Avrupa Birliği’ne Aday Ülkelerin Pandemi Öncesi ve Sonrası Siber Güvenlik Performansı: Centroidous ve RAPS Yöntemleri ile Bir Değerlendirme

Abstract

Dijital dönüşüm ile ortaya çıkan çok boyutlu siber güvenlik risklerinin tanımlanabilmesi, öngörülebilmesi, bertaraf edilebilmesi amacıyla ülkelerin veya kurumların karşı karşıya kaldıkları bu durumlarla mücadele edebilmeleri için mevcut durumlarını tespit etmeleri önem arz etmektedir. Bu nedenle ülkeler veya kurumlar dijital güvenlik performanslarının değerlendirilmesi için siber güvenlik kapasitelerini ölçen araçlara ihtiyaç duymaktadır. Buna paralel olarak Avrupa Birliği yasal düzenlemelerle hem üye hem de aday ülkelere siber güvenliğe yönelik bağlayıcı yükümlülükler getirmiştir. Bu durum siber güvenlik performansının ölçülmesini yalnızca teknik değil, politik ve hukuki açılardan da izlenmesi gereken bir konu haline getirmiştir. Bu çalışmada Avrupa Birliği’ne aday ülkelerin siber güvenlik performansları pandemi öncesi ve sonrası olmak üzere iki ayrı dönem için analiz edilmiştir. Ulusal Siber Güvenlik Endeksi’nde yer alan on iki performans göstergesi Centroidous yöntemi ile objektif biçimde ağırlıklandırılmış, ardından RAPS yöntemiyle Avrupa Birliği’ne aday dokuz ülkenin performansları sıralanmıştır. Çalışma siber güvenlik performansının nesnel verilerle ölçülmesine yönelik alternatif bir metodoloji sunarak, politika yapıcılar için karar mekanizması oluşturmaktadır. Elde edilen bulgular sonucunda pandemi sonrasında siber güvenlik performansı göstergelerinden politika geliştirme, siber olaylara müdahale ve eğitim kriterlerinin önem kazandığı, siber tehdit paylaşımı, elektronik kimlik ve güven hizmetleri, kişisel verilerin korunması kriterlerinin ise daha az önemli hale geldiği görülmüştür. Ek olarak, ülkelerin pandemi döneminde artan dijitalleşmeye siber güvenlik açısından ne kadar hazırlıklı olduğu ortaya koyulmuştur. Gürcistan ve Ukrayna’nın yaşanan krizleri fırsata çevirerek siber güvenlik kapasitelerini güçlendirdiği sonucuna varılmıştır. Buna karşılık özellikle Moldova ve Karadağ’ın gerekli atılımları yapamayarak siber güvenlik performanslarında gerileme yaşadığı görülmüştür. Türkiye ise orta düzeyde bir siber güvenlik performansı göstermiş, ancak rekabet gücünü arttırmak için siber güvenlik eylemlerini hızlandırması gerektiğini göstermiştir.

Keywords

• Siber güvenlik
• Dijitalleşme
• Çok kriterli karar verme

Cybersecurity Performance of European Union Candidate Countries in the Pre and Post Pandemic: An Evaluation with Centroidous and RAPS

Abstract

Digital transformation introduces complex cybersecurity risks, and countries and institutions must evaluate their capacities to identify, anticipate, and address these threats effectively. Accordingly, there is a growing need for tools to assess digital security capabilities and evaluate cybersecurity performance. In parallel, the European Union has introduced legally binding cybersecurity obligations for both member and candidate countries through regulatory frameworks. As a result, assessing cybersecurity performance has become not only a technical matter but also a political and legal imperative. This study analyzes the cybersecurity performance of European Union candidate countries in two distinct periods: before and after the pandemic. Twelve performance indicators from the National Cyber Security Index were objectively weighted using Centroidous, and the performance of nine candidate countries was subsequently ranked using the RAPS method. By proposing an alternative methodology for objectively measuring cybersecurity performance, this study contributes to decision-making processes for policymakers. The findings reveal that, in the post-pandemic period, the importance of cybersecurity indicators changed considerably. Policy development, incident response, and training gained importance, while cyber threat sharing, electronic identity and trust services, protection of personal data indicators became relatively less significant. Furthermore, the analysis pointed out which countries were prepared for the rapid digitalization during the pandemic. According to the findings, Georgia and Ukraine transformed crisis into an opportunity by strengthen their cybersecurity capacities, whereas Moldova and Montenegro made insufficient progress. Türkiye has demonstrated a moderate level of cybersecurity performance, however, it needs to accelerate its cybersecurity efforts to enhance its competitive standing.

Keywords

• Cybersecurity
• Digitalization
• Multi criteria decision making

References

1. Alamoudi, M. H., & Bafail, O. A. (2022). BWM—RAPS approach for evaluating and ranking banking sector companies based on their financial ındicators in the saudi stock market. Journal of Risk and Financial Management, 15, 467. https://doi.org/10.3390/jrfm15100467
2. Altıntaş, F. F. (2022). G7 ülkelerinin siber güvenlik performanslarının analizi: Entropi tabanlı MABAC yöntemi ile bir uygulama. Güvenlik Bilimleri Dergisi, 11(1), 263–286. https://doi.org/10.28956/gbd.1109776
3. Bafail, O. A., Abdulaal, R. M. S., & Kabli, M. R. (2022). AHP-RAPS approach for evaluating the productivity of engineering departments at a public university. Systems, 10, 107. https://doi.org/10.3390/systems10040107
4. Barik, K., Misra, S., Konar, K., Kaushik, M., & Ahuja, R. (2022). A comparative study on the application of text mining in cybersecurity. Recent Advances in Computer Science and Communications, 16(3), 80-93. https://doi.org/10.2174/2666255816666220601113550
5. Bui, H. A., & Nguyen, X. T. (2024). A novel multicriteria decision-making process for selecting spot welding robot with removal effects of criteria techniques. International Journal on Interactive Design and Manufacturing, 18(2), 1033–1052. https://doi.org/10.1007/s12008-023-01650-9
6. Chaudhuri, A., Behera, R. K., & Bala, P. K. (2025). Factors impacting cybersecurity transformation: An Industry 5.0 perspective. Computers and Security, 150, 104267. https://doi.org/10.1016/j.cose.2024.104267
7. CMM (2021). The Cybersecurity Capacity Maturity Model. https://gcscc.ox.ac.uk/the-cmm (Erişim Tarihi 10 Şubat 2025)
8. CRI (2015). Cybersecurity Readiness Index. https://www.potomacinstitute.org/steps/index.php/component/content/article/cyber-readiness-index-cri-2-0?catid=31%26Itemid=101 (Erişim Tarihi 10 Şubat 2025)

9. CSF (2018). Cyber Security Framework. https://www.nist.gov/cyberframework (Erişim Tarihi 10 Şubat 2025)
10. Cybersecurity Act (2019). https://eur-lex.europa.eu/eli/reg/2019/881/oj (Erişim Tarihi 10 Şubat 2024)
11. Çifci, H. (2024). Cybersecurity Maturity of Turkey: An assessment with ENISA’s National Capabilities Assessment Framework (NCAF). Savunma Bilimleri Dergisi, 20(2), 191-210. https://doi.org/10.17134/khosbd.1450078
12. de Azambuja, A. J. G., Plesker, C., Schützer, K., Anderl, R., Schleich, B., & Almeida, V. R. (2023). Artificial intelligence-based cyber security in the context of Industry 4.0—A Survey. Electronics (Switzerland), 12, 1920. https://doi.org/10.3390/electronics12081920
13. Dünya Bankası (2025). DataBank: World Development Indicators. https://data.worldbank.org/indicator?tab=all (Erişim Tarihi 19 Aralık 2025)
14. e-Governance Academy (2018). National Cyber Security Index (NCSI). https://ncsi.ega.ee/ (Erişim Tarihi 18 Ocak 2025)
15. Erdem, M., & Özdemir, A. (2025). Evaluation of cyber security risk pillars for a digital, innovative, and sustainable model utilizing a novel fuzzy hybrid optimization. Computers and Security, 153, 104394. https://doi.org/10.1016/j.cose.2025.104394
16. European Union. (2016). Directive (EU) 2016/1148 on security of network and information systems (NIS Directive). Official Journal of the European Union. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016L1148 (Erişim Tarihi 18 Ocak 2025)
17. European Union. (2022). Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2 Directive). Official Journal of the European Union. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022L2555 (Erişim Tarihi 18 Ocak 2025)
18. Fagarazzi, A. (2024). Impact of digital development level on National Cybersecurity Index. Business Excellence, 18(2), 37-61. https://doi.org/10.22598/pi-be/2024.18.2.37
19. Farahbod, K., Shayo, C., & Varzandeh, J. (2020). Cybersecurity indices and cybercrime annual loss and economic impacts. Journal of Business and Behavioral Sciences, 32(1), 63-71.
20. GCI (2024). Global Cybersecurity Index, https://www.itu.int/en/ITU-D/Cybersecurity/Pages/global-cybersecurity-index.aspx (Erişim Tarihi 25 Mart 2025)
21. GDPR (2018). General Data Protection Regulation. https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 (Erişim Tarihi 25 Mart 2025)
22. Geleta, R. (2018). Cyber security metrics for performance measurement in E-Business. International Conference on Smart Systems and Inventive Technology (220-222), IEEE.
23. Goutam, R. K. (2015). Importance of cyber security. International Journal of Computer Applications, 111(7), 14-17.
24. Gupta Bhol, S., Mohanty, J. R., & Kumar Pattnaik, P. (2023). Taxonomy of cyber security metrics to measure strength of cyber security. Materials Today: Proceedings, 80, 2274–2279. https://doi.org/10.1016/j.matpr.2021.06.228
25. Hwang, C.-L., & Yoon, K. (1981). Multiple attribute decision making: Methods and applications—A state-of-the-art survey (Lecture Notes in Economics and Mathematical Systems, Vol. 186). Springer. https://doi.org/10.1007/978-3-642-48318-9
26. ITU (2008). International Telecommunication Union. https://www.itu.int/rec/T-REC-X.1205-200804-I/en (Erişim Tarihi 18 Ocak 2025)
27. Kayişoğlu, G., Güneş, B., & Bolat, P. (2024). ECDIS cyber security dynamics analysis based on the fuzzy FUCOM method. Transactions on Maritime Science, 13(1). https://doi.org/10.7225/toms.v13.n01.w09
28. Khatun, M., Wagner, F., Jung, R., & Glaß, M. (2023). An application of DEMATEL and fuzzy DEMATEL to evaluate the interaction of safety management system and cybersecurity management system in automated vehicles. In Engineering Applications of Artificial Intelligence (Vol. 124). Elsevier Ltd. https://doi.org/10.1016/j.engappai.2023.106566
29. Küpeli, M., & Söğüt, E. (2024). Assessment of the Cybersecurity Efficiency of G20 Countries Using Data Envelopment Analysis. 17th International Conference on Information Security and Cryptology (1-4), IEEE. https://doi.org/10.1109/ISCTrkiye64784.2024.10779233
30. Maisikeli, S. G. (2020). UAE cybersecurity perception and risk assessments compared to other developed nations, 3rd International Conference on Information and Computer Technologies (ICICT) (432-439) IEEE. https://doi.org/10.1109/ICICT50521.2020.00075
31. Maniya, K., & Bhatt, M. G. (2010). A selection of material using a novel type decision-making method: Preference selection index method. Materials & Design, 31(4), 1785–1789. https://doi.org/10.1016/j.matdes.2009.11.020
32. Mohamed, M., Abdelmouty, A. M., Mohamed, K., & Smarandache, F. (2025). SuperHyperSoft-driven evaluation of smart transportation in Centroidous-MOOSRA: Real-world insights for the UAV era. Neutrosophic Sets and Systems, 78, 149–163.
33. OECD Report. (2020). Going Digital Integrated Policy Framework, OECD Digital Economy Papers, No. 292, OECD Publishing, https://www.oecd.org/en/publications/going-digital-integrated-policy-framework_dc930adc-en.html (Erişim Tarihi 18 Ocak 2025)
34. OECD Report. (2024). New perspectives on measuring cybersecurity, OECD Digital Economy Papers, No. 366, OECD Publishing, https://doi.org/10.1787/b1e31997-en (Erişim Tarihi 18 Ocak 2025)
35. Prasetya, Y. W. A., Suhardjo, B., & Munir, R. (2024). Regression analysis of the national cyber security index in the Southeast Asia Region. Asian Journal of Social and Humanities, 2, 1206.
36. Radulescu, C. Z., Radulescu, M., Vevera, A. V., & Boncea, R. (2024). Extended Group TOPSIS method with application for Cybersecurity. 10th 2024 International Conference on Control, Decision and Information Technologies (1768–1773), IEEE. https://doi.org/10.1109/CoDIT62066.2024.10708191
37. Salih, A. A., & Abdulrazzaq, M. B. (2023). Cyber security: performance analysis and challenges for cyber attacks detection. Indonesian Journal of Electrical Engineering and Computer Science, 31(3), 1763–1775. https://doi.org/10.11591/ijeecs.v31.i3.pp1763-1775
38. Sellak, H., Chhetri, M. B., Grobler, M., & Moore, K. (2021). ACSIMA: A Cyber Security Index for Mobile Health Apps. Proceedings - 2021 36th IEEE/ACM International Conference on Automated Software Engineering Workshops (145–152), IEEE. https://doi.org/10.1109/ASEW52652.2021.00039
39. Shtantsel, S., Buryk, Z., Grytsyshen, D., Yevenok, O., & Sergiienko, L. (2024). Evaluating Information Security Strategies in the Public Sector: Efficiency and Cybersecurity Risks, Journal of Information Systems Engineering and Management, 10(2s), 348-358. https://doi.org/10.52783/jisem.v10i2s.323
40. Stević, Ž., Pamučar, D., Puška, A., & Chatterjee, P. (2020). Sustainable supplier selection in healthcare industries using a new MCDM method: Measurement of alternatives and ranking according to Compromise solution (MARCOS). Computers & Industrial Engineering, 140, 106231. https://doi.org/10.1016/j.cie.2019.106231
41. Tanaji, B. A., & Roychowdhury, S. (2024). BWM Integrated VIKOR method using Neutrosophic fuzzy sets for cybersecurity risk assessment of connected and autonomous vehicles. Applied Soft Computing, 159, 111628. https://doi.org/10.1016/j.asoc.2024.111628
42. Urošević, K., Gligorić, Z., Janković, I., Gluščević, B., & Beljić, Č. (2025). Simulation of MCDM process—stope and fan pattern selection in an underground mine with uncertainty. Mathematics, 13, 786. https://doi.org/10.3390/math13050786
43. Urošević, K., Gligorić, Z., Miljanović, I., Beljić, C., & Gligorić, M. (2021). Novel methods in multiple criteria decision-making process (Mcrat and raps)—application in the mining industry. Mathematics, 9, 1980. https://doi.org/10.3390/math9161980
44. Ünver, G. N. (2023). Comparison of cyber security policies of Türkiye and England. Cyberpolitik Journal, 8(16), 49-84.
45. Van Dua, T. (2025). Development of The PSI-RAPS-MCRAT Method: A Hybrid Model. EUREKA, Physics and Engineering, 2025(1), 141–151. https://doi.org/10.21303/2461-4262.2025.003404
46. Van Thien, N., Dung, H. T., & Trung, D. D. (2024). Overcoming the limitations of the RAPS method by identifying alternative data normalization methods. Engineering, Technology and Applied Science Research, 14(4), 15745–15750. https://doi.org/10.48084/etasr.7909
47. Vinogradova-Zinkevič, I. (2024). Centroidous method for determining objective weights. Mathematics, 12(14), 2269. https://doi.org/10.3390/math12142269
48. Zavadskas, E. K., & Turskis, Z. (2010). A new additive ratio assessment (ARAS) method in multicriteria decision-making. Technological and Economic Development of Economy, 16(2), 159–172. https://doi.org/10.3846/tede.2010.10
49. Zavadskas, E. K., Turskis, Z., Antucheviciene, J., & Zakarevicius, A. (2012). Optimization of weighted aggregated sum product assessment. Elektronika ir Elektrotechnika, 122(6), 3–6. https://doi.org/10.5755/j01.eee.122.6.1810