# Risk-Based Cybersecurity Compliance Assessment System (RC2 AS)
## 4 Risk-Based Cybersecurity Compliance Assessment System (RC2 AS)
### Proposed Risk-Based Cybersecurity Compliance Assessment System (RC2 AS)
#### 4.2.5 RC2 AS Rich Dashboards  
Lastly, the dashboard page will be displayed after filling out the self-assessment and answering all of the questions related to all subdomains. First, the user needs to select the model from the following options: (strict compliance, semi-strict compliance, weighted compliance, and RC2 AS weighted compliance) along with the date range. Accordingly, comprehensive dashboards will be generated and displayed. These dashboards include (a) the overall compliance score with ECC based on the selected model. Moreover, they include the overall compliance score across all models (Figure 6), and (b) the compliance score for each main domain per compliance statute is also based on the selected model (Figure 7). Accordingly, they provide the organization with insight into its cybersecurity posture per domain, and they provide a detailed view of each main domain and the compliance level for each control. This helps the organization to gain valuable insight into the most critical compliance concerns, which will support it in building its activities and actions to enhance its cybersecurity controls and prepare action plans accordingly. (c) The RC2 AS evaluation of the organization among dates ranges across the main domains based on the selected model (Figure 8), which allows for the close monitoring of the changes within the domain controls along with the selected duration, and (d) the proposed action plan for the organization based on its current compliance status.  
As mentioned before, the ECC has 29 subdomains. Each subdomain has a risk level (high, medium, and low) that the regulator redefines. Accordingly, based on compliance level, the subdomains will be divided among these risk levels using the proposed color-coding scheme. The visualized action plan helps the organization understand its current compliance status with ECC. A complete summary is provided for all domains and subdomains, including their compliance and risk levels. Additionally, this plan helps the organization to identify its weaknesses and design a well-structured strategy to enhance its level based on its priorities and resources. To illustrate more, the chart in Figure 9 allows the organization to prioritize its actions. For example, the subdomains that are not fully implemented and have a high risk level should be considered first. Therefore, this will be used as an action plan to draw future implementations based on the risk and compliance levels. Moreover, such a summary encourages the organization to continuously implement the subdomains that are categorized as high-risk and fully implemented.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Compliance Status** & **Risk-Based Weight Value** & **Color** \\ \hline
**Implemented** & 100\% & \\  & 75\% & \\  & 50\% & \\ \hline
**Partially** & \textgreater{}85\% to \textless{}100\% & \\
**Implemented** & \textgreater{}35\% to \textless{}85\% & \\ \hline
**Not Implemented** & 0 & \\ \hline
**Not Applicable** & N/A & \\ \hline \hline \end{tabular}
\end{table}
Table 11: RC2 AS color-coding scheme.  
Figure 6: RC2 AS dashboard of ECC—(a).  
Figure 7: RC2 AS dashboard of ECC—(b).