# Educational Organization's Security Level Estimation Model
## 2 Related Works
### Education Organization Security Risk Assessment  
Security risk management and assessment are very closely related to some specific areas. Therefore, a security risk assessment model exists for specifically Internet of Things systems [37], cloud computing environments [38], nuclear, SCADA systems [39; 40], and other areas. Therefore, it is important to develop education organization's security risk assessment models as well.  
In a search of education or e-learning organization security risk assessment Web of Knowledge, Google Scholar, Scopus, ACM Digital Library, EBSCO Publishing, IEEE Xplore, Springer LINK, Taylor & Francis scientific journal databases were analyzed. A graph of analyzed keywords of papers is presented in Figure 1.  
The keyword bubble size indicated the occurrence of the keyword and illustrates the key keywords are concentrated on \"online learning\", \"cybersecurity\", and \"COVID-19\". Meanwhile, the keyword \"risk assessment\" is assigned to the same cluster as \"COVID-19\", while the keyword \"probabilistic risk assessment\" belongs to the \"cybersecurity\" cluster. This indicates that the education organization security risk assessment is not that popular and has no clear belonging to the cybersecurity area or more general topics.  
The analysis of existing papers on the topic of education organization and security risk assessment revealed a lack of security risk assessment models dedicated to an educational organization. Most related papers are related to some IT environments in the education organization. For instance, authors [PERSON] and [PERSON] propose a model for the university computing environment [41; 42]. The solution provides external and internal scanning and based on existing tools presents some metrics for the environ  
Figure 1: Keyword connection between the analyzed papers in search of an education organization security risk assessment model.  
ment security risk assessment. However, no universal model, oriented to any education institution and including both security-management related security risks, not just hardware/software related, are provided in this paper. Papers by [PERSON] [43], [PERSON] et al. [44] are oriented on some specific area of education institution and present the security risk assessment results rather than education organization dedicated security risk assessment model.  
Another direction on security risk assessment, related to education organizations, is the risk assessment of e-learning systems. For example, [PERSON] and [PERSON] define criteria for estimating the information security threats in an e-learning environment [45], [PERSON] and [PERSON] model security threats by using Petri nets [46], [PERSON] et al. analyses the threats to e-learning system assets [47].  
We have not succeeded to find a security risk assessment model, which would take into account the security of the organization as a whole, not separate elements of it, and would present one quantitative metric, defining the security level of the education organization. Therefore, the paper presents a new, multi-criteria decision-based model (MCDM), dedicated to educational organization security level estimation. The idea of MCDM usage in the security area is not new; however, it was not used for educational organization security level estimation. There were no security level quantitative models dedicated to educational organization security level estimation at all. The paper presents a constructed MCDM criteria list, its values normalization methods, experts' opinion-based criteria importance coefficients.