# An Integrated Cyber Security Risk Management Approach for a Cyber-Physical System
## 4 An Integrated Risk Management Approach
### Risk Management Process
#### 4.2.1 Activity 1: Risk Management Context  
The risk management context formally triggers the risk management activities. The purpose of this activity is to define the system and its components, scope, the KPI, and the risk acceptance level in which an organization will tolerate the residual risk to the overall business continuity. Active involvement of the actor's requirement is taken into account, risk managers and management representatives are also considered for successfully planning of risk management activities that focus on the cybersecurity of the CPS. The initiation of risk management is determined by the implementation  
Figure 2: Metamodel. of the risk management scope, schedule, available resources, risk monitoring strategy, and risk treatment, based on the critical infrastructure organizations' objectives. It includes three steps which are given below. Step 1: Identify the system and components and existing risk management practice  
This step identifies the system and its associated components of a critical infrastructure. This step also identifies the current risk management practice for the CPS organization. We follow the NIST cyber security framework's implementation tiers for this purpose framework [28]. In particular, according to the framework, tiers range from 1 (partial) to 4 (adaptive). This allows us to understand the organization's current risk management practice and desired practice for future practice. Critical infrastructure is a unique system because of its complex, diversified, mutual interrelations among its systems, components, and other systems [34]. Due to the relationship between other components and systems, the state of one system is highly dependent on the state of the other system or component and thus these factors are called interdependencies. Interdependencies among the systems or components can be classified into four categories, as explained below. * Physical interdependency: This refers to two or more infrastructures that are physically interdependent if the operation of one infrastructure depends on the physical output of the other. * Cyber interdependency: Refers to the state of an infrastructure depending on the information communicated through the information infrastructure. * Logical interdependencies: This type of interdependency occurs when the state of each infrastructure depends on the state of the other through controls, mechanisms, regulatory or otherwise, that cannot be considered cyber, physical, or geographical. * Geographical independencies: This kind of interdependency occurs when elements of multiple infrastructures are in the same remote area. In this case, natural disasters can cause an element of one infrastructure to create failure in one or more infrastructures within close vicinity. Step 2: Determine goals and key performance indicators (KPI)  
This step identifies the organizational and security goals. The main goals are general confidentiality, integrity, availability, and reputation. Based on these goals, the key performance indicators for the organizational context are considered, as well as the strengths and weaknesses of the organization, which help to explain the need for cybersecurity risk management. It is also necessary to identify the key operational responsibilities of the critical infrastructure in order to support the cybersecurity activities. Key performance indicators play an integral role in risk management. They are the benefits and targets set by organizations and these goals must be achieved. A secure CPS should be able to provide the below KPI:  
* Confidentiality (C): This KPI deals with the disclosure of sensitive data against unauthorized users, CPS internal users, external users, and malicious attackers. It involves the deletion and transfer of data between authorized users in a secure environment to prevent data leakage. * High availability (A): Availability refers to ensuring that the assets of the critical infrastructure are made available and accessible to the end users as agreed, or when and where they need it.