# An Integrated Cyber Security Risk Management Approach for a Cyber-Physical System
## 3 The Rationale for an Integrated Risk Management Approach  
An integrated risk management includes a combination of various components of a CPS which are interdependent and necessary for successful risk management. It needs to be a part of an organization's strategy in order to address the organization's risk management principles. Critical infrastructure organizations (i.e., health, financial, telecommunications, transportation, energy, and water) are always the targets for attackers and face different types of risks [30]. An integrated risk management scheme enforces a constant assessment of potential risks at every level in an organization and gathers the results at the corporate level to enable priority setting and minimize risk. The identification, assessment, and management of risks throughout the organization help to avoid greater risks and foster improvement of the organization. Traditional security risk assessment methods only address IT security risk or compliance risk. The integrated risk management framework will build a holistic solution considering the technical and nontechnical aspects of the organization. Figure 1 shows several areas that will incorporate into an integrated risk management approach. The main components of the integrated risk management framework are:  
* Integration of stakeholder's model: The integration of the stakeholder's model for risk management is a means of achieving greater inclusivity in an organization, and it is important for an organization to understand its own security risk management practices. This approach shows the importance of security from each and every area of the business enterprise of a critical infrastructure organization by making it clear to managers and subsequently enhancing employee commitment. In a traditional security risk assessment having just one stakeholder, which could be the compliance manager or security director, the value of the security risk assessment process is limited. An integrated risk management approach seeks to relate vulnerability findings and IT control gaps in the context of how such findings may affect attackers, users, government, shareholders, regulatory authorities, numerous individuals, or groups across an organization. It also deals with the human issues for risk management. * Measurement of cross-functional risks from organizational context: An effective risk management method renders a successful management of various factors that prevent organizations from achieving their desired security objectives. Risks depicted through an integrated risk management approach become cross-functional (i.e., a system whereby people from different areas of an organization work together as a team considering both technical and nontechnical perspectives), and the approach draws an obvious conclusion on how risks affect regulatory requirements, the supply management chain, and the goals or KPSs of the organization and its security objectives. The approach will provide a better understanding of cross-functional risks amongst control objectives that may have been impacted by technical or process-based vulnerabilities and will give attention to any higher risks. Cross-functional risks include technical risks and nontechnical risks such as software risk, system complexity and vulnerabilities, environmental risk, legal security, etc. As the approach captures different information from different stakeholders, security issues are shared across the organization and weighed appropriately in light of the management's level of criticality for each business and control function. * Builds upon existing frameworks/standards/guidelines: An integrated risk management approach builds upon existing frameworks by evaluating how the combination of neglected risk factors could yield minor to terrible outcomes. A state-of-the-art and well-known approach can smoothly lead an organization beyond simple compliance and reveal how to more effectively secure a particular information environment.