- Research Article
- 10.32620/reks.2025.4.15
Integrating CVSS, national criticality levels, and MCDA for multi-factor cyber incident prioritization
- Dec 08, 2025
- RADIOELECTRONIC AND COMPUTER SYSTEMS
- Dmytro Uzlov + 4 more +4
This integrated approach aims to prevent suboptimal prioritization, ensure effective resource allocation, and expedite the recovery of information systems. Methodology: the proposed methodology establishes a hierarchical, multi-factor prioritization approach. It integrates the quantitative technical severity assessment provided by CVSS with Ukraine’s national criticality levels. This dual-layer scoring is further supplemented by a structured tie-breaking mechanism using additional attributes to achieve precise prioritization. A structured dataset was constructed, covering nationwide impact, economic consequences, information-related impacts, functional consequences, recovery capabilities, and system/network specifics. A prioritization methodology was developed, involving five key phases: incident registration, data verification, correlation and aggregation, criticality assessment, and tie-breaking. Dedicated software was implemented to simulate the algorithm within the CERT-UA environment, enabling real-time registration, evaluation, and visualization of prioritized incidents. The simulation tested the algorithm’s effectiveness in handling incident inflows and its potential to streamline response efforts. Conclusions: this study presents a robust and novel multi-factor methodology that overcomes the insufficient granularity of existing national criticality levels. Introducing a hierarchical tie-breaking mechanism, the approach provides CERT-UA with a clear, decisive, and efficient tool for incident prioritization. Simulation and pilot implementations confirm the algorithm’s practical value and immediate applicability within the existing operational environments, significantly enhancing the ability of national-level response teams to mitigate the negative impacts of cyber threats. The system’s simplicity and adaptability ensure its applicability within existing operational environments, while its tie-breaking mechanism minimizes the risk of suboptimal prioritization. Future research directions include integrating artificial intelligence and machine learning to enhance prioritization accuracy and adapting this methodology for diverse organizational contexts. This work lays a strong foundation for advancing cyber incident management, addressing the evolving nature of cybersecurity challenges.
Read more