A multi-criterion taxonomy of cybersecurity beneficiaries

Abstract

Cyber-attacks generate increasingly large global losses while financial resources for securing information systems remain limited. Existing reference frameworks (CIS Controls, ISO/IEC 27001, NIST CSF) lack fine-grained differentiation between beneficiary types, leading to inefficient resource allocation. This paper proposes a multi-criterion taxonomy consisting of ten organizational categories (O1–O10) and five population categories (P1–P5). The taxonomy extends the preliminary categorization matrix from [1], which was based solely on organizational size and occupational status, by introducing three additional classification criteria: sectoral risk profiles derived from attack frequency data, alignment with national legislative requirements (Republic of Moldova), and digital literacy assessment for population categories. Organizational classification employs EU SME definitions, while a four-level cybersecurity scale (Ordinary, Medium, Enhanced, High) correlates with CIS Controls implementation groups for practical application. Comparative analysis demonstrates advantages in sectoral granularity, population coverage, and applicability under resource constraints. The paper acknowledges the theoretical nature of the framework and presents a detailed three-stage validation protocol for future empirical testing, with limitations explicitly identified and primary contributions being conceptual and methodological.