Çodur S., Tiryaki F.
INTERNATIONAL JOURNAL OF INFORMATION SECURITY, cilt.25, sa.6, ss.1-14, 2026 (SCI-Expanded, Scopus)
-
Yayın Türü:
Makale / Tam Makale
-
Cilt numarası:
25
Sayı:
6
-
Basım Tarihi:
2026
-
Doi Numarası:
10.1007/s10207-026-01347-6
-
Dergi Adı:
INTERNATIONAL JOURNAL OF INFORMATION SECURITY
-
Derginin Tarandığı İndeksler:
Applied Science & Technology Source, Academic Search Ultimate (EBSCO), Social Science Premium Collection (ProQuest), Business Source Ultimate (EBSCO), Criminology Collection (ProQuest), Engineering Source (EBSCO), Scopus, Pharma Collection (ProQuest), Technology Collection (ProQuest), Aerospace Database, Science Citation Index Expanded (SCI-EXPANDED), ABI/INFORM, Compendex, Criminal Justice Abstracts, INSPEC, Criminal Justice Periodical Index
-
Sayfa Sayıları:
ss.1-14
-
Karadeniz Teknik Üniversitesi Adresli:
Evet
Özet
Abstract
This study proposes an expert-based multi-criteria decision analysis framework for prioritizing selected ISO/IEC 27001 implementation investment items. The framework evaluates eleven practical implementation items, including ten major investment areas and the Statement of Applicability, which are relevant to early-stage ISO/IEC 27001 implementation planning. Judgments obtained from ten information security and IT professionals were first aggregated using RANCOM, a ranking-based subjective weighting method that allows ties and accommodates expert hesitation. The resulting priority structure was then compared with Copeland and PageRank rankings, and its stability was examined through a leave-one-expert-out sensitivity analysis. The findings indicate strong convergence across methods for the upper-priority items, with C1 (Server Room Setup), C3 (System Redundancy/Backup), and C2 (Disaster Recovery Center) consistently emerging as the highest-priority implementation investments. Smaller numerical differences among mid- and lower-ranked items indicate that these results should be interpreted with attention to numerical proximity and organizational context. Overall, the study provides a practical decision-support framework for early-stage ISO/IEC 27001 implementation planning.