Mathematical Model for Assessing Cybersecurity Level in Critical Civilian Information Infrastructures: Healthcare, Energy and Education

Abstract

This paper develops and clarifies a mathematical model for assessing the cybersecurity level of critical civilian information infrastructures in healthcare, energy and education. The objective is to provide a transparent and reproducible composite index that can support institutional diagnosis, cross-sector comparison and regional policy prioritization. The model integrates three normalized dimensions: threat exposure, control effectiveness and operational resilience. Threat exposure is estimated from likelihood and impact indicators and transformed through a bounded calibration function; control effectiveness is derived from implementation and validated operational performance of security controls; and resilience is calculated from recovery and response indicators. The final cybersecurity score is expressed within the interval [0,1] through an explicit weighted aggregation formula. The article also explains the normalization logic, calibration parameter, sector-specific weighting and reproducibility conditions of the model. Because access to institutional cybersecurity datasets is limited, the application presented in this paper is illustrative and hypothetical rather than empirical. To address this limitation, the paper provides complete input tables, intermediate calculations and a sensitivity analysis showing how the final score changes under alternative weighting scenarios. The proposed framework contributes an integrated evaluation logic that links cybersecurity risk assessment, security control maturity and operational continuity into a single policy-oriented metric. JEL: O3; UDC: [004.056.5:330.4]:[338.49:351.84]