# Risk-Based Cybersecurity Compliance Assessment System (RC2 AS)
## 5 Proposed System Evaluation and Results Discussion
### Comparison Using \"RC2 AS Weighted Compliance\" Method  
In the same way, we will continue with the example mentioned before in Section 5.2. However, here we will evaluate the overall compliance score while considering (a) the weight for the level of \"Partially Implemented\" status, and (b) the risk level of the subdomain that the regulator has predefined. Assume the risk level of subdomain (1-2) is \"Low\" for both entities. The self-assessments for both entities are shown in Tables 20 and 21. This method presented the difference in compliance for both entities, specifically for control (1-2-3) with the risk values included. The overall compliance score of the subdomain (1-2) for both entities has been reduced due to the risk value for this subdomain being \begin{table}
\begin{tabular}{p{14.2 pt} p{142.3 pt} p{142.3 pt} p{142.3 pt}} \hline \hline \multicolumn{2}{c}{**Method Name**} & **Entity X** & **Entity Y** \\ \hline Strict Compliance Method & 66.67\% & 66.67\% \\ Semi-Strict Compliance Method & 83.33\% & 83.33\% \\ Weighted Compliance Method & 89.67\% & 77.00\% \\ \hline \hline \end{tabular}
\end{table} 
Table 19: Comparison of overall compliance score between two entities by using “Weighted Compliance” Method. \begin{table}
\begin{tabular}{p{142.3 pt} p{142.3 pt} p{142.3 pt} p{142.3 pt}} \hline \hline \multicolumn{2}{c}{**Method Name**} & **Entity X** & **Entity Y** \\ \hline Strict Compliance Method & 66.67\% & 66.67\% \\ Semi-Strict Compliance Method & 83.33\% & 83.33\% \\ Weighted Compliance Method & 89.67\% & 77.00\% \\ \hline \hline \end{tabular}
\end{table} 
Table 19: Comparison of overall compliance score between two entities by using “Weighted Compliance” Method. \"Low\". For more illustrations, the risk-based weight value for both entities in controls (1-2-1) and (1-2-2) using Equations (8) and (9) will be reduced from value 1 without risk to 0.5 after a low-risk value. At the same time, the overall compliance score for entity X in control (1-2-3) will be \((\frac{0.5+0.38+0.5+0}{3})=(0.343\%)\). So, the overall compliance score for subdomain (1-2) will be \((\frac{0.5+0.5+0.34}{3}*100)=(44.79\%)\). Similarly, the risk-based weight value for entity Y in control (1-2-3) will be \((\frac{0.5+0.34+0.0}{4})=(0.16\%)\). So, the overall compliance score for entity X in subdomain (1-2) will be followed, \((\frac{1+0.16}{3}*100)=(38.54\%)\). Accordingly, by using this method it has been noticed that **(b)** the overall compliance score has been reduced here as this is an indicator that the entity needs to focus first on the subdomain with the highest level of impact. Furthermore, **(a)** the color coding for the \"Implemented\" and \"Partially Implemented\" statuses are lighter than the normal ones, as been affected by risk value as illustrated in Table 11. The comparison between the compliance level by including \"Risk Value\" is shown in Table 22.  
As another example, we will provide the advantage of adding the risk level to the compliance score calculation method. Let us assume that we have two entities whose compliance statuses are similar for subdomain (1-2). However, the risk level is different as classified by the regulator. The risk level for subdomain (1-2) for entity X is \"High\", while for entity Y it is \"Medium\". The self-assessment for entity X is presented in Table 23:  
\begin{table}
\begin{tabular}{p{42.7 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline  & 1-2 & \multicolumn{2}{c}{Cybersecurity Management} \\ \hline  & Risk Level: & Low & \\ \hline Control No. & Control Clauses & Question & RC2 AS Compliance Answer & Compliance Status \\ \hline  & A dedicated cybersecurity function (e.g., division, department) must be established within the organization, etc. [13]. & **Q1:** Does the cybersecurity department independent of information technology management in the entity? & Yes (100\%) & \\ \hline  & The position of cybersecurity function head (e.g., CISO), and related supervisory and critical positions within the function, etc. [13].