# "Check, Check, Check, We Got Those" – Catalogue Use in Information Security Risk Management

Erik Bergström, Martin Lundgren, Karin Bernsmed, Guillaume Bour

► To cite this version:

Erik Bergström, Martin Lundgren, Karin Bernsmed, Guillaume Bour. "Check, Check, Check, We Got Those" – Catalogue Use in Information Security Risk Management. 17th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2023, Kent, United Kingdom. pp.181-191, 10.1007/978-3-031-38530-8_15. hal-05462109

HAL Id: hal-05462109

https://inria.hal.science/hal-05462109v1

Submitted on 16 Jan 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
<figure><img src="image_3.png" /></figure>

“Check, Check, Check, We Got
Those” – Catalogue Use in Information Security
Risk Management

Erik Bergström<fnref n="1" />(✉), Martin Lundgren<fnref n="2" />(✉), Karin Bernsmed<fnref n="3" />(✉), and Guillaume Bour<fnref n="3" />(✉)

**Abstract.** Information Security Risk Management (ISRM) is fundamental in most organisations today. The literature describes ISRM as a complex activity, and one way of addressing this is to enable knowledge reuse in the shape of catalogues. Catalogues in the ISRM domain can contain lists of, e.g. assets, threats and security controls. In this paper, we focus on three aspects of catalogue use. Why we need catalogues, how catalogue granularity is perceived, and how catalogues help novices in practice. As catalogue use is not yet a widespread practice in the ISRM, we have selected a domain where catalogues are a part of the ISRM work. In this case, the Air Traffic Management (ATM) domain uses a methodology that includes catalogues and is built on ISO/IEC 27005. The results are based on data collected from 19 interviews with ATM professionals that are either experts or novices in ISRM. With this paper, we nuance the view on what catalogues can contribute with. For example, consistency, coherency, a starting point and new viewpoints. At the same time, we identify the need to inform about the aim of the catalogues and the limitations that come with catalogue use in order to leverage the use – especially from a novice perspective.

**Keywords:** Information Security Risk Management · Catalogues · Risk management practice

# 1 Introduction

Most organisations worldwide depend on securing their information assets and need skilled labour to do so. Today, information security-related jobs are among the most in-demand jobs and in the coming decade, it is expected to be one of the fastest-growing sectors [1]. Such growth implies many more information security novices will be on the

<footnote n="1">¹ School of Engineering, Department of Computer Science and Informatics, Jönköping University, Jönköping, Sweden
erik.bergstrom@ju.se</footnote>

<footnote n="2">² School of Informatics, University of Skövde, Skövde, Sweden
martin.lundgren@his.se</footnote>

<footnote n="3">³ SINTEF Digital, Trondheim, Norway
{karin.bernsmed,guillaume.bour}@sintef.no</footnote>
job market in the coming years. We also know that working with security, especially with more complex tasks such as Information Security Risk Management (ISRM), can be difficult for novices to understand and follow [2].

One way to address the lack of knowledge is to reuse knowledge that could lower the barriers to working with information security. One way of reusing knowledge is through catalogues, which can be described as a body of knowledge accumulated from previous experience [3]. Similar approaches are used in other related fields. There are, for instance, catalogues listing non-functional requirements [3] and information systems outsourcing risks [4]. In an ISRM context, catalogues are used primarily to support identifying assets, threats and security controls [5].

Support, e.g. in the shape of catalogues in the ISRM domain, can help professionals by providing a systematic overview of relevant security issues [6]. Catalogues could be usable for information security professionals regardless of if they are novices or experts, as even experts could miss treating a risk relevant to a system [7].

Leming [8] describes having a complete asset catalogue as a way of keeping track of assets and as a fundamental part of good risk management. A very recent article by Andersson [9] lists the lack of catalogues as one of the major problems in information classification and requests focus on the subject in future studies. There are also open questions regarding how detailed catalogues should be [10] and how they should be maintained [9].

Little research sheds light on how catalogues as a method for reusing knowledge are perceived in practice [11]. Perhaps there is a lack of interest because catalogue use has not yet permeated the ISRM community. Additionally, there is little research on ISRM from a security-novice perspective [2]. This paper addresses these needs by investigating three fundamental aspects of catalogues: Why do we need catalogues, how is catalogue granularity perceived, and how do catalogues help novices?

# 2 Background

This section introduces ISRM in the chosen domain (air traffic management) and the background on catalogue use in ISRM.

## 2.1 Information Security Risk Management in Air Traffic Management

Traditionally, aviation security has focused on aircraft and ground infrastructure security [12]. But as information systems, including those related to aviation, become evermore interconnected, new risks towards these systems emerge. Particularly, Air Traffic Management (ATM) systems are crucial to aviation safety, as they serve to separate aircraft from objects on the ground as well as other aircraft [13]. Considering ATM systems' safety and security concerns, information and cybersecurity-related risk management has become an integrated part of ATM [14]. Research and development programs such as SESAR (Single European Sky ATM Research) and NextGen (Next Generation Air Transportation System) are but two examples of initiatives to help tackle challenges in ATM security [12].
ISRM is the methodical and continuous process of identifying and protecting critical assets (e.g., information and the systems using that information) from potential vulnerabilities in those assets and the threats that might compromise their confidentiality, integrity, and availability [15]. Protection from a risk means the implementation of one or more security controls, i.e., any effort, tool, or process that aims to either remove or reduce the impact or likelihood of a threat being realised. ISRM and standardised processes are therefore applicable in any industry, including ATM and secure system engineering [12].

While numerous ISRM standards exist, they typically share three phases: asset identification, risk analysis, and security controls [16]. Each phase provides input for the next, where asset identification aims to identify and value critical information systems (e.g., onboard platforms for integrated aircraft communication). Risk analysis builds upon this information and aims to identify and prioritise risks towards those information systems (e.g., identify vulnerabilities and threats) to make informed decisions on what security controls to implement.

## 2.2 Catalogues in Information Security Risk Management

Leveraging knowledge reuse is not new and is used in most computing areas. For example, Lynne [17] suggested that experts' work could be facilitated more than two decades ago when best practices or other proven solutions were provided in a new context. In software engineering, for example, knowledge reuse is a common practice that takes many shapes, e.g. libraries, reuse design, design patterns and domain-specific software architectures and requirements reuse [11]. A study on knowledge reuse revealed that it can be represented in many different forms, such as patterns, generic models, templates, ontologies, taxonomies, profiles and catalogues [11]. Here we use the term catalogues inclusive.

Catalogue use in ISRM primarily focuses on assets, threats and security controls, but other types of catalogues exist, for example, privacy-related [7]. According to Labunets [7], catalogues can be divided into two distinct types; domain-general catalogues (for example, BSI IT-Grundschutz, ISO/IEC 27002 and 27005, and NIST 800-53) and domain-specific catalogues (for example, Payment Card Industry Data Security Standard (PCI DSS) for credit card handling, SecRAM for security and safety in ATM, OWASP for web application security, and Cloud Security Alliance (CSA) Cloud Control Matrix for cloud security). Similarly, ENISA maintains a compendium of various risk management frameworks and toolboxes in which catalogues (such as lists of different types of threats) are common [18, 19].

A potential benefit of using catalogues is the possibility of lowering the threshold of working with security as a non-expert or novice. However, not much more than a handful of papers have been measuring the effect of catalogues, and the literature is fragmented on this topic [5]. One study found that domain experts who are not security experts using catalogues can produce nearly identical results to those of domain experts without catalogues [5]. Another study found that novices perceived catalogues as less important than experts, which is interesting since one of the reasons to use catalogues is to help novices [14]. Further, Yskout, Scandariato and Joosen [20] found no difference in productivity or quality of results between teams using security patterns and those that
did not. Another issue is that the literature largely builds around studies on students as participants, which is also recognised as a threat to the validity by for example [21].

The literature also highlights the benefits of using catalogues for more experienced analysts. The analyst's background determines the quality, and they have a bias in favour of past experiences. They may therefore neglect to address risks that, despite being important to the system, are less interesting to the analysts personally [5].

Literature also points out that a non-expert may not know how and when to leverage catalogues in specific contexts [22] or when, for example, the technical background in risk catalogues inhibits participating business users [23].

The extent of the content in catalogues has also been discussed in the literature [24]. Quinn, Ivy, Barrett, Witte and Gardner [25] point out the difficulty in timing between when to perform an activity in relation to how complete the catalogues are. The content also relates to the granularity of catalogues, which has also been described as problematic [10]. For example, asset catalogues were found to lack depth and dependencies between assets [14, 26]. Some works describe what could be described as the framework for a catalogue [5, 11], i.e., key features that effective catalogues should have in terms of structure, size and coverage, and language. Also, the context where the catalogues are used must be clarified to leverage the catalogue use [14]. A similar discussion also exists on what granularity valuation should be performed [27, 28], consequently affecting the catalogues' granularity.

In addition, several papers (e.g., [9, 14, 29]) describe updating the catalogue as a major issue. The issue is partly because of the scope, size, and rate of change [29]. A positive aspect of the updating issue is that it can provide a rare opportunity to discuss consequences, leading to increased information security awareness [9].

## 3 Method

The focus of this study is to nuance the perceptions of catalogue use in ISRM. Hence, we opted for a qualitative research approach [30] centred around in-depth semi-structured interviews. In practice, this was done by targeting domain experts and novices, all working in the ATM domain and with experience working with catalogues as a part of their ISRM work. We selected the ATM domain as they use SecRAM, which is based on ISO/IEC 27005 [31] and because SecRAM has catalogues as an integrated part of the methodology. ATM is also a domain where security and safety are absolutely fundamental, as it is considered a critical infrastructure [32]. This is something that could negatively impact the data collection as the willingness to talk about internal security practices might decrease in such a domain. Even with such hinders, we completed 19 interviews with novices and experienced ISRM respondents, distributed as shown in Table 1.

To be able to capture in-depth knowledge about catalogue perceptions, we started by gathering documents describing SecRAM (7 documents, 120 pages) [33]. These documents, combined with ISO/IEC 27005 [31] and scientific literature, formed the basis for the interview guide. The semi-structured interviews drew inspiration from the laddering technique [34], which can be a useful technique for understanding tool use [35] and understanding behaviour [36]. An open-ended interview guide and a set of follow-up questions were prepared. The laddering technique, as exercised in this study, meant
that the interviewer repeatedly asks "why" in order to find the fundamental reasons underlying the perceptions and behaviour [34]. To be able to do so, the interviewing environment needs to be considered. The interviews were performed with a team of four researchers. Each interview had one lead interviewer, and the rest of the team was mainly silent in the background but with the possibility to enter the interview if deemed necessary. The interviews were performed using conferencing software which enabled data collection from organisations all over Europe and, at the same time, enabled a non-imposing interview setting for the respondent.

<table><caption>**Table 1.** Overview of the respondents and their ISRM experience.</caption><thead><tr><td>ISRM experience</td><td>Number of respondents</td></tr></thead><tbody><tr><td>Novices (less than 1 year experience)</td><td>6</td></tr><tr><td>Experts (1–3 years of experience)</td><td>7</td></tr><tr><td>Experts (over 3 years of experience)</td><td>6</td></tr></tbody></table>

Each interview lasted approximately one hour, and the interviews were transcribed (233 pages), checked, and imported into the qualitative data analysis software NVivo [37]. Based on the literature, three themes were decided on a priori (why catalogues are needed, perceptions of granularity, and how catalogues help novices). The data collected was coded thematically under these themes.

# 4 Results

The results are presented according to the themes identified a priori. Respondents are referred to as R1 to R19.

## 4.1 Why Do We Need Catalogues?

In general, the catalogues were perceived positively as helpful and valuable tools in the ISRM. Not only was there a positive perception from an individual perspective but also from a team and community perspective. Digging into the underlying reasons revealed several reasons for this perception.

Creating and maintaining catalogues creates a common body of knowledge that enables *consistency* and *coherency* within an ISRM activity or between them. The motivation for consistency is mainly that the catalogues provide an overview, while the coherency is because *structure* and *naming* are provided. When catalogues are available, they enable the reuse of information between solutions, and for R10, this was one of the reasons that pushed the use of catalogues. One example given by R15 that addressed consistency was: "If... each partner has the same catalogue, then the name is the same. You are clear that you talk about the same assets." R17 addressed the structure by highlighting the catalogues provide something fundamental that makes it easier not to forget something. This was exemplified by R7, who described a case where interviews
with managers and operators sometimes did not lead to a complete list of identified assets and that the catalogues could have helped to identify additional assets.

Catalogues are perceived as a *good starting point* from a novice and expert perspective. Catalogues can provide many examples and, thereby, a direction that is perceived as a departure point. R17 described that the biggest obstacle was not having a clear starting point when working without catalogues. The alternative to catalogues was to use brainstorming or similar activity, which novices perceived as more problematic. That was the case even if the catalogues were perceived as incomplete, as they still provided the necessary *inspiration* to get going. Inspiration was also mentioned as supporting a starting point when creating domain-specific catalogues based on domain-general catalogues.

Catalogues can also be used to provide *motivation* as to why specific controls need to be implemented. R8 described a scenario where catalogues were used to convince the customer why certain security controls needed to be implemented and procedures needed to be changed. R19 gave another example where catalogues were used as motivation to overcome what was described as a cultural dilemma. In this case, to systematise safety-related events such as injuries or fatalities that were described as a more problematic discussion in Europe than in other parts of the world.

SecRAM uses domain-specific catalogues; for example, impact areas are specified from several perspectives (e.g., economic, capacity, branding and environment). Catalogues offer the possibility to explicate such aspects in great detail, thereby broadening the perspective and enabling new *viewpoints* on assets, threats and security controls. Several novices described this as a major advantage of catalogue use. At the same time, the experts unanimously saw risks of the opposite – that catalogues can inhibit taking in viewpoints. It was described that catalogues could limit creativity and deter the group from exploring the entire nature of the system. R12 meant that it is possible that with catalogues, it becomes: "*check, check, check, we got those [security controls]...now we are good.*" Similarly, R5 perceived people as being stuck in looking at the defined list and stopped to think when they came in front of them. A novice, R13 was on the same track and perceived that it was difficult to think beyond what already was in the catalogues, especially when considering new threat scenarios and new variants of existing ones. R12 suggested one way of leveraging catalogues; to introduce them a bit later in the process so that they do not confine people. Maybe R6 summarised the viewpoint issue best by stating: "*Catalogues are a good thing, but it also brings some constraints.*"

## 4.2 How is Catalogue Granularity Perceived?

The granularity of catalogues was a heavily discussed topic among the respondents, and most of the novices and experts believed the catalogues to be incomplete and too general. Most respondents had found items to add to the catalogues to make them more complete. One of the respondents (R11) described that the perceived biggest weakness was the incompleteness of the catalogues, and R6 added that they sometimes did not know what to do when there was a missing item in the catalogues.

Some novices remarked that the granularity was too high for them, and one of the novices (R1) had taken a copy of the catalogue, grouped some items, and deleted some to make it more manageable. On the same line was another novice (R2) who believed that the catalogues had a lot of redundant information and could be shortened. One of the
experts (R6) experienced the catalogues to have both too high and too low granularity depending on where in the catalogues you looked, which also impacted the use negatively.

Several respondents (e.g., R5, R6, R9, and R19) believed that creating complete catalogues is utopic. R5 put it as *"I say it is very difficult to do it for primary assets, then you can imagine it is simply not possible to do it on the level of supporting assets, and then also not possible to do it on the level of threats and actually absolutely not possible to do it on level of vulnerabilities ... you can only do it with a low granularity."* In the end, it is also not possible from a resource perspective either or as R19 described it: *"You have to trade off how much resources you throw into something before you invest in it. And I personally believe... security has also become such a mammoth task, because when you really look into the different technologies that we are using in ATM, it is just not feasible to use enough security experts to cover every corner."*

Finally, the catalogues are rudimentary and represented in spreadsheets, which was shown to be a format that did not provide enough support for the activities. Several respondents commented that better tool support is needed to support more extensive catalogues with higher granularity. Tools could also enable a more straightforward path between the activities and decrease the manual work that can generate errors. In addition, it was suggested that tool support could help novices by providing structure to the ISRM process.

## 4.3 How do Catalogues Help Novices?

Catalogues were perceived to help novices. Experts that reflected on their time as novices exemplify this. For example, R16 stated: *"The catalogue of security controls helped a lot. Without that, it was difficult for me as a beginner."* Furthermore, it was described by R19 that the catalogues are lowering the bar of working with security since they *"offer good, general sort of introductory level mechanisms that allow non-experts, as part of their day-to-day project work, to deal with security questions which then ultimately trigger stronger security assessments if needed."* A novice confirmed this and added that the beginning of the process was the most difficult and that the catalogues made it easier to get into the concepts that are used in the security domain. It may be because catalogues with definitions provide a standardised vocabulary that can help novices. For example, R2 meant that some of the terms used in the security domain are very specific to that domain. It can be intimidating for people participating in a workshop to enter the domain without a clear understanding of the terms.

A significant inhibitor, as mentioned in the granularity section, was the lack of information about the completeness of the catalogues. It was difficult for novices to understand that the catalogues were incomplete and some of the text in them were "fuzzy" (R2), making it hard to focus as there was a hidden assumption that they were complete.

One of the novices, R9, described a lack of knowledge in the security domain and that the ISRM process became too complicated despite having catalogues. Another novice, R14, in a similar situation, concluded that catalogues are good but don't replace team members with specific skills. In this case, the notion came from an experience where the novice did not have the technical expertise to understand details about communication
and where the catalogues required that type of expertise. Hence, it was necessary to
bring in extra expertise to leverage the content of the catalogue.

# 5 Discussion

This study gives insights into a topic that has not attracted especially much attention
from researchers in the ISRM community. More specifically, we focused on why we
need catalogues, how granularity is perceived, and how catalogues help novices.

When consistency and coherency are provided as a consequence of catalogue use,
one of the respondents mentioned a decrease in the use of the “gut feeling” as a positive
effect. This relates to the subjective judgement issue in ISRM, a persistent problem that
leads to inconsistent decisions [38]. Anything that can decrease subjective judgement
and increase the consistency and the result of, for example, a classification will, in turn,
improve the quality of the subsequent ISRM activities [39].

Both experts and novices described that catalogues fill a fundamental gap in ISRM by
providing a more structured approach to identifying assets, threats, and security controls
that would result in a more complete analysis. At the same time, there was a unanimous
belief that one has to be cautious because catalogues also limit the viewpoints, making
you a bit more confined. Perhaps the use limits the creativity that impacts the thinking
outside the box that can help identify items that are not described in the catalogues. This
was especially true when completely new scenarios were considered and not variants of
existing ones.

From several perspectives, the notion of having complete catalogues with definitions
of all assets, threats, and controls is utopic, especially if domain-generic catalogues are
considered. One of the respondents emphasised that the continuous work of updating
the catalogues is valuable and interesting to the community, which is in line with the
findings in Andersson [9]. Perhaps can the tedious updating work be seen from a more
positive angle and contribute to raising awareness rather than be a necessary evil.

# 6 Conclusions

This study has investigated domain-specific catalogue use in ISRM. It is clear that knowl-
edge reuse in the shape of catalogues provides many benefits, including consistency and
coherency within an ISRM activity or between them, a starting point for ISRM activi-
ties, motivation and enabling new viewpoints. For novices, catalogues also provide an
essential source of information about terms that make it easier to enter the security
domain.

At the same time, there are some very important lessons from this study, especially
for novices. It is necessary to better communicate the aim and purpose of the catalogues.
There are some potentially negative consequences of using catalogues for some users.
For example, it can limit their viewpoints and lead them to believe that the catalogues are
complete. A simple introduction that the catalogues are not complete and that they are
living documents could remove some of the tensions experienced by novices. Catalogue
users must also understand that the use can limit their viewpoints and be encouraged to
insert new items into the catalogues.
In general, there is little focus in the literature on what can be described as the
framework for knowledge reuse [11] in the security domain, i.e. how the knowledge
should be represented and if some aspects can be automated. Future studies could outline
more on the content needed in catalogues to make them even more useful.

Another suggestion for future work is to do more studies on measuring the effect of catalogue use. As the literature is somewhat limited and fragmented, future studies could try to consider the suggestion of when the catalogues are introduced in the process. Current studies have used a more binary approach where it is either catalogues or no catalogues in the experiments. At the same time, a third group could have the catalogues introduced after a while to see if this leverages catalogue use for novices.

Finally, we investigated the use of domain-specific catalogues. More studies are needed to investigate both domain-general and domain-specific catalogues. The domain-general can be an entry point for increased catalogue use if they get greater attention in literature and practice. The domain-specific ones have a possibility to give more, and one suggestion could be to investigate the reuse of knowledge between domains, as it is a costly and time-consuming activity to keep the catalogues updated.

**Acknowledgement.** We gratefully acknowledge the grant from the Swedish Civil Contingencies Agency (MSB), project VISKA (MSB 2021–14650) and the funding from the SESAR JU under the EU H2020 research and innovation programme (grant agreement 731765).

References

1. Fortune Media IP Limited. https://fortune.com/education/articles/this-cybersecurity-job-is-one-of-the-fastest-growing-in-the-u-s-and-it-pays-six-figures/

2. Osborn, E., Simpson, A.: Risk and the small-scale cyber security decision making dialogue—a UK case study. Comput. J. **61**, 472–495 (2018)

3. Carvalho, R.M., Andrade, R.M., Lelli, V., Silva, E.G., de Oliveira, K.M.: What about catalogs of non-functional requirements? In: REFSQ Workshops (2020)

4. Sá-Soares, F., Soares, D., Arnaud, J.: A catalog of information systems outsourcing risks. Int. J. Inf. Syst. Proj. Manage. **2**, 23–43 (2022)

5. de Gramatica, M., Labunets, K., Massacci, F., Paci, F., Tedeschi, A.: The role of catalogues of threats and security controls in security risk assessment: an empirical study with ATM professionals. In: Fricker, S.A., Schneider, K. (eds.) REFSQ 2015. LNCS, vol. 9013, pp. 98–114. Springer, Cham (2015). https://doi.org/10.1007/978-3-319-16101-3_7

6. Rudolph, M.: Generation of usable policy administration points for security and privacy. Technische Universität Kaiserslautern, vol. Ph.D., p. 386, Fraunhofer Verlag (2020)

7. Labunets, K.: Security Risk Assessment Methods: An Evaluation Framework and Theoretical Model of the Criteria Behind Methodsâ Success. University of Trento (2016)

8. Leming, R.: Why is information the elephant asset? An answer to this question and a strategy for information asset management. Bus. Inf. Rev. **32**, 212–219 (2015)

9. Andersson, S.: Problems in information classification: insights from practice. Inf. Comput. Secur. (2023)

10. Luh, R., Temper, M., Tjoa, S., Schrittwieser, S., Janicke, H.: PenQuest: a gamified attacker/defender meta model for cyber security assessment and education. J. Comput. Virol. Hacking Tech. **16**(1), 19–61 (2019). https://doi.org/10.1007/s11416-019-00342-x
11. Souag, A., Mazo, R., Salinesi, C., Comyn-Wattiau, I.: Reusable knowledge in security requirements engineering: a systematic mapping study. Requirements Eng. **21**(2), 251–283 (2015). https://doi.org/10.1007/s00766-015-0220-8

12. Asgari, H., et al.: Provisioning for a distributed ATM security management: the GAMMA approach. IEEE Aerosp. Electron. Syst. Mag. **32**, 5–21 (2017)

13. Nie, R.T., Zhao, Y., Dai, J.H.: Evaluation on safety performance of air traffic management based on fuzzy theory. In: 2009 International Conference on Measuring Technology and Mechatronics Automation, pp. 554–557 (2009)

14. Bernsmed, K., Bour, G., Lundgren, M., Bergström, E.: An evaluation of practitioners’ perceptions of a security risk assessment methodology in air traffic management projects. J. Air Transp. Manag. **102**, 102223 (2022)

15. Whitman, M.E., Mattord, H.J.: Management of Information Security. Cengage Learning, Stamford (2013)

16. Lundgren, M., Bergström, E.: Dynamic interplay in the information security risk management process. Int. J. Risk Assess. Manage. **22**, 212–230 (2019)

17. Lynne, M.M.: Toward a theory of knowledge reuse: types of knowledge reuse situations and factors in reuse success. J. Manag. Inf. Syst. **18**, 57–93 (2001)

18. Lambrinoudakis, C., et al.: Compendium of risk management frameworks with potential interoperability: supplement to the interoperable EU risk management framework report. European Union Agency for Cybersecurity (ENISA) (2022)

19. Papadatos, K., et al.: Interoperable EU Risk Management Toolbox. European Union Agency for Cybersecurity (ENISA) (2022)

20. Yskout, K., Scandariato, R., Joosen, W.: Do security patterns really help designers? In: 2015 IEEE/ACM 37th IEEE International Conference on Software Engineering, pp. 292–302 (2015)

21. Labunets, K., Paci, F., Massacci, F.: Which security catalogue is better for novices? In: 2015 IEEE Fifth International Workshop on Empirical Requirements Engineering (EmpiRE), pp. 25–32 (2015)

22. Riaz, M., et al.: Identifying the implied: findings from three differentiated replications on the use of security requirements templates. Empir. Softw. Eng. **22**(4), 2127–2178 (2016). https://doi.org/10.1007/s10664-016-9481-1

23. Hasan, B., Schäfer, P., Gómez, J.M., Kurzhöfer, J.: Risk catalogue for mobile business applications. In: Proceedings of the 13th International Joint Conference on e-Business and Telecommunications, pp. 43–53. SCITEPRESS - Science and Technology Publications, Lda, Lisbon, Portugal (2016)

24. Schmitz, C., Schmid, M., Harborth, D., Pape, S.: Maturity level assessments of information security controls: an empirical analysis of practitioners assessment capabilities. Comput. Secur. **108**, 102306 (2021)

25. Quinn, S., Ivy, N., Barrett, M., Witte, G., Gardner, R.: Identifying and estimating cybersecurity risk for enterprise risk management. Natl. Inst. Stand. Technol. NIST Spec. Publ., 1–52 (2021)

26. Brunner, M., Sauerwein, C., Felderer, M., Breu, R.: Risk management practices in information security: exploring the status quo in the DACH region. Comput. Secur. **92**, 101776 (2020)

27. Bergström, E.: Supporting information security management: developing a method for information classification. In: School of Informatics, vol. Doctoral dissertation, p. 310. University of Skövde, Skövde, Sweden (2020)

28. Fibikova, L., Müller, R.: A simplified approach for classifying applications. In: Pohlmann, N.R., Helmut; Schneider, Wolfgang (ed.) ISSE 2010 Securing Electronic Business Processes, pp. 39–49. Vieweg+Teubner (2011)

29. Rees, J., Allen, J.: The state of risk assessment practices in information security: an exploratory investigation. J. Organ. Comput. Electron. Commer. **18**, 255–277 (2008)
30. Oates, B.J.: Researching Information Systems and Computing. Sage, London (2006)

31. ISO/IEC 27005: Information technology – Security techniques – Information security risk management. ISO/IEC (2018)

32. Marotta, A., Carrozza, G., Battaglia, L., Montefusco, P., Manetti, V.: Applying the SecRAM methodology in a CLOUD-based ATM environment. In: 2013 International Conference on Availability, Reliability and Security, pp. 807–813 (2013)

33. SESAR 3 Joint Undertaking. https://www.sesarju.eu/

34. Reynolds, T.J., Gutman, J.: Laddering theory, method, analysis, and interpretation. J. Advert. Res. **28**, 11–31 (1988)

35. Skalkos, A., Tsohou, A., Karyda, M., Kokolakis, S.: Identifying the values associated with users’ behavior towards anonymity tools through means-end analysis. Comput. Hum. Behav. Rep. **2**, 100034 (2020)

36. Modesto Veludo-de-Oliveira, T., Akemi Ikeda, A., Cortez Campomar, M.: Laddering in the practice of marketing research: barriers and solutions. J. Cetacean Res. Manag. **9**, 297–306 (2006)

37. Lumivero. https://lumivero.com/products/nvivo/

38. Kaarst-Brown, M.L., Thompson, E.D.: Cracks in the security foundation: employee judgments about information sensitivity. In: Proceedings of the 2015 ACM SIGMIS Conference on Computers and People Research, pp. 145–151. ACM (2015)

39. Bergström, E., Karlsson, F., Åhlfeldt, R.-M.: Developing an information classification method. Inf. Comput. Secur. **29**, 209–239 (2021)