Towards Effective Cybersecurity Governance: Jordan Compliance System and Self-Assessment Tools

Enforcing cybersecurity governance is no longer a choice. It has become essential to protect nations’ safety and economy. In addition to the well-known cybersecurity standards that provide guidelines for implementing security controls, many countries have introduced national cybersecurity frameworks to meet their requirements and needs. These countries also provide assessment tools to check that organizations comply with these frameworks. This research emphasizes the importance of efficient cybersecurity governance practices, highlighting the Jordanian National Cyber Security Framework (JNCSF) that was announced in 2019. We have chosen this framework because, since its launch, it has not been presented or analyzed thoroughly by any of the existing studies. Moreover, the National Cyber Security Center (NCSC) in Jordan has not announced any public self-assessment tools for organizations to evaluate their compliance with the JNCSF. Therefore, the absence of a structured and publicly available self-assessment mechanism for the JNCSF creates a challenge for organizations in objectively measuring their cybersecurity governance readiness. Accordingly, the main contributions of this paper are to provide a detailed breakdown and discussion of the JNCSF, which supports organizations in Jordan and also shares the JNCSF philosophy regionally and internationally. Additionally, this study introduces an efficient self-assessment tool (named JCCT) that can be used both offline and online. JCCT accurately measures the institution’s cybersecurity compliance against JNCSF and international standards (ISO and NIST), reflecting its current state and the potential impact on its risk profile. Moreover, this paper proposes new compliance score equations based on a comprehensive mathematical model that generally benefits any governance system. The JCCT tool offers rich, interactive, customized dashboards and automatically generates reports with recommended action plans for the organization.