Abstract:Cybersecurity attacks are still causing significant threats to individuals and organizations, affecting almost all aspects of life. Therefore, many countries worldwide try to overcome this by introducing and applying cybersecurity regularity frameworks to maintain organizations’ information and digital resources. Saudi Arabia has taken practical steps in this direction by developing the essential cybersecurity control (ECC) as a national cybersecurity regulation reference. Generally, the compliance assessment processes of different international cybersecurity standards and controls (ISO2700x, PCI, and NIST) are generic for all organizations with different scopes, business functionality, and criticality level, where the overall compliance score is absent with no consideration of the security control risk. Therefore, to address all of these shortcomings, this research takes the ECC as a baseline to build a comprehensive and customized risk-based cybersecurity compliance assessment system (RC2AS). ECC has been chosen because it is well-defined and inspired by many international standards. Another motive for this choice is the limited related works that have deeply studied ECC. RC2AS is developed to be compatible with the current ECC tool. It offers an offline self-assessment tool that helps the organization expedite the assessment process, identify current weaknesses, and provide better planning to enhance its level based on its priorities. Additionally, RC2AS proposes four methods to calculate the overall compliance score with ECC. Several scenarios are conducted to assess these methods and compare their performance. The goal is to reflect the accurate compliance score of an organization while considering its domain, needs, resources, and risk level of its security controls. Finally, the outputs of the assessment process are displayed through rich dashboards that comprehensively present the organization’s cybersecurity maturity and suggest an improvement plan for its level of compliance.

An Implementation Framework (IF) for the National Information Assurance and Cyber Security Strategy (NIACSS) of Jordan

A Framework of Information Security Integrated with Human Factors

Understanding the Intention to Adopt Cloud-based Accounting Information System in Jordanian SMEs

Proposed framework for medication delivery system in the Jordanian public health sector

Guidance Framework for Developing IoT-Enabled Systems' Cybersecurity

Application of a Human Factors-Integrated Information Security Framework to an Oil and Gas Organization.

Cyber Security Threat Awareness Framework for High School Students in Qatar

Risk-Based Cybersecurity Compliance Assessment System (RC2AS)

Measuring digital transformation impact in Jordan: A proposed framework.

The Strategy Detection on Information Security in Corporate Organizations on Crucial Asset

A process framework for information security management

Security Framework for IoT Devices against Cyber-Attacks

A comprehensive privacy and security framework for dynamic protection (CPSF)

Adaptable Plug and Play Security Operations Center Leveraging a Novel Programmable Plugin-based Intrusion Detection and Prevention System

An Assessment Methodology and Instrument for Cybersecurity: The Ireland Use Case

A collaborative framework for intrusion detection (C-NIDS) in Cloud computing

Collaboration-Based Cloud Computing Security Management Framework

AssessITS: Integrating procedural guidelines and practical evaluation metrics for organizational IT and Cybersecurity risk assessment

I-SolFramework: An Integrated Solution Framework Six Layers Assessment on Multimedia Information Security Architecture Policy Compliance

Integrated Solution Modeling Software: A New Paradigm on Information Security Review and Assessment

A Value Driven Framework for Cybersecurity Innovation in Transportation & Infrastructure