DETAILED ACTION
Claims 1-18 are presented for examination on the merits.
Notice of Pre-AIA or AIA Status
The present application is being examined under the first inventor to file provisions of the AIA .
Drawings
The drawings filed on 10/18/2024 are accepted by the examiner.
Priority
The application is filed on 03/28/2024 and claims priority of Provisional
Application filed on 10/19/2023.
Claim Rejections - 35 USC § 103
1. In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
2. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
3. The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
4. This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
5. Claims 1-18 are rejected under 35 U.S.C. 103 as being unpatentable over Calado et al. (US 20230061234 A1, hereinafter, Calado) in view of Kraus et al. (US 20200380160 A1, hereinafter, Kraus).
Regarding claim 1, Calado discloses a method for monitoring compliance of a computing system (Para 0032, 0005, 0002,0025: controls and metrics to monitor compliance with policies and standards, standard hierarchy),
the method comprising: receiving a plurality of documents containing rules (Para 0008: the standards, the standard statements, the mandates, the obligations, and the industry best practices correspond to documents and requirements within an organization include one or more pre-configured rules. Para 0009: at least one policy represented by one or more documents within an organization that establishes one or more high-level operational requirements.);
converting each of said plurality of documents to a respective tree structure comprising a plurality of nodes (0006, 0009, 0012, 0032: graph platform represent hierarchy structure associated with a plurality of connected relationships, data types, and compliance with law or regulation including obligations, policies and standards wherein various inputs are translated at various levels in the metrics including the relationships between the nodes);
generating a tree mapping relating a first one of said respective tree structures to a second one of said respective tree structures (Para 0009: generating a tiered connected data structure between a first and second set of data associated with control objectives, the policies, the policy statements, the standards, the standard statements, and the mandates);
generating a control mapping relating said first one of said respective tree structures to a set of one or more compliance controls (Para 0009-0010: generating a graphical representation illustrating a second set of relationships between data components comprising the control objectives and information wherein policy hierarchy generates evidence of compliance with each governance artifact pre-mapped to the control objective);
generating an evidence mapping relating said set of one or more compliance controls to a set of compliance control evidence (Para 0009: producing a set of control objectives for data commensurate with the identified sensitivity tier and identified criticality tier associated with control objectives, the policies, the standards, the mandates, the obligations, and the industry best practices wherein documenting and executing a control that is mapped to a control objective provides seamless evidence of compliance with each governance artifact pre-mapped to the control objective); and
[determining a compliance score for an entity based on said compliance controls, said compliance control evidence], and said evidence mapping (Para 0010: documenting and executing a control that is mapped to a control objective provides seamless evidence of compliance with each governance artifact mapped to the control objective ).
Calado does not explicitly state but Kraus from the same or similar fields of endeavor teaches determining a compliance score for an entity based on said compliance controls, said compliance control evidence (Kraus, Para 0162, 0192-0193, 0203-0210: regulatory compliance tracks and produces evidence of compliance with regulations….calculate a weighted combination and statistics score and compute recommendations based on the results, regulatory compliance, policy formulation, policy enforcement, alert prioritization and data protection).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to determine a compliance score for an entity based on said compliance controls, said compliance control evidence as taught by Kraus in the teachings of Calado for the advantage of enhancing cybersecurity and data categorization efficiency by providing reliable statistics wherein the resulting statistics can be utilized for regulatory compliance, policy formulation or enforcement, data protection, forensic investigation, risk management, evidence production (Kraus, Abstract).
Regarding claim 2, the combination of Calado and Kraus discloses the method of claim 1, wherein each of said mappings includes a set of weights (Calado, Para 0012, 0009: Risk and Compliance (GRC) system translates the various inputs into normalized scores and weighs the input scores based on the number of relationships associated with the node in the tiered data structure mapping).
Regarding claim 3, the combination of Calado and Kraus discloses the method of claim 1, wherein said set of controls is decoupled from said set of compliance control evidence by said evidence mapping (Kraus, Para 0291, 0162: policy is included in the model that defines a many-to-one mapping in the hierarchy wherein set of controls are disjoint wherein regulatory compliance tracks or produces evidence of compliance with regulations).
Regarding claim 4, the combination of Calado and Kraus discloses the method of claim 1, wherein each of said plurality of nodes has a unique identifying string assigned thereto (Kraus, Para 0125, 0078: : a string or enumeration value associated with computing nodes, for example).
Regarding claim 5, the combination of Calado and Kraus discloses the method of claim 4, wherein said unique identifying string includes at least one of a name, a description, a data type, a version number, and/or a weight (Kraus, Para 0125, 0192-0193: a string or enumeration value identifies a sensitivity type wherein a weighted value is combined with data sensitivity statistic).
Regarding claim 6, the combination of Calado and Kraus discloses method of claim 1, wherein each of said mappings is a tree structure comprising a set of weights (Kraus, Para 0162, 0192-0193, 0203-0210, 0291: regulatory compliance tracks and produces evidence of compliance with regulations. calculate a weighted combination and statistics score and compute recommendations based on the results, regulatory compliance, policy formulation, policy enforcement, alert prioritization and data protection wherein a policy is included in the model that defines a many-to-one mapping in the hierarchy).
Regarding claim 7; Claim 7 is similar in scope to claim 1, and is therefore rejected under similar rationale (Further, Para 0123 of Calado teaches: computer-readable medium including a machine-readable storage device, a machine-readable storage substrate, a memory device, processors wherein computer program instructions are encoded).
Regarding claim 8; Claim 8 is similar in scope to claim 2, and is therefore
rejected under similar rationale.
Regarding claim 9; Claim 9 is similar in scope to claim 3, and is therefore rejected under similar rationale.
Regarding claim 10; Claim 10 is similar in scope to claim 4, and is therefore rejected under similar rationale.
Regarding claim 11; Claim 11 is similar in scope to claim 5, and is therefore rejected under similar rationale.
Regarding claim 12; Claim 12 is similar in scope to claim 6, and is therefore rejected under similar rationale.
Regarding claim 13; Claim 13 is similar in scope to claim 1, and is therefore rejected under similar rationale (Further, Para 0123 of Calado teaches: computer-readable medium including a machine-readable storage device, a machine-readable storage substrate, a memory device wherein computer program instructions are encoded).
Regarding claim 14; Claim 14 is similar in scope to claim 2, and is therefore
rejected under similar rationale.
Regarding claim 15; Claim 15 is similar in scope to claim 3, and is therefore rejected under similar rationale.
Regarding claim 16; Claim 16 is similar in scope to claim 4, and is therefore rejected under similar rationale.
Regarding claim 17; Claim 17 is similar in scope to claim 5, and is therefore rejected under similar rationale.
Regarding claim 18; Claim 18 is similar in scope to claim 6, and is therefore rejected under similar rationale.
Conclusion
6. The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Vaidyam Anandan et al. (US 12086264 B1) discloses methods for providing a risk assessment for a software application based on evidence obtained from one or more sources. In some aspects, security and compliance evidence may be obtained from one or more evidence sources.
Noskov et al. (US 12517965 B2) discloses methods for identifying a person's interests based at least in part on their interactions with social networks, where “interests” may refer to a person's hobbies, opinions, behaviors, goals, memberships, or activities.
7. Any inquiry concerning this communication or earlier communications from the examiner should be directed to MAHFUZUR RAHMAN whose telephone number is (571)270-7638. The examiner can normally be reached on Monday thru Friday.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Yin-Chen Shaw can be reached on 571-272-8878. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MAHFUZUR RAHMAN/Primary Examiner, Art Unit 2498