AHP-TOPSIS-Based Cybersecurity Control Prioritization for Local E-Government: Integrating COBIT 2019 and ISO/IEC 27001:2022 in Ecuador

Authors

• Gabriel Neptali Bailon Arcentales, Universidad Bolivariana del Ecuador (UBE), Guayaquil, Ecuador
• Jair Andres Semblantes Pinto, Universidad Bolivariana del Ecuador (UBE), Guayaquil, Ecuador
• Noel Batista Hernandez, Universidad Bolivariana del Ecuador (UBE), Guayaquil, Ecuador

Abstract

Local governments in Ecuador manage critical citizen services yet operate with limited cybersecurity maturity. This paper presents MPEC-GAD, a cybersecurity governance model integrating COBIT 2019 strategic alignment with ISO/IEC 27001:2022 technical controls, using AHP-TOPSIS multi-criteria prioritization. Applied to GAD Jaramijo (Manabi, Ecuador), the four decision criteria weight risk reduction, implementation cost, deployment time, and technical complexity (AHP Consistency Ratio CR = 0.0054 < 0.10). The TOPSIS ranking directs scarce resources toward the 47 mandatory EGSI controls with highest risk-reduction per investment unit. A single-round structured review by seven experts rated pertinence, viability and completeness with mean scores >=4.0/5.0.

Recommended Citation

Bailon Arcentales, Gabriel Neptali; Jair Andres Semblantes Pinto; and Noel Batista Hernandez. "AHP-TOPSIS-Based Cybersecurity Control Prioritization for Local E-Government: Integrating COBIT 2019 and ISO/IEC 27001:2022 in Ecuador." Neutrosophic Sets and Systems 101, 1 (2026). https://digitalrepository.unm.edu/nss_journal/vol101/iss1/17