# Risk-Based Cybersecurity Compliance Assessment System (RC2 AS)
## 4 Risk-Based Cybersecurity Compliance Assessment System (RC2 AS)
### Existing ECC Assessment and Compliance Tool  
The objective of this sub-section is to fully understand and highlight the ECC-1:2018 assessment and compliance tool by studying their domains/controls, scope, objective, and compliance assessment process. A better understanding of the tool will facilitate and pave the way toward establishing the foundation of the RC2 AS solution. The list of main functions listed in this section was used as a starting point to build the functions of the proposed system. Before diving into these functions, the key points of the ECC are:  
* Description: Minimum cybersecurity standards were customized and developed after reviewing international cybersecurity standards, controls, frameworks, previous cybersecurity attacks incidents, and international practices in cybersecurity to minimize the risk of cyberattack to enterprises' information and technical assets that are created by external and internal threats. * Scope: It is mandatory for all Saudi Arabian entities within the government and private sectors. * Objective: The essential objectives must be focused on to protect the information and assets of organizations: confidentiality, availability, and integrity of information, with attention paid to the pillars that cybersecurity focuses on (strategy, people, procedures, and technology). \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Ref.** & **General Idea** & **Approach Used** & **Focus Area** & **Standards** & **NCA-ECC?** \\ \hline \multirow{4}{*}{[32]} & Propose an information security management framework comprising five constructs for HEIs in Malaysia. & Interviews and surveys were conducted to gain relevant insights. & \multirow{4}{*}{International} & \multirow{4}{*}{\begin{tabular}{} \end{tabular} } & \multirow{4}{*}{No} \\ \cline{1-1} \cline{5-5}  & Propose a model for evaluating the maturity of business continuity and disaster-recovery practices for information technology organizations in SCA. & The study adopted an iterative approach to link existing theories to emerging data. & \multirow{4}{*}{National} & \multirow{4}{*}{ISO22301} & \multirow{4}{*}{No} \\ \cline{1-1} \cline{5-5}  & Incorporate three models and a combined model for cyber security countermeasures within SMEs in education, healthcare, and commerce in Saudi Arabia. & The study considered organizational special needs and asset sensitivity. & \multirow{4}{*}{National} & \multirow{4}{*}{NIST} & \multirow{4}{*}{No} \\ \cline{1-1} \cline{5-5}  & Propose a lightweight cybersecurity maturity assessment framework for HEI in SA. & The study developed a comprehensive policy that bridges local needs and international standards. & & \multirow{4}{*}{Both} & \multirow{4}{*}{Both} & \multirow{4}{*}{\begin{tabular}{} \end{tabular} } & \multirow{4}{*}{Yes} \\ \cline{1-1} \cline{5-5}  & Measure the extent to which certified ISO/IEC 27001 Saudi organizations adhere to the ICA-ECC and propose a framework for complying with not fully implemented controls. & The study design is a qualitative survey that included the use of interviews presented in an interview table from which the answers (data) were collected and analyzed. & \multirow{4}{*}{Both} & \multirow{4}{*}{\
\begin{tabular}{} \end{tabular} } & \multirow{4}{*}{
\begin{tabular}{} \end{tabular} } & \multirow{4}{*}{Yes} \\ \cline{1-1} \cline{5-5}  & Propose a risk-based cybersecurity compliance assessment system based on ECC. & A comprehensive and customized risk-based cybersecurity compliance assessment system was provided that reflects the current status of the organization, considering its domain and risk ranges. & & \multirow{4}{*}{National} & \multirow{4}{*}{NCA-ECC} & \multirow{4}{*}{Yes} \\ \cline{1-1} \cline{5-5}  & & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Cont. ECC Domains and Structure: As shown in Figure 2, ECC consists of 5 main cybersecurity domains, 29 cybersecurity subdomains, and 114 cybersecurity controls.