Multicriteria Classification Method to Evaluate the Security of Information Systems for Emerging Enterprises

ABSTRACT This paper presents a method for evaluating the security level of information systems in emerging enterprises by identifying relevant assessment criteria and constructing a preference model adapted to their organizational context. The method is based on the dominance‐based rough set approach (DRSA), which generates interpretable classification rules from qualitative assignment examples. An empirical study was conducted with 34 emerging enterprises in the Hauts‐de‐France region of France. The proposed method consists of two phases. In Phase 1, decision rules were inferred from 19 assignment examples. In Phase 2, these rules were applied to classify 15 additional enterprises according to their security level from low to high. The approach combines supervised learning with multicriteria decision modelling. The preference model (decision rules) constructed from the learning set was found to be understandable and applicable by the decision‐makers we interviewed, which supports transparency and trust in the classification results.