A Process-Integrated Multi-Criteria Framework for Information Security Investment

Abstract

: Information security investment decisions increasingly require structured evaluation under uncertainty and organizational constraints. Organizations frequently struggle to efficiently allocate limited resources while ensuring alignment between security scope and business objectives. This study proposes a process-integrated decision-support framework that combines Design Science Research with Multi-Attribute Utility Theory (MAUT) to address this challenge. The framework embeds structured scope elicitation within project-management processes and links it to interval-based multi-criteria aggregation. It is evaluated through two analytically constructed scenarios representing low-and high-complexity environments. Results demonstrate that iterative scope construction combined with uncertainty-aware MAUT modelling enhances preference robustness, improves transparency of trade-offs, and reduces misalignment between investment alternatives and organizational requirements. The study contributes to the bridging of governance processes with formal decision analysis and by reframing information security investment as a dynamic scope-alignment problem rather than a static optimization task. Implications for research and practice are discussed.