# Risk-Based Cybersecurity Compliance Assessment System (RC2 AS)
## 4 Risk-Based Cybersecurity Compliance Assessment System (RC2 AS)
### Proposed Risk-Based Cybersecurity Compliance Assessment System (RC2 AS)
#### 4.2.3 Proposed Calculation Methods for the Overall Compliance Score of ECC
We map each of these RC2 AS compliance answer options to dedicated weight values depending on the percentage of implementation of this control as detailed in Table 9:  
Therefore, the overall compliance score is calculated in Equation (7):  
\[Compliance\ Score=\frac{\sum_{i=1}^{n}(Weight\ Value_{i})}{TA_{Controls}}\% \tag{7}\]  
where;  
n = No. of total Control(s); TA = No. of Applicable Control(s);  
(D) **RC2 AS Weighted Compliance**  
A better understanding of the organization's domain and status is needed to reflect compliance levels accurately. Therefore, this method differentiates organizations by different scopes, business functionality, and criticality level. For this reason, the overall compliance score should not be measured similarly. This method includes the risk level of the subdomains to calculate the overall compliance score. This means that the regulator predates a risk level for each subdomain in ECC (29 subdomains) depending on different criteria and conditions. To clarify more, each organization will have a risk level of one of the following (high, medium, or low) according \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**RC2 AS Compliance Answer** & **Yes** & \multicolumn{2}{c}{**Partially Implemented with**} & **No** & **NA** \\ \hline Implementation Percentage & 100\% & >0\% to <=35\% & >35\% to <=85\% & >85\% to <100\% & 0\% & NA \\ Weight Value & 1 & 0.75 & 0.5 & 0.25 & 0 & - \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Mapping RC2 AS compliance answer options with weight values. to the risk impact in case the subdomain controls are not implemented. However, the organization can officially request the regulator to change the risk level of the subdomains (if required). The following example elaborates more on how this method is used. There are two organizations: the first is a university, and the second is a CNI (Critical National Infrastructure) organization. Both organizations are not fully implementing control in a subdomain (2-10). Accordingly, the impact of not fully implementing this control is definitely not the same for both organizations. Thus, both organizations will be assigned to a different risk level for the subdomain; subsequently, the overall compliance score will be affected by the risk value of that subdomain. The above formula (Equation (7)) will be modified to consider the risk value as shown in Equation (8):  
\[Compliance\ Score=\frac{\sum_{i=0}^{n}(Risk\ Based\ Weight\ Value_{i})}{TA_{Controls}}\% \tag{8}\]  
where  
n = No. total Control(s); TA = No. of Applicable Control(s);  
As mentioned before, there are three different risk levels (high, medium, and low), each with a risk value (1, 0.75, and 0.5), respectively. To calculate the \"Risk-based Weight Value\", the compliance status weight value and the risk value are multiplied as shown in Equation (9):  
\[Risk\ Based\ Weight\ Value=Weight\ Value*Risk\ Value \tag{9}\]  
Table 10 describes the difference in the weight value, in case the risk is considered or not.