Abstract: A method and system for creating a security rating for a sub-entity of an entity. The security rating of the sub-entity is calculated based on an entity map provided by a representative of the entity. The sub-entity map details which assets of an entity belong to one or more of its sub-entities. It is advantageous to know the security rating of a sub-entity of an entity when an at-risk company is making a decision on whether or not to conduct business with a sub-entity whose security rating may different than that of the entity to which it belongs.