METHODOLOGY FOR CALCULATING THE LEVEL OF CYBERSECURITY OF CRITICAL INFORMATION INFRASTRUCTURE FACILITIES

Abstract

The article addresses a pressing scientific and practical challenge: the creation of a unified toolkit for the quantitative assessment of the security status of critical information infrastructure objects (CIIO). The relevance of the study is substantiated by an unprecedented increase in the number of cyberattacks (by 74% in 2025 compared to 2024) and a shift in their vector toward operational technologies. The research emphasizes the lack of transparent tools in Ukraine that would allow operators to objectively evaluate their posture and enable regulators to perform effective monitoring.

Existing methodologies are grouped according to three characteristics: procedural, verification, and analytical. It is determined that none of them are fully universal under the conditions of full-scale war, necessitating the development of a hybrid approach. The research results present a developed five-stage methodology that transforms a multi-criteria theoretical method into a detailed algorithm. The methodology integrates seven systems of criteria: Governance (GV), Cybersecurity Risk Identification (ID), Cyber Protection (PR), Cyber Incident Detection (DE), Cyber Incident Response (RS), Cybersecurity Recovery (RC), and a Sectoral Component (SE).

To incorporate a risk-oriented approach, the Analytic Hierarchy Process (AHP) is applied, allowing for the determination of weighting coefficients for each protection direction through pairwise comparisons. The data collection procedure is described through a three-component approach: documentation inspection, interviewing, and technical testing, which minimizes evaluation subjectivity. Furthermore, the results of the practical application of the methodology at fuel and energy sector facilities are provided. A comparative analysis of the developed proprietary software against two international analogs is conducted, proving the superior accuracy of the author's methodology due to its adaptation to national legislation and the possibility of individual weight adjustment.

The study identifies that the most critical gaps are systems with high weighting coefficients and low implementation levels. The practical value of the work lies in creating a roadmap for CIIF management regarding the prioritization of security investments. Prospects for further research are aimed at automating the determination of the target cyber protection level for conducting gap analysis.