Risk Assessment for Cyber Resilience of Critical Infrastructures: Methods, Governance, and Standards - Ali Aghazadeh Ardebili; Marianna Lezzi; Mahdad Pourmadadkar (Applied Sciences)
As future infrastructures increasingly rely on digital systems, their exposure to cyber threats has grown significantly. The complex and hyper-connected nature of these systems presents challenges for enhancing cyber resilience against adverse conditions, stresses, attacks, or compromises on cybersecurity resources. Integrating risk assessment with cyber resilience allows for adaptive approaches that can effectively safeguard critical infrastructures (CIs) against evolving cyber risks. However, the wide range of methods, frameworks, and standards—some overlapping and others inadequately addressed in the literature—complicates the selection of an appropriate approach to cyber risk assessment for cyber resilience. To investigate this integration, this study conducts a systematic literature review (SLR) of relevant methodologies, standards, and regulations. After conducting the initial screening of 173 publications on risk assessment and cyber resilience, 40 papers were included for thorough review. The findings highlight risk assessment methods, standards, and guidelines used for cyber resilience and provide an overview of relevant regulations that strengthen cyber resilience through risk assessment practices. The results of this paper will offer cybersecurity researchers and decision-makers an illuminated understanding of how risk assessment enhances cyber resilience by extracting risk assessment best practices in the literature supported by relevant standards and regulations.