# An Integrated Cyber Security Risk Management Approach for a Cyber-Physical System
## 2 Related Work
### Frameworks/Standards/Guidelines  
There are widely accepted risk management standards such as ISO 31000 that provide guidelines for risk management activities which also consider risk management as an integral part of the overall organizational processes, including strategic planning and management processes [24]. IEC 31010 is also another recognized risk management method and technique [25]. The NIST framework focuses on managing cyber-security risk and NERC CIP standards for the identification and protection of critical cyber assets that support the reliable operation of the electric power grid. The NIST framework [26] is a risk-based approach for managing cyber-security risk. It is applied to deliver a complete platform that identifies relevant paths, providing guidance that ranges from requirements to implementation. Critical infrastructure organization can use the NIST framework alongside their existing frameworks to systematically identify, manage, and assess cybersecurity risk. It can serve as the basis for a new cybersecurity program or a mechanism for improving its existing programs. The outcome of the framework will serve as the basis for the on-going operation of the system, which includes reassessment to verify that the cybersecurity requirements are fulfilled [27]. A particular goal driven risk management approach [28; 29] emphasizes the identification of goals as objectives specific to the organization mission. Risks are considered as an obstruction to the goal so that identified risks are assessed based on which goals they oppose. The approach is applied in various domains such as software development project and cloud computing.  
Several observations were made from reviewing the existing works.  
* [PERSON] et al. [9] reviewed existing cyber security risk assessment works and concluded that it is necessary to have a comprehensive risk management method which will cover all stages of the risk management process.
* Different risk management approaches for smart grid were also discussed in a previous work [21]. However, risk management from a holistic perspective that incorporates all aspects of a smart grid and their interdependencies is needed.
* Most of the risk management approaches emphasize assessing vulnerabilities and identifying threats but lack emphasis on the cascading effect of vulnerabilities and threats to the asset.
* The existing works provide limited efforts in considering the estimation of an accurate risk level for the organization.  
Our work intends to fill these gaps by proposing an integrated cyber-security risk management approach. The novelty of this work is a comprehensive cyber-security risk management framework that considers all phases of the risk management process. We follow the existing risk management standard and framework with a holistic view of the risks and propose our approach. In particular, the proposed work is initiated by understanding of the business context and current risk management status of the organization. The approach considers cascading vulnerabilities and threats to generate a cyber-attack scenario and the impact of the risks are considered from the CPS organization's key performance indicators (KPIs) to generate the accurate risk levels.