# Risk-Based Cybersecurity Compliance Assessment System (RC2 AS)
## 4 Risk-Based Cybersecurity Compliance Assessment System (RC2 AS)
### Proposed Risk-Based Cybersecurity Compliance Assessment System (RC2 AS)
#### 4.2.3 Proposed Calculation Methods for the Overall Compliance Score of ECC  
As we have mentioned in Section 4.1, what has been published by NCA and presented in the current compliance and assessment tool of the ECC tool does not provide an overall compliance score. Therefore, RC2 AS proposes several possible calculation methods to provide the overall compliance score:  
* Method (1): Strict compliance. * Method (2): Semi-strict compliance. * Method (3): Weighted compliance. * Method (4): RC2 AS Weighted compliance. Now, we will describe each method and the attributes and factors that are needed to calculate the overall compliance score. (A) **Strict Compliance**  
This is the most strict method as it only considers the fully implemented controls. The \"Partiality Implemented\" and \"Not Implemented\" controls are discarded. The fully implemented control will have a weight value of (1), and the rest will have a (zero) value. \begin{table}
\begin{tabular}{c c} \hline \hline
1-2 & Cybersecurity Management \\ \hline \multicolumn{3}{c}{Sample of Control’s Question(s) with Dependency} \\ \hline \multirow{4}{*}{1-2-1} & A dedicated cybersecurity function (e.g., division, department) must be established within the organization. This function must be independent of the information technology/information communication and technology (IT/ICT) functions (as per the Royal Decree number 37140 dated 14/8/1438H). It is highly recommended that this cybersecurity function reports directly to the head of the organization or his/ her delegate while ensuring that this does not result in a conflict of interest[13]. \\ \hline \multicolumn{3}{c}{Sample of Control’s Question(s) without Dependency} \\ \hline \multirow{4}{*}{1-2-2} & **Q1:** Is the cybersecurity department function headed by full-time and experienced Saudi cybersecurity professionals? \\ \cline{2-2}  & **Q2:** Do the related supervisory and critical positions in the cybersecurity department function with full-time and experienced Saudi cybersecurity professionals[13]. \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Sample of RC2 AS subdomain structure (with and without dependency). \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**RC2 AS Compliance Answer** & **Yes** & **Partially Implemented with** & **No** & **NA** \\ \hline Implementation Percentage & 100\% & \textgreater{}0\% to \(\leq\)35\% & \textgreater{}35\% to \(\leq\)85\% & \textgreater{}85\% to \textless{}100\% & 0\% & NA \\ \hline \hline \end{tabular}
\end{table} 
Table 8: RC2 AS compliance answer options. This means that only fully implemented controls will be counted (100% implementation), and other controls will not be counted (from > 0% to < 100% implementation). Equation (5) shows how the compliance score of this method is calculated:  
\[Compliance\ Score=\frac{\sum(F_{Control})}{TA_{Controls}}\% \tag{5}\]  
where;  
F = No. Fully Implemented Control(s); TA = No. of Applicable Control(s);  
(B) **Semi-Strict Compliance**  
This method is less strict than the above method. Here, the compliance status \"Implemented\" will have the same weighted value, which is (1), whereas \"Partially Implemented\" has a weight value equal to (0.5). Otherwise, no weight value is given (zero value). Accordingly, Equation (6) calculates the overall compliance score for this method:  
\[Compliance\ Score=\frac{\sum(F_{Control}+1/2P_{Control})}{TA_{Controls}}\% \tag{6}\]  
where;  
F = No. Fully Implemented Control(s); P = No. Partially Implemented Control(s);  
TA = No. of Applicable Control(s);  
(C) **Weighted Compliance**  
Before we present the attributes of this compliance score equation, referring to the RC2 AS compliance answer options mentioned above in Table 8, where there are three different levels of compliance status based on the implementations percentage of the control, which are (a) >0% to <=35%, (b) >35% to <=85%, and (c) >85% to <100%. Thus, weighted \"Partiality Implemented\" is embedded in this equation to impact the calculation of the overall compliance score.