A novel ranking model for information technology security controls through COBIT and MCDM

Purpose According to organizations that are more reliant on information technology (IT), the risk of security threats has significantly increased. Therefore, organizations must prioritize the protection of their IT security and implement appropriate security controls. COBIT 2019 is a comprehensive framework for IT governance that provides numerous security controls to maintain the security of IT. This framework examines IT security through two processes: “APO13: Managed Security” and “DSS05: Managed Security Services,” and a total of 10 security controls have been defined for this purpose. The purpose of this paper is to use a multi-criteria decision-making (MCDM) approach to determine the importance of security controls in the COBIT 2019 framework. Design/methodology/approach To achieve this, two MCDM methods, namely, analytic hierarchy process (AHP) and technique for order of preference by similarity to ideal solution (TOPSIS), were used to compare and rank the security controls of the COBIT 2019 framework based on five COBIT’s information criteria. The authors first calculated the criteria weights using the AHP method and then used them in the TOPSIS method to rank security controls based on their scores. Findings Conferring to the results, the control “protect against malicious software” achieved the highest rank with a score of 0.763, while the control “manage sensitive documents and output devices” obtained the lowest rank with a score of 0.280. The results of this study can be used as a valuable resource for various security teams to enhance the management of organizations’ IT security more effectively and accurately. Originality/value This model is a valuable resource for various security teams, enabling them to implement more effective controls to prevent security threats. In turn, this can lead to reduced time and costs, improved organizational performance and increased efficiency.