# Analysis and Ranking of IT Risk Factors Using Fuzzy TOPSIS-Based Approach
## 4 Discussion  
Many organizations find it difficult to assess information technology risk, which seems to be the largest source of information systems risk. Furthermore, current IT risk measurements are primarily focused on functional instead of strategic security risk factors. A plethora of information generated from cybersecurity technology solutions could make risk evaluations more difficult. It is essential to determine risks to one's IT systems as well as data, to decrease or manage the risk, and to create a reaction strategy in place of an IT disaster [34; 35; 36]. IT risk control strategies are influenced by legal responsibilities relating to privacy, digital transactions, and employee training. Physical and logical failures, human error, phishing, viruses, and targeted activities, as well as natural calamities such as fires, hurricanes, and floods, are all examples of IT risks. A company risk analysis can be used to handle IT risks. A planning process can assist one's company in recovering from an IT outage.  
Figure 5: Closeness coefficient graph.  
\begin{table}
\begin{tabular}{l l l} \hline \hline  & **Ci** & **Rank** \\ \hline A1 & 0.603 & 1 \\ \hline A2 & 0.524 & 3 \\ \hline A3 & 0.183 & 8 \\ \hline A4 & 0.325 & 7 \\ \hline A5 & 0.442 & 6 \\ \hline A6 & 0.522 & 4 \\ \hline A7 & 0.503 & 5 \\ \hline A8 & 0.542 & 2 \\ \hline \hline \end{tabular}
\end{table}
Table 8: Closeness coefficient.  
Due to the presence of associated risks, several IT companies are currently experiencing daunting challenges and issues of forming healthy collaborations as part of their strategic plan. These dangers must be identified and adequately controlled if an efficient strategic approach is to be established. As a result, risk evaluation makes it appear to be a critical component of the venture's progress. A hierarchical IT risk layout depiction was investigated in order to establish a conceptual framework for empirical risk evaluation in this article. The basic factors for characterizing risks as well as criteria for measuring probability and consequence have been introduced to assist in sustained evaluation. Having to convert linguistic information into mathematical risk levels has been intended using an optimized decision method based on fuzzy set theory. Decisions are made in a setting that contains three elements: certainty, uncertainty, and risk. Whilst also certainty could be assumed of a scenario where all of the variables leading to a potential situation could be precisely indicated and recognized by a decision maker, a lack of certainty is the polar contrary, producing an uncertain scenario extremely difficult to define in terms of its likelihood of occurring.  
The findings in this research show that Technology is the most significant risk factor within an organization, followed by other risk factors such as Strategic, Financial, Policy and Procedures, Environmental, Operational, Vendors, and People. IT security, particularly network security, must not be treated lightly; therefore, it is important to remember that threats are not limited to exterior cyber-attacks. In reality, more subtle but iterative risks can cause massive problems in businesses despite the fact that they can be prevented. The risk evaluation highlighted here can assist in persuading management to participate in security procedures. When used appropriately, this system would give management an understanding of the significance of their IT resources, as well as the threats they face and the likelihood that such threats would be successful in endangering the assets. This risk evaluation will also provide administration with a solid foundation for making logical and dependable risk management program investments.