it” or applying generic computer elements to perform that abstract idea. The claims do not recite an improvement to a technology or technical field but merely using generic computer elements to receive and analyze information and determine a result.
Therefore, the examiner maintains the current 101 rejection.
Claims 2-9, 12-19, and 21 were dependent on claims 1, 11, and 20 Therefore, they are also rejected under the same rejection as above.
Applicant’s arguments, see REMARKS, filed July 23, 2026, with respect to the rejections of 1-9 and 11-21 is/are rejected under 35 U.S.C. 103 as being unpatentable over Shaw (US 2020/0258093) in view of Erwin (US 2023/0316184) further in view of Duchin (US 2020/0143388) are persuasive.
Claims 1, 11, and 20: Applicant argues that the current prior art does not disclose the newly amended claim limitations.
The closest prior art Shaw (US 2020/0258093) discloses a system of mapping compliance standards by receiving new standard content from a user and using a model to map the new standard to compliance standards in a database.
The second closest prior art Erwin (US 2023/0316184) teaches a system of receiving a request to automatically generate a compliance verification framework to receive a plurality of organization regulations and determine if they match industry standards.
The third closes prior art Duchin (US 2020/0143388) teaches a system of mapping regulation controls. Duchin teaches a system of receiving a plurality of new controls and using a machine learning model to generate a vector representation of the new controls and compare them to existing controls to determine a likelihood that the new control relates to and can be mapped to an existing control.
However, the prior art individually and in combination do not disclose the newly amended claim limitation of “control operation of a compliance application by causing the compliance application to access the compliance map and identify, for the custom control of the custom control framework, the subset of the reference controls to which the custom control is assigned; and identify an additional control that is configured to enable the cloud service to further comply with the second compliance standard regarding security of data and provide a recommendation recommending addition of the additional control to the custom control framework.”
Therefore, claim 1, 11, and 20 are allowed over U.S.C. 103.
Claims 2-9, 12-19, and 21 were dependent on claims 1, 11, and 20. Therefore, they are also allowed over U.S.C. 103.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant’s disclosure:
Lin (US 2024/0152933) Automatic mapping of a question or compliance controls associated with a compliance standard to compliance controls associated with another compliance standard.
Bendapudi (US 2007/0260774) Wrapper for use with global standards compliance checkers.
Becker (US 2009/0326997) Managing a company’s compliance with multiple standards and performing cost/benefit analysis of the same.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to COREY RUSS whose telephone number is (571)270-5902. The examiner can normally be reached on M-F 7:30-4:30.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Lynda Jasmin can be reached on 5712726782. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be
obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/COREY RUSS/Primary Examiner, Art Unit 3629
Prosecution Insights