DETAILED ACTION
Notice of Pre-AIA or AIA Status
This is a non-final Office action in response to communications received on 07/31/2024. Claims 1 through 20 are presented for examination. The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Drawings
The drawings filed on 07/31/2024 are acknowledged.
Priority
No foreign priority or provisional date is recognized.
Objection to Specification
The abstract of the disclosure is objected to because of the language. The proper language and format for an abstract should be clear and concise and should not repeat information given in the title. It should avoid using phrases which can be implied, such as, “The disclosure concerns,” “The disclosure defined by this invention,” “The disclosure describes,” etc. In addition, the form and legal phraseology often used in patent claims, such as “means” and “said,” should be avoided.
A corrected abstract of the disclosure is required and must be presented on a separate sheet, apart from any other text. See MPEP § 608.01(b).
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The text of those sections of Title 35, U.S. Code not included in this action can be found in a prior Office action.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or non-obviousness.
Claims 1-5, 7-12, 14-18, and 20 are rejected under U.S.C 103 as being unpatentable over Brannon (US 20190384899A1) in view of Hader (US20210273978A1).
Regarding claim 1, Brannon discloses the limitations as follows:
A computer-implemented method comprising:
obtaining, by one or more computing devices, attributes of a target system;
(paras. [0006]- [0008], [0041]-[0043], fig.2: a scanning server (i.e. one or more computing devices) vendor devices and user devices (i.e. target system) to identify the vendor attributes and device characteristics)
determining, based on the attributes of the target system, a plurality of privacy criteria associated with maintaining compliance (paras. [0003]-[0005], [0036], [0041], [0044], [0228], fig.3: evaluating vendor and user device attributes (i.e. attributes of target system) to determine applicable privacy requirements for privacy practices, compliance with privacy regulations (i.e. plurality of privacy criteria), and data protection policies)
identifying, from a set of security controls, a subset of security controls in accordance with the plurality of security criteria (paras. [0006]-[0007], [0041], [0045], [0228] fig.3: identifying from a set of security certifications and security policies (i.e. security controls), a set of security policies and certifications that the vendor does or does not have (i.e. subset of security controls) that are applicable for determining risk of the vendor (i.e. security criteria))
based on the attributes of the target system (paras. [0003]- [0005], [0044]- [0047]: evaluating based on scanned attributes of vendor and user devices (i.e. attributes of the target system)
to the target system (paras. [0008], [0041], fig.2]: vendors (i.e. target system)
Brannon does not explicitly disclose the remaining part of the limitation as follows:
a plurality of security criteria associated with maintaining compliance with a set of target protocols;
determining a priority associated with each of the security controls in the subset of security controls, wherein the priority for each of the security controls is determined … and relationships of the security control with the set of target protocols
and implementing the subset of security controls
However, in the same field of endeavor, Hader discloses the remaining limitations of claim 1 as follows:
a plurality of security criteria associated with maintaining compliance with a set of target protocols (paras [0032-0033], [0042], table 1: evaluating compliance needs as key drivers for defining security requirements (i.e. plurality of security and privacy criteria) used to determine whether a system satisfies applicable frameworks and standards (i.e. maintaining compliance with a set of target protocols);
identifying, from a set of security controls, a subset of security controls in accordance with the plurality of security criteria; (paras [0024], [0036]: determining a set of security controls (i.e. set of security controls) and identifying a sub-set of security controls (i.e. a subset of security controls) selected from that set based on an evaluation score reflecting compliance-driven security requirements (i.e. in accordance with security criteria)
determining a priority associated with each of the security controls in the subset of security controls, wherein the priority for each of the security controls is determined (paras, [0004], [0025], [0030], [0034] determining and implementing a prioritization of security controls (i.e. determining a priority associated with each of the security controls) to reduce risk impact that are used to assess (i.e. determining based on attributes of the target system) security requirements)
and relationships of the security control with the set of target protocols (paras [0042], table 1; security controls which are mapped to frameworks and standards (i.e. relationships of the security control with set of target protocols)
and implementing the subset of security controls (paras [0024], [0036]: implementation of the subset of security controls (i.e. implementing the subset of security controls)
Hader is combinable with Brannon because both are from the same the same field of endeavor of computer-implemented techniques for assessing, and evaluating compliance mechanisms for a system. It would have been obvious to one of ordinary skill in the art at the time of the invention to integrate Hader’s security controls, and prioritization regarding security criteria with Brannon in order to prevent and reduce the impact of risk in an organization regarding the system’s specific assets.
Regarding claims 2 and 9, Brannon and Hader teach the limitations of the method of claim 1, and the non-transitory computer readable medium of claim 8.
Brannon and Hader teach the limitations of claims 2 and 9 as follows:
The computer-implemented method of claim 1, wherein the plurality of security and privacy criteria comprise requirements for risk assessment (Brannon, paras. [0006], [0390]-[0391]: performing risk assessment as part of security and privacy determination), information security program, data protection, employee training, and incident response. (Hader, paras. [0032-0033], [0035]- [0036], [0042], table 1: including requirements that comprise of and correspond to numerous listed frameworks from ISO/IEC 27001 and NIST, 800-53 such as Incident Response, Information Security Policies (i.e. information security program), Risk Assessment, Asset management & Systems and Communications Protection (i.e. data protection), Awareness and Training (i.e. employee training) and more; eventually are implicated in the controls)
Hader is combinable with Brannon because both are from the same the same field of endeavor of computer-implemented techniques for assessing, and evaluating compliance mechanisms for a system. It would have been obvious to one of ordinary skill in the art at the time of the invention to integrate Hader’s framework requirements with Brannon in order to demonstrate a proactive security posture as an organization, and adapt comprehensive coverage to address security in most levels.
Regarding claims 3 and 10, Brannon and Hader teach the limitations of the method of claim 1, and the non-transitory computer readable medium of claim 8.
Hader teaches the limitations of claims 3 and 10 as follows:
The computer-implemented method of claim 1, wherein the set of security controls comprise pre-defined security controls related to cyber security. (Hader, paras. [0035]-[0036], [0042], table 1: wherein the security controls are selected from an existing set defined by standards and frameworks (i.e. pre-defined security controls related to cybersecurity)
Hader is combinable with Brannon because both are from the same the same field of endeavor of computer-implemented techniques for assessing, and evaluating compliance mechanisms for a system. It would have been obvious to one of ordinary skill in the art at the time of the invention to integrate Hader’s pre-defined security controls with Brannon in order to provide a structured, consistent, and reliable approach to managing risks and ensuring regularly compliance.
Regarding claims 4, 11, and 17, Brannon and Hader teach the limitations of the method of claim 1, the non-transitory computer readable medium of claim 8, and the apparatus of claim 15.
Hader teaches the limitations of claims 4, 11, and 17 as follows:
The computer-implemented method of claim 1, wherein selecting the subset of security controls comprising: cross referencing each of the plurality of security and privacy criteria with each control included in the set of security controls to determine a relevance; (Hader paras [0006], [0025], [0042], [0061]: cross referencing security controls to security requirements and rules defined by frameworks and standards (i.e. cross referencing each of the plurality of security and privacy criteria with each control) to evaluate applicability and suitability (i.e. determine a relevance)
and selecting the subset of security controls according to the relevance. (Hader paras [0006], [0025], [0042], [0061]: and choosing security controls based on the evaluation results (i.e. selecting the subset of security controls according to the relevance))
The same motivation to combine utilized in claims 1, 8, and 15 is equally applicable in the instant claim.
Regarding claims 5, 12, and 18, Brannon and Hader teach the limitations of the method of claim 1, the non-transitory computer readable medium of claim 8, and the apparatus of claim 15.
Hader and Brannon teach the limitations of claims 5, 12, and 18 as follows:
The computer-implemented method of claim 1, further comprising: customizing the subset of security controls using technology infrastructure and operational requirements (Hader paras. [0032]- [0033], [0071]: tailoring and adjusting the selection and application of security control subsets based on system- specific compliance needs (i.e. customizing subset of security controls operational requirements) and applicability to the system environment (i.e. technology infrastructure)) …of the target system (Brannon paras. [0008], [0041], fig.2]: vendors (i.e. target system)
Hader is combinable with Brannon because both are from the same the same field of endeavor of computer-implemented techniques for assessing, and evaluating compliance mechanisms for a system. It would have been obvious to one of ordinary skill in the art at the time of the invention to integrate Hader’s customization of the subset of security controls with Brannon in order to have the system specifically tailored to an organization’s unique risks, vulnerabilities, and objectives which enhances effectiveness and prevents known issues.
Regarding claims 7, 14, and 20, Brannon and Hader teach the limitations of the method of claim 1, the non-transitory computer readable medium of claim 8, and the apparatus of claim 15.
Hader and Brannon teach the limitations of claims 7, 14, and 20 as follows:
The computer-implemented method of claim 1, further comprising: continuously monitoring an effectiveness … according to the target system’s compliance
(Brannon paras. [0038], [0054], fig.20: continuously monitoring the system for changes, and performing repeated privacy assessments according to audit schedules; generating alerts based on updated evaluations of vendor privacy based on changes of attributes (i.e. target system’s compliance) overtime)
of the implemented subset of security controls… with the set of target protocols after implementing the subset of security controls. (Hader paras. [0032], [0053], [0074-0075]: evaluating status of subsets from security controls that were implemented and are mapped to standards and frameworks (i.e. implemented subset of security controls with a set of target protocols after implementing the subset of security controls)
The same motivation to combine utilized in claims 1, 8, and 15 is equally applicable in the instant claim.
Regarding claim 16, Brannon and Hader disclose the limitations of claim 1. Hader discloses the limitation as follows:
The system of claim 15, wherein the plurality of security and privacy criteria comprise requirements for risk assessment, information security program, data protection, employee training, and incident response, and wherein the set of security controls comprise pre-defined security controls related to cyber security. (Hader, paras. [0032-0033], [0035]- [0036], [0042], table 1: including requirements that comprise of and correspond to numerous listed frameworks from ISO/IEC 27001 and NIST, 800-53 such as Incident Response, Information Security Policies (i.e. information security program), Risk Assessment, Asset management & Systems and Communications Protection (i.e. data protection), Awareness and Training (i.e. employee training) and more; eventually are implicated in the controls) in addition wherein the security controls are selected from an existing set defined by standards and frameworks (i.e. pre-defined security controls related to cybersecurity)
Hader is combinable with Brannon because both are from the same the same field of endeavor of computer-implemented techniques for assessing, and evaluating compliance mechanisms for a system. It would have been obvious to one of ordinary skill in the art at the time of the invention to integrate Hader’s framework requirements and pre-defined security controls with Brannon in order to demonstrate a proactive security posture as an organization, and adapt comprehensive coverage to address security in most levels. This also provides a structured, consistent, and reliable approach to managing risks and ensuring regularly compliance.
Regarding claim 8, Brannon discloses the limitations as follows:
A non-transitory computer-readable medium encoded with instructions that, when executed by one or more computers, cause the one or more computers to perform operations comprising:
obtaining, by one or more computing devices, attributes of a target system; (paras. [0006]- [0008], [0041]- [0043], fig.2: a scanning server (i.e. one or more computing devices) vendor devices and user devices (i.e. target system) to identify the vendor attributes and device characteristics)
determining, based on the attributes of the target system, a plurality of privacy criteria associated with maintaining compliance (paras. [0003]- [0005], [0036], [0041], [0044]- [0053], fig.3: evaluating vendor and user device attributes (i.e. attributes of target system) to determine applicable privacy requirements for privacy practices, compliance with privacy regulations (i.e. plurality of privacy criteria), and data protection policies);
identifying, from a set of security controls, a subset of security controls in accordance with the plurality of security criteria (paras. [0006]-[0007], [0041], [0045], [0228] fig.3: identifying from a set of security certifications and security policies (i.e. security controls), a set of security policies and certifications that the vendor does or does not have (i.e. subset of security controls) that are applicable for determining risk of the vendor (i.e. security criteria))
based on the attributes of the target system (paras. [0003]- [0005], [0044]- [0047]: evaluating based on scanned attributes of vendor and user devices (i.e. attributes of the target system)
to the target system (paras. [0008], [0041], fig.2]: vendors (i.e. target system)
Brannon does not explicitly disclose the remaining part of the limitation as follows:
a plurality of security criteria associated with maintaining compliance with a set of target protocols;
determining a priority associated with each of the security controls in the subset of security controls, wherein the priority for each of the security controls is determined … and relationships of the security control with the set of target protocols
and implementing the subset of security controls
However, in the same field of endeavor, Hader discloses the remaining limitations of claim 8 as follows:
a plurality of security criteria associated with maintaining compliance with a set of target protocols (paras [0032-0033], [0042], table 1: evaluating compliance needs as key drivers for defining security requirements (i.e. plurality of security and privacy criteria) used to determine whether a system satisfies applicable frameworks and standards (i.e. maintaining compliance with a set of target protocols)
identifying, from a set of security controls, a subset of security controls in accordance with the plurality of security and privacy criteria; (paras [0024], [0036]: determining a set of security controls (i.e. set of security controls) and identifying a sub-set of security controls (i.e. a subset of security controls) selected from that set based on an evaluation score reflecting compliance-driven security requirements (i.e. in accordance with security and privacy criteria)
determining a priority associated with each of the security controls in the subset of security controls, wherein the priority for each of the security controls is determined (paras, [0004], [0025], [0030], [0034] determining and implementing a prioritization of security controls (i.e. determining a priority associated with each of the security controls) to reduce risk impact that are used to assess (i.e. determining based on attributes of the target system) security requirements)
and relationships of the security control with the set of target protocols (paras [0042], table 1; security controls which are mapped to frameworks and standards (i.e. relationships of the security control with set of target protocols)
and implementing the subset of security controls (paras [0024], [0036]: implementation of the subset of security controls (i.e. implementing the subset of security controls)
Hader is combinable with Brannon because both are from the same the same field of endeavor of computer-implemented techniques for assessing, and evaluating compliance mechanisms for a system. It would have been obvious to one of ordinary skill in the art at the time of the invention to integrate Hader’s security controls, and prioritization regarding security criteria with Brannon in order to prevent and reduce the impact of risk in an organization regarding the system’s specific assets.
Regarding claim 15, Brannon discloses the limitations as follows:
A system comprising one or more computers and one or more storage devices on which are stored instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:
obtaining, by one or more computing devices, attributes of a target system; (paras. [0006]- [0008], [0041]- [0043], fig.2: a scanning server (i.e. one or more computing devices) vendor devices and user devices (i.e. target system) to identify the vendor attributes and device characteristics)
determining, based on the attributes of the target system, a plurality of privacy criteria associated with maintaining compliance (paras. [0003]- [0005], [0036], [0041], [0044]- [0053], fig.3: evaluating vendor and user device attributes (i.e. attributes of target system) to determine applicable privacy requirements for privacy practices, compliance with privacy regulations (i.e. plurality of privacy criteria), and data protection policies)
identifying, from a set of security controls, a subset of security controls in accordance with the plurality of security criteria (paras. [0006]-[0007], [0041], [0045], [0228] fig.3: identifying from a set of security certifications and security policies (i.e. security controls), a set of security policies and certifications that the vendor does or does not have (i.e. subset of security controls) that are applicable for determining risk of the vendor (i.e. security criteria));
based on the attributes of the target system (paras. [0003]- [0005], [0044]- [0047]: evaluating based on scanned attributes of vendor and user devices (i.e. attributes of the target system)
to the target system (paras. [0008], [0041], fig.2]: vendors (i.e. target system)
Brannon does not explicitly disclose the remaining part of the limitation as follows:
a plurality of security criteria associated with maintaining compliance with a set of target protocols;
determining a priority associated with each of the security controls in the subset of security controls, wherein the priority for each of the security controls is determined … and relationships of the security control with the set of target protocols
and implementing the subset of security controls
However, in the same field of endeavor, Hader discloses the remaining limitations of claim 15 as follows:
a plurality of security criteria associated with maintaining compliance with a set of target protocols (paras [0032-0033], [0042], table 1: evaluating compliance needs as key drivers for defining security requirements (i.e. plurality of security and privacy criteria) used to determine whether a system satisfies applicable frameworks and standards (i.e. maintaining compliance with a set of target protocols)
identifying, from a set of security controls, a subset of security controls in accordance with the plurality of security and privacy criteria; (paras [0024], [0036]: determining a set of security controls (i.e. set of security controls) and identifying a sub-set of security controls (i.e. a subset of security controls) selected from that set based on an evaluation score reflecting compliance-driven security requirements (i.e. in accordance with security and privacy criteria)
determining a priority associated with each of the security controls in the subset of security controls, wherein the priority for each of the security controls is determined (paras, [0004], [0025], [0030], [0034] determining and implementing a prioritization of security controls (i.e. determining a priority associated with each of the security controls) to reduce risk impact that are used to assess (i.e. determining based on attributes of the target system) security requirements)
and relationships of the security control with the set of target protocols (paras [0042], table 1; security controls which are mapped to frameworks and standards (i.e. relationships of the security control with set of target protocols)
and implementing the subset of security controls (paras [0024], [0036]: implementation of the subset of security controls (i.e. implementing the subset of security controls)
Hader is combinable with Brannon because both are from the same the same field of endeavor of computer-implemented techniques for assessing, and evaluating compliance mechanisms for a system. It would have been obvious to one of ordinary skill in the art at the time of the invention to integrate Hader’s security controls, and prioritization regarding security criteria with Brannon in order to prevent and reduce the impact of risk in an organization regarding the system’s specific assets.
Claims 6, 13, and 19, are unpatentable under Brannon (US 20190384899A1) and Hader (US20210273978A1), as applied to claim 1, further in view of Cain (US20060080656A1).
Regarding claims 6, 13, and 19, Brannon and Hader teach the limitations of the method of claim 1, the non-transitory computer readable medium of claim 8, and the apparatus of claim 15.
Hader teaches the limitations of claims 6, 13, and 19 as follows:
The computer-implemented method of claim 1, further comprising:
for the subset of security controls comprising: assessing current level of compliance, defining gaps in compliance (Hader paras [0025], [0032-0033]: evaluating compliance needs (i.e. current level of compliance) for subsets of the security controls and identifying their unmet security requirements (i.e. defining gaps in compliance)
It would have been obvious to one of ordinary skill in the art at the time of the invention to integrate Hader’s method of analyzing compliance aspects within security controls with Brannon in order to highlight deficiencies in policies and procedures for the system of an organization.
Neither Brannon or Hader disclose the limitations of claims 6, 13, and 19 as follows:
determining an implementation plan… assigning responsibilities, setting timelines, defining milestones, and allocating resources
However, in the same field of endeavor, Cain discloses the limitations of claims 6,13, and 19 as follows:
determining an implementation plan… assigning responsibilities, setting timelines, defining milestones, and allocating resources (Cain paras [0056], [0336]- [0347], [0542-0543], [0556]- [0557], fig25: implementing a planning phase (i.e. determining an implementation plan) assigning administrators (i.e. assigning responsibilities), determining rollout schedules/ deadlines (i.e. setting timeliness and defining milestones), and prioritizing deployment activities (i.e. and allocating resources))
Brannon and Hader are combinable with Cain because all are from the same the same field of endeavor of computer-implemented techniques for assessing, managing, and deploying security mechanisms for a system. It would have been obvious to one of ordinary skill in the art at the time of the invention to integrate Cain’s implementation plan with the system of Brannon and Hader in order to ensure that security controls are deployed in a measurable manner rather than having inconsistencies across a system.
Prior Art Not Relied Upon but Considered Includes:
US 20080066148 A1, “Enforcing Policy-Based Application and Access Control in An Information Management System” by Keng Lim. This reference describes techniques for monitoring and controlling network traffic using policy-based rules. It discloses how examining session characteristics leads to centralizing policy enforcement to improve network security, compliance, and filtering (see paras. [0011], [0074-0078], [0143-0146].
Conclusion
Claims 1-20 are rejected.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JAELYN MCCRACKEN whose telephone number is (571)272-2075. The examiner can normally be reached Monday-Friday 7:30 am- 5pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Taghi T Arani can be reached at (571) 272-3787. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/J.D.M./Examiner, Art Unit 2438
/TAGHI T ARANI/Supervisory Patent Examiner, Art Unit 2438