Risk management is a significant, costly, not time-consuming, and straightforward process (Haimes, 1991). It often requires the involvement of experts, resources, etc. (Vrhovec et al., 2015). The advantages that it gives significantly outweigh the outlay cost and expended funds (Han, 2015).

Risk management involves taking measures aimed at reducing the frequency of threat implementation and reducing the damage from them (Boranbayev et al., 2018c). Depending on the received risk indicators, the owner of the information system must choose a risk management strategy. There are four main risk management strategies:

The components of the risk management process for information systems are shown in Fig. 1.

The necessity and effectiveness of using the risk management process in the design and operation of the software are confirmed by many studies (Sangaiah et al., 2018).

As you can see from (Fig. 1), firstly the input data are installed. Further, the identification and assessment of risks are carried out. Based on them, a risk report is formed. Also, it is necessary to determine whether the handling is required for identified risks. If there are risks at the output that need modification to an acceptable level, then the handling phase of risks (mitigation) occurs (Caplinskas et al., 2012). It is possible that risk-handling will not immediately yield the result in an acceptable level of residual risk.

The primary purpose of the article is to present the developed model, which allows to evaluate risks in order to determine which should be neutralized firstly.

As part of the research to develop a risk assessment model for CII, the study was conducted on factors affecting their safe and reliable operation.

New methods of risk analysis are continually being developed (Boranbayev et al., 2018d). These include association rules (Garcia et al., 2008), genetic algorithms (Pfeifer et al., 2015), models of processes (Aloini et al., 2012), and cluster analysis (Bannerman, 2008). Each method has its unique advantages and disadvantages.

The topic of risk analysis in various sectors is the most important topic that many researchers are paying attention to these days (Navickiene et al., 2018). The goal of the model is to prevent or reduce the threats of negative financial and non-financial consequences associated with the use of information infrastructures, as well as external factors affecting information infrastructures. The model is aimed at minimizing risks in the organization’s activities related to the violation of the integrity, confidentiality, and availability of information infrastructures arising from the deliberate destructive impact of employees or third parties. The model also takes into account the criticality of the checked information infrastructures, possible direct and indirect losses, as well as the probability of risk realization.

One of the essential steps to ensure the reliability and security of the information infrastructures is to take measures to mitigate the level of failures by identifying the most dangerous and harmful elements that pose a risk to the system and eliminate them (Lo and Liou, 2018).

Most organizations that specialize in solving information security problems offer various methods for assessing information risks. Known techniques can be divided into single-stage and multi-stage ones according to the type of decision-making procedure used in them. In a one-step methodology (“Risk Matrix”), risk assessment is performed using a one-time decisive procedure. In a multi-stage methodology (NIST, CRAMM), risk assessment is performed with a preliminary assessment of key parameters. The mechanism of risk assessment based on fuzzy logic is an expert system, in which certain rules form the knowledge base. For example, “table” logic or logic reflecting the relationships formed by “if, … , then” rules. The method for assessing the critical threats, assets and vulnerabilities OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) is a methodology based on strategic risk assessment (Bamakan and Dehghanimohammadabadi, 2015).

The analysis of the companies’ choice of risk assessment tools and methods showed that the FMEA – Failure Modes and Effects Analysis (Baynal et al., 2018), FTA – Fault Tree Analysis (Giraud and Galy, 2018), Bow-Tie Analysis (Muniz et al., 2018), HAZOP – Hazards and Operability Studies (Taylor, 2017) and LOPA – Layer of Protection Analysis (Yan and Xu, 2018) are the most common tools used in the most significant and industrial organizations. These tools assess potential risks and try to keep them within acceptable limits (Yasseri and Mahani, 2013).

Many studies were is reviewed for improving FMEA (Lo and Liou, 2018). For example, FMEA combined with methods, such as Grey Relational Analysis (GRA) (Zhou and Thai, 2016), the Visekriterijumska Optimizacija i Kompromisno Resenje (VIKOR) method (Safari et al., 2016), the Decision-Making Trial and Evaluation Laboratory (DEMATEL) method (Govindan and Chaudhuri, 2016), MULTIMOORA (Zhao et al., 2017) and others. To apply FMEA-WASPAS, an approach was proposed (Can, 2018).

The issue of measuring according to some criteria is known as MCDM (Zolfani et al., 2013; Zavadskas et al., 2009; Medineckiene et al., 2015). Scientists used MCDM approaches previously in risk management. The processes using MCDM approaches for the issue of managing risks for a nuclear and radiation emergency were presented by (Papamichail and French, 2012). An overview of risk assessment using MCDM approaches was presented in the researches (Linkov et al., 2006) and (Ananda and Herath, 2009). Evaluating risk assessment approaches for solid waste management were reviewed in (Allesch and Brunner, 2014). Criteria such as safety and risk in the context of maintenance and reliability can be widely found among the criteria evaluated in MCDM approaches (de Almeida et al., 2015). Besides, MCDM methods were applied in different areas of activity (Zavadskas et al., 2013; Sivilevicius et al., 2008; Saparauskas et al., 2011; Turskis et al., 2015). Effective use of the MCDM method is presented in Zavadskas et al. (2012, 2015a, 2015b).

The researches on the use of various methods for risk assessment were reviewed (de Almeida et al., 2015). Some of them are AHP (Ma et al., 2013), MAUT/MAVT (Garcez and de Almeida, 2014), Weighted sum (Akbari et al., 2014), TOPSIS (Jozi and Majd, 2014), NSGA (Woodward et al., 2014), ELECTRE (Macary et al., 2014), ANP (Tavana et al., 2013), PROMETHEE (Bates et al., 2014), and other methods (Jin et al., 2014).

In our case, according to Saaty and Ergu (2015), the MCDM method was chosen. Hybrid MCDM approach was applied. Earlier hybrid MCDM methods were proposed to use in Zavadskas et al. (2016a, 2016b).

The group decision-making processes are necessary to design and evaluate a set of different alternatives. One of the most important tasks is to reject those alternatives that do not meet lower bounds of the important criteria values. For a long time, a rigorous agreement was seen as a final group’s opinion. In most cases, a group of experts who make real-life decisions have no strict and steady opinion about the same criteria and alternatives. An agreement of the group is reached when the most dominant players agree with the criteria ratings and performances of the considered alternatives. Real-life problems’ modelling and solution lead the group of decision-makers to situations when models are based on vague logic. Besides, most often the models are based on the criteria rating in words. Such type of ratings cannot be replaced by the strict (crisp) numerical values. The fuzzy set theory allows decision takers to apply partially obtained information into the issue solving framework (Turskis et al., 2012). A fuzzy set is characterized by a membership (characteristic) function which assigns to each object a grade of membership ranging (Zadeh, 1965). Different types of membership functions are available. In this research, the most commonly used triangular membership function is used (Dubois and Prade, 1978). A fuzzy triangular number will be denoted as ( α , β , γ ) (α – lower value of the fuzzy number, β – modal value of the fuzzy number, γ – upper value of the fuzzy number).

It is required to identify the importance of the activities of the different process managers before starting to assess the critical challenges of workplace safety’s management, efficiency level of safety solutions and quality improvement. In order to achieve this, experts can use weighting methods for criteria. There are a lot of different subjective approaches for assessing weights: SWARA (Kersuliene et al., 2010; Keshavarz-Ghorabaee et al., 2018), FARE (FActor RElationship) (Ginevicius, 2011), and others.

Nominal group technique Delphi (Linstone and Turoff, 2002) is a useful tool for solving complicated problems which need expert data. It is a group decision-making process and includes idea generation, problem description, data assessment, and generation of feasible alternatives.

Likert scales are known as a tool for the measurement and assessment of attitudes. The reason for this is that the Likert scale is a straightforward tool to use and can be analysed effectively as interval or fuzzy scales (Allen et al., 2017).

Eckenrode (1965) presented seminal work on criteria weights elicitation. Rating is sufficient for personal assessment, and it is especially useful for group decision making. It works well because it forces the expert to get clarity on his criteria and create a shared set of criteria. Eckenrode’s Rating method is selected and modified by applying the basics of fuzzy sets theory in this study.

Risk assessment for each information infrastructure and analysis of the adequacy of risk management measures are carried out by experts.

To ensure sustainable functioning of CII, stakeholders should implement risk management processes. An integrated method of determination of criteria significance is developed to achieve the goals as mentioned earlier. The problem could be solved based on the survey of experts’ data. There was formed a team of five experts, who have a university degree in IT and information security as well as actively work with risk management.

The standard seven-stage Delphi procedure is applied in the case research. Firstly, a facilitator describes to the participants the purpose and the procedure of the issue. Secondly, members of the group silently explain their opinion about the solution (criteria), with a short explanation in writing, not consulting or discussing their ideas with other participants. It ensures that all participants get an opportunity to make an equal contribution. Thirdly, a facilitator encourages a sharing and a discussion of reasons for the choices made (criteria) by each group member to identify common ground. Fourthly, participants verbally explain in details all presented ideas which are not clear for all participants of the groups or further details about any of the ideas that colleagues have produced and which may not be apparent to them. Fifthly, a facilitator eliminates duplicate solutions (criteria) from the list of all solutions, and the members proceed to rank the solutions starting from the most important to the least important. Sixthly, a facilitator includes a prioritizing procedure of the recorded ideas concerning the original problem. Following the voting and ranking process, a facilitator asks participants who have a different opinion about ranks from average criteria ranking some questions. Seventhly, a final ranking and rating of criteria should be done (Turskis et al., 2019).

When solving problems by the MCDM method, first of all, a set of possible alternatives is formed, consisting of the CII. Next step is the selection of criteria and sub-criteria.

Criteria for risk assessment can be different. They depend on the infrastructure for which the risk is determined. In this case, the threats were taken as criteria. The experts determine the choice of threats aimed at the information infrastructure according to the Delphi method. The participants of the experts form a group, based on Sherwood et al. (2005). Then experts ranked and rated the impact of threats and probability of threats in the prevention of accidents at work. Based on the results, the following five threats that are most associated with cybersecurity were identified as criteria:

1) Health and safety threat (T1) – the threat to the personal health and safety of staff, customers and members of the population.

2) Technology threat (T2) – the threat of failure to plan, manage and monitor the performance of technology-related projects, product, services, processes, staff and delivery channels.

3) Information security threat (T3) – the threat of unauthorized disclosure or modification to information, or loss of availability of information, or inappropriate use of information.

4) Legal and regulatory compliance threat (T4) – the threat of failure to comply with the laws of the states in which business operations are carried out, or failure to comply with any regulatory, reporting, and taxation standards, or failure to comply with contracts, or failure of contracts to protect business interests.

5) Climate and weather threat (T5) – the threat of loss or damage caused by unusual climate conditions, including drought, heat, flood, cold, storm, and winds.

Each of the threats has its characteristics. According to Kosseff (2018), it is necessary to promote “identification, confidentiality, and integrality of public and private information, systems, and networks”. Mena et al. (2018) focused on IoT inherent vulnerabilities and their implications to the fundamental information security challenges in confidentiality, integrity, and availability.

In this paper, the characteristics of the threats were taken as sub-criteria. It was proposed to choose sub-criteria, which focus on almost every aspect of security, i.e. protection of data from beginning to end. This work focuses on major six aspects of security, i.e. confidentiality, availability, integrity, direct losses, indirect losses, and criticality.

Thus, the following sub-criteria were chosen to solve the MCDM problem:

1) Loss of availability. Availability is the property of being accessible and usable upon demand by an authorized entity. Loss of availability can conclude performance degradation, short-term/long-term interruption, total loss (destruction).

2) Loss of confidentiality. Confidentiality is the property that information is not made available or disclosed to unauthorized individuals, entities, or processes. Confidentiality refers to keeping information secret from unauthorized entities (Sherman et al., 2018). Loss of confidentiality can lead to internal disclosure, external disclosure of information, and others.

3) Loss of integrity. Integrity is the property of protecting the accuracy and completeness of assets. Loss of integrity can conclude accidental modification, deliberate modification, incorrect results, incomplete results, etc.

4) Direct losses are losses arising naturally, according to the usual course of things, from the breach of contract itself, and are therefore foreseeable and recoverable. Often these include financial costs.

5) Indirect losses are losses that arise from a particular circumstance of the case. Indirect losses, often referred to as “consequential losses”, are not inflicted by the peril itself but describe losses which were suffered as a result or consequence of the direct loss. For example, reputational risks.

6) Criticality is the quality, state, or degree of being of the highest importance. In RCM terms, criticality is based on the consequence of failure. It is an essential criterion for information infrastructures provided critical services.

According to the analysis of severity (Lough et al., 2008), the importance of severity can be divided into five categories: insignificant (the client noticed a very slight failure), low (slight irritation of the client), medium (causes customer dissatisfaction, customer is annoyed), high (product does not work, client evils) and very high (the client is at risk, the safety rules are violated).

At the same time, some methods of risk analysis apply a 10-point scale for ranking the severity of risks (Table 1).

The 10-level scale has more exact results of calculations. The weight depending on their importance determines further criteria. More critical criteria get higher weight values.

Based on the scale proposed in Table 1, the Likert-type scale is presented (Table 2, Fig. 4).

Rating: The raw rating assigned by the judge to each criterion, taking into account the sub-criteria, against the scale of 0 to 10 (10 most valuable) is treated as follows (Tables 3–4): (1) w c j = p c j ∑ c = 1 m p c j , where w c j – weight computed for criterion c from the rating given by judge j, p c j – rating given by judge j to criterion c, and w c is calculated as follows: (2) w c = ∑ j = 1 n w c j ∑ j = 1 n ∑ c = 1 m w c j .

Using rules of fuzzy arithmetic, the equations (1) and (2) are modified as follows: (3) w ˜ c j = p ˜ c j ∑ c = 1 m p ˜ c j = ( p c α j ∑ c = 1 m p c γ j ; p c β j ∑ c = 1 m p c β j ; p c γ j ∑ c = 1 m p c α j ) , w ˜ c = ( w c α ; w c β ; w c γ ) = ∑ j = 1 n w ˜ c j ∑ j = 1 n ∑ c = 1 m w ˜ c j = ( ∑ j = 1 n w c α j ∑ j = 1 n ∑ c = 1 m w c γ j ; ∑ j = 1 n w c β j ∑ j = 1 n ∑ c = 1 m w c β j ; ∑ j = 1 n w c γ j ∑ j = 1 n ∑ c = 1 m w c α j ) , where w j α = min k y j k , j = 1 , n ‾, k = 1 , p ‾, is minimum possible value of j-th criterion, w j β = ( ∏ k = 1 p y j k ) 1 p , j = 1 , n ‾, is the most possible value of j-th criterion and w j γ = max k y j k , j = 1 , n ‾, k = 1 , p ‾, is the maximal possible value of j-th criterion.

A defuzzification should be applied before final decisions are made. The defuzzification is a process of producing a quantifiable result in crisp logic, given fuzzy logic, and corresponding membership degrees. A common and useful defuzzification technique is a centre of gravity. This method is selected in the case study (Turskis et al., 2019). (4) w c = 1 3 ( w c α + w c β + w c γ ) .

The experts were requested to rate the main threats according to linguistic significance scale. Finally, linguistic variables are converted to fuzzy numbers and ranks determined (Tables 3–4, Fig. 5).

Fuzzy threat impact on CII values defuzzified as follows (Fig. 5).

The last stage is a calculation of a relative impact index ( R I) of each considered threat (Fig. 6): (5) R I c = w c max c w c .

Based on the method described above, the probability of threats implementation was defined (Tables 5–8, Fig. 7).

Fuzzy threat probability level values defuzzified as follows (Figs. 8, 9).