Prioritizing selected ISO/IEC 27001 implementation investment items using multi-criteria decision analysis

Abstract This study proposes an expert-based multi-criteria decision analysis framework for prioritizing selected ISO/IEC 27001 implementation investment items. The framework evaluates eleven practical implementation items, including ten major investment areas and the Statement of Applicability, which are relevant to early-stage ISO/IEC 27001 implementation planning. Judgments obtained from ten information security and IT professionals were first aggregated using RANCOM, a ranking-based subjective weighting method that allows ties and accommodates expert hesitation. The resulting priority structure was then compared with Copeland and PageRank rankings, and its stability was examined through a leave-one-expert-out sensitivity analysis. The findings indicate strong convergence across methods for the upper-priority items, with C1 (Server Room Setup), C3 (System Redundancy/Backup), and C2 (Disaster Recovery Center) consistently emerging as the highest-priority implementation investments. Smaller numerical differences among mid- and lower-ranked items indicate that these results should be interpreted with attention to numerical proximity and organizational context. Overall, the study provides a practical decision-support framework for early-stage ISO/IEC 27001 implementation planning.