Aggregated Information Security Metrics for 5G Telecommunications Infrastructure Based on ISO/IEC 27011 and Multi-Criteria Decision-Making

Quantitative assessment of information security in 5G telecommunications infrastructure is difficult because individual security metrics are heterogeneous and rarely interpreted together. Conventional multi-criteria decision-making (MCDM) applications rank alternatives by compensatory aggregation, so a violated metric can be offset by others. This study proposes a standard-traceable method in which MCDM only weights the metrics, while measured values are evaluated against tolerable values by a non-compensatory exceedance indicator and a three-level status rule. Twenty-four metrics were derived from ISO/IEC 27011:2024 controls through the ISO/IEC 27004 measurement chain and grouped into three domains. The analytic hierarchy process (AHP) weighted three quality criteria of a metric (significance 62.6%, correctness 28.9%, measurability 8.5%), and the weighted aggregated sum product assessment (WASPAS) method used them to derive the metric weights, cross-checked by the fuzzy technique for order of preference by similarity to ideal solution (Fuzzy TOPSIS). Validation combined synthetic deterioration scenarios, Monte Carlo analysis and comparison with alternative MCDM methods. In three 12-month scenarios, the exceedance indicator flagged each violation in the month it occurred, whereas compensatory aggregation lagged by three to six months or did not react. The domain status remained stable in 85.3–100% of Monte Carlo draws under perturbed tolerable values and measurements. Compared with conventional MCDM-based aggregation, the advantage lies in traceable metric selection, normalization against tolerable values and the non-compensatory status rule.