Automated production of certification controls by translating framework controls

Patent metadata

Field	Value
Publication number	US-9253212-B2
Application number	US-201314035760-A
Country	US
Kind code	B2
Filing date	Sep 24, 2013
Priority date	Sep 24, 2013
Publication date	Feb 2, 2016
Grant date	Feb 2, 2016

Abstract

A compliance application automatically produces certification controls by translating framework controls. The framework controls are common certification controls used in production of the certification. The application retrieves framework controls including metadata from a compliance framework data store. Metadata of the framework controls map the framework controls to the certification. In addition, the application retrieves certification parity data associated with the metadata. Certification controls are produced based on the framework controls and the certification parity data. A view of the certification including the certification controls is provided to a customer requesting the certification.

First claim

What is claimed is:

1. A method executed on a computing device to automate production of certification controls by translating framework controls, the method comprising:
receiving a request to view a certification at a compliance application that is being executed on a first server, wherein the certification is a compliance certification associated with a service that defines one or more security rules for the service;
retrieving, by the compliance application, the framework controls including metadata from a framework data store, wherein the metadata maps the framework controls to the certification;
retrieving, by the compliance application, certification parity data associated with the metadata from a parity data store;
producing, by the compliance application, the certification controls based on the framework controls and the certification parity data through a translation layer of the compliance application;
establishing, by an automation component that is being executed on a second server, a connection to the translation layer of the compliance application;
executing, by the automation component, a compliance test on the framework controls to determine whether the framework controls translate to the certification controls; and
providing, by the compliance application, a view of the certification including the certification controls through a user interface.

2. The method of claim 1 , further comprising:
receiving the request at the compliance application from a customer including one or more of: an external auditor, a potential customer, and a certification authority.

3. The method of claim 1 , further comprising:
automating, by the compliance application, the certification by translating a report using the certification parity data, wherein the report is produced by at least one from a set of: monitoring and reporting a service associated with the certification.

4. The method of claim 1 , further comprising:
enabling, by the compliance application, a team to update the framework controls, wherein the team includes at least one from a set of: an engineering team, a management team, an operation team, and a compliance team.

5. The method of claim 4 , further comprising:
transmitting, by the compliance application, an alert to the team to prompt the team to update the framework controls.

6. The method of claim 1 , further comprising:
matching, by the compliance application, the metadata to attributes of the certification described by the request.

7. The method of claim 6 , further comprising:
comparing, by the compliance application, the attributes including one or more of: a service identifier, a security description, and an expiration date to the metadata.

8. The method of claim 1 , further comprising:
producing, by the compliance application, the certification controls through the translation layer by translating the framework controls using the certification parity data.

9. The method of claim 1 , further comprising:
updating, by the compliance application, the certification parity data based on a result of the compliance test executed by the automation component.

10. A system to automate production of certification controls by translating framework controls, the system comprising:
a first server computing device configured to execute a compliance application associated with providing a certification associated with a service to one or more external entities, wherein the compliance application is configured to:
receive a request to view the certification from a customer including at least one from a set of: an external auditor and a potential customer, wherein the certification is a compliance certification associated with the service that defines one or more security rules for the service;
retrieve the framework controls including metadata, wherein the metadata maps the framework controls to the certification from a framework data store;
retrieve certification parity data associated with the metadata from a parity data store;
produce the certification controls based on the framework controls and the certification parity data through a translation layer of the compliance application; and
provide a view of the certification including the certification controls through a user interface; and
a second server computing device configured to execute an automation component associated with the certification controls, the automation component configured to:
establish a connection to the translation layer of the compliance application; and
execute a compliance test on the framework controls to determine whether the framework controls translate to the certification controls.

11. The system of claim 10 , wherein the compliance application is further configured to:
detect evidence associated with dependency information of the framework controls within the certification parity data, wherein the evidence is data obtained from the certification parity data.

12. The system of claim 11 , wherein the
compliance application is further configured to:
utilize the evidence obtained from the certification parity data to comply with
the compliance test

validating the dependency information; and
update the certification parity data with a result of the compliance test to produce the certification controls in compliance with a certification authority.

13. The system of claim 12 , wherein the
compliance application is further configured to:
utilize the evidence obtained from the certification parity data, the compliance test, the framework controls, and the certification parity data to produce the certification within a common audit.

14. The system of claim 13 , wherein the
compliance application is further configured to:
certify a service associated with the certification to a certification authority during the common audit.

15. The system of claim 12 , wherein the
compliance application is further configured to:
utilize the evidence, the compliance test, the framework controls, and the certification parity data to produce additional certifications within a multi audit.

16. The system of claim 15 , wherein the
compliance application is further configured to:
certify additional services associated with the additional certifications to a certification authority perceptive of mapping techniques used in the framework controls, during the multi audit.

17. A computer-readable memory device with instructions stored thereon to automate production of certification controls by translating framework controls, the instructions comprising:
receiving a request to view a certification at a compliance application that is being executed on a first server, wherein the certification is a compliance certification associated with a service that defines one or more security rules for the service;
retrieving, by the compliance application the framework controls including metadata, wherein the metadata maps the framework controls to the certification from a framework data store;
retrieving, by the compliance application certification parity data associated with the metadata from a parity data store;
detecting, by the compliance application, evidence associated with dependency information of the framework controls within the certification parity data, wherein the evidence is data obtained from the certification parity data;
utilizing, by the compliance application, the evidence to comply with a compliance test validating the dependency information;
producing the certification controls based on the framework controls and the certification parit

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Tejerina David Nunez
• Veney Shawn
• Rodriguez Melissa
• Roberts Gregory
• Schwab Arthur J

Classifications

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L9/006

  involving public key infrastructure [PKI] trust models (network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title