Prioritizing Cybersecurity Controls for SDG 3: An AHP-Based Impact–Feasibility Assessment Framework

Abstract

Cybersecurity is increasingly recognized as a key enabler of Sustainable Development Goals (SDGs) and especially SDG 3 (Good Health and Well-being) as healthcare systems become more digitized. This study prioritizes cybersecurity control families from the NIST 800-53r5 framework using a structured framework combining the Analytic Hierarchy Process (AHP) and the Impact–Feasibility Matrix. From the impact–feasibility perspective, expert judgment reveals that while impact is the primary driver in selecting controls, feasibility—particularly budget and cost constraints—plays a decisive role in real-world implementation. A group of fifteen experts, including cybersecurity officers, health IT professionals, and public health advisors, has participated in structured surveys as per the methodological framework of this paper. Financial and budgetary limitations emerged as the top feasibility barrier, often determining whether high-impact controls are deployed or delayed. This underscores the need for strategic investments and phased implementation approaches, particularly in resource-constrained health systems. The results provide a practical roadmap for policymakers and healthcare administrators to allocate cybersecurity resources effectively, balancing technical necessity with economic feasibility to support resilient digital health infrastructures.