Decision Support System for Determining Cyber Risk Mitigation Priorities in Higher Education Using the Fuzzy TOPSIS Method

Fristi Riandari (Manajemen Informatika, Politeknik Negeri Medan, Indonesia)
Hengki Tamando Sihotang (Sains Data, Universitas Pembangunan Nasional Veteran Jakarta)

Jurnal Teknik Informatika C.I.T. Medicom
Vol 18 No 2 (2026): May: Intelligent Decision Support System (IDSS)

The increasing frequency and sophistication of cyber threats have made higher education institutions attractive targets for cyberattacks, posing significant risks to information assets, academic operations, and institutional reputation. Universities rely heavily on digital technologies, including academic information systems, e-learning platforms, cloud services, and research databases, making effective cybersecurity risk management essential. However, limited cybersecurity resources often prevent institutions from addressing all potential threats simultaneously, highlighting the need for a systematic approach to prioritizing cyber risk mitigation efforts. This study aims to develop a Decision Support System (DSS) for determining cyber risk mitigation priorities in higher education institutions using the Fuzzy Technique for Order Preference by Similarity to Ideal Solution (Fuzzy TOPSIS) method. Six evaluation criteria were considered, namely probability of occurrence, financial impact, operational impact, reputation damage, data sensitivity, and recovery complexity. Expert assessments were expressed using linguistic variables and converted into Triangular Fuzzy Numbers (TFNs) to accommodate uncertainty in the decision-making process. The Fuzzy TOPSIS method was then applied to evaluate and rank cyber risks according to their mitigation priorities. The results demonstrated that the proposed DSS successfully generated a prioritized ranking of cyber risks, with ransomware and data breach risks receiving the highest mitigation priorities due to their substantial impacts on university operations, financial resources, and information security. The findings suggest that the developed DSS effectively supports cybersecurity decision-making by handling uncertainty in expert assessments and providing systematic recommendations for cyber risk mitigation. Consequently, the proposed framework can assist higher education institutions in allocating cybersecurity resources more efficiently and enhancing their overall cybersecurity resilience.