Abstract
The emergence of cloud computing networks has led to a sharp rise in the frequency of cyberattacks. As a result, networks' appropriate security has become an issue for organisations. Organisations' information security advisors must make difficult and complex choices when evaluating and choosing information security measures that allow for the protection of their assets and resources. Controls for information security must be chosen depending on the proper level of security. However, choosing them requires a thorough examination into the organization's vulnerabilities, risks, and threats as well as taking into account the organization's budgetary and implementation limits. By suggesting a formalised method, the Complex Proportional Assessment (COPRAS) Method, this research aimed to enhance the information security control analysis process. This method was used to rank and choose the most pertinent collection of information security controls to meet an organization's information security needs. In order to determine which information security measures are most suited for an organisation, we contend that the prioritisation of those controls using the (COPRAS) Method results in an effective and economical assessment and evaluation of those controls. In order to implement security and privacy successfully, an organisation with a network connected with the cloud needs to evaluate and prioritise the information security measures. The organisation intends to exert as much effort as possible to analyse ISCs, which are crucial for risk management, in this situation with few resources. For organisations, choosing the right information security policies is a serious and crucial issue. This section's goal is to select the top ISCs from a list of available options. The organisation wants to include all necessary factors that might be used in the selection of security controls. Implementation time (C1), effectiveness (C2), risk (C3), budgetary restrictions (C4), exploitation time (C5), maintenance cost (C6), and mitigation time (C7) are the seven key factors used by the decision makers' team to select and evaluate ISCs. By using the COPRAS METHOD, the Information Security Control 2 received the top ranking and the Information Security Control 5 received the bottom ranking. Implementation time (C1), Effectiveness (C2), Risk (C3), Budgetary Constraints (C4), Exploitation time (C5), Maintenance cost (C6), and Mitigation time (C7) are the evaluation factors.