# Educational Organization's Security Level Estimation Model
## 3 Proposed Security Level Estimation Model
### Criteria Value Normalization Methods  
In multi-criteria decision making, all criteria values must be normalized. Therefore, methods to convert each criteria value to a numerical value in the range [0, 1] must be presented. For all policy and process sub-criteria, a maturity level is used as a value. The maturity level allows estimation of how optimized the policy and processes are. Especially it is important when talking about modernization, development, pandemics permutations when a clear change management plan and risk society must be developed in the organization. Maturity level allows not going into very specific details of the organization; however, provides the main level or policy and process quality in the organization. It might have one of six values (five levels and one value to indicate there are no policies for this area). The normalized numeric values for each possible value are presented in Table 1. There each value has assigned numeric value proportionally from 0 to 1. \begin{table}
\begin{tabular}{c c} \hline \hline
**Criteria Value** & **Description** & **Normalized Value** \\ \hline No policy/process exists & There is no such policy/process in the organization. & 0.0 \\ Maturity level: initial & Chaotic, poorly controlled, reactive & 0.2 \\ Maturity level: managed & Planned, performed, measured, and controlled, but still reactive. & 0.4 \\ Maturity level: defined & Well-characterized and understood, are described in standards, & 0.6 \\  & procedures, tools, and methods are proactive & \\ Maturity level: quantitatively managed & Quantitative objectives for quality and performance are established & 0.8 \\  & and used as criteria. & \\ Maturity level: optimizing & Quantitative improvement objectives are established, continually & 1.0 \\  & revised to reflect changing objectives, and used as criteria in & 1.0 \\  & managing improvement. & \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Criteria value association to normalized value for sub-criteria of policy and process top-level criteria. All sub-criteria of criteria \"people security awareness\" use binary values--whether it is or not. Therefore, very straightforward normalization method is used (1)--value 1 is assigned if the value is true, and 0 is assigned if the value is false. \[nv(x_{i})=\left\{ \begin{array}{ll}1,&x=true\\ 0,&x=false\end{array} \right. \tag{1}\]  
where \(nv(x)\) is normalized value for value \(x_{i}\) of criteria \(i\). The widest variety of normalization methods is needed for criteria \"processed data or/and used systems\". In most cases, values are categorized and must be converted into numeric values. The tables for criteria value transformation to normalized value are presented in Tables 2-4. Each one is generated with the same method--all values are listed and proportional values from 0 to 1 are assigned to each of the possible criteria values. System vulnerability estimation is based on analysis of existing vulnerabilities or used systems. The vulnerability score in NVD varies from 0.0 to 10.0; therefore, the normalized value should be calculated as the proportion between the maximum vulnerability score of \begin{table}
\begin{tabular}{c c c} \hline \hline
**Criteria Value** & **Description** & **Normalized Value** \\ \hline \multirow{3}{*}{Owner} & The organization owns the infrastructure/system & \multirow{3}{*}{0.00} \\  & and is fully responsible for it. & \\ \cline{1-1} \cline{3-3} \multirow{3}{*}{Controller} & The organization has all management rights of the infrastructure/system but does not own it. & \\ \cline{1-1} \cline{3-3} \multirow{3}{*}{Processor} & The organization has limited usage rights, & \multirow{3}{*}{0.66} \\ \cline{1-1} \cline{3-3} \multirow{3}{*}{Not used} & The infrastructure/system is not used in the organization. & \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Criteria value association to normalized value for sub-criteria information technology management responsibility.