## 4 Results
### General Synthesis of Results  
Before presenting the results of the SLR, a general synthesis of the reviewed papers is provided in this subsection to provide a 'bird's-eye view' of the investigated knowledge area. As shown in Figure 1, 40 papers were included in the review, which together constitute \begin{table}
\begin{tabular}{p{142.3 pt} p{284.5 pt}} \hline \hline
**Criteria Type** & **Criterion** \\ \hline Exclusion Criteria & 1. Records that are not written in English. 2. Records that are published as technical opinions, editorials, testimonials, organizational reports, book series, or book chapters. 3. Studies that do not discuss cyber risk assessment or cyber resilience. \\ \hline Inclusion Criteria & 1. Studies that propose, perform, or validate the cyber risk assessment methods with a cyber resilience perspective 2. Studies that discuss standards, guidelines, or regulations related to risk assessment for cyber resilience. \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Exclusion and inclusion criteria for record screening. \begin{table}
\begin{tabular}{p{42.7 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Query ID** & **Search in** & **Query String** & **QTY** \\ \hline Qs[\#doc.] & Scopus & TITLE-ABS-KEY (“cyber resilient\"\" AND ”risk assessment”) & 95 \\ \hline Qw[\#doc.] & WoS & TS = (“cyber resilient\"\" AND ”Risk assessment”) & 32 \\ \hline Qi[\#doc.] & IEEE & “cyber resilient\"\" AND ”risk assessment” & 46 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Search queries and results. QTY: Number of document results. Asterisk (*) at the end of a word indicates that all variants of the word are also included. the knowledge area of 'risk assessment for cyber resilience'. These papers are analyzed according to their publication year, source type, sectors addressed, and keyword analysis. Figure 2 illustrates the annual number of publications, divided by their source type. The first publication was a conference paper [22], published in 2016, followed by only one conference paper in the entire 2017. The first journal paper was published the next year, in the IEEE Systems Journal [99]. Moreover, the cumulative percentage curve indicates that more than half of all documents considered in the review were published in 2023 and 2024. This suggests the potential for significant growth in the next few years. Moreover, half of the publications are journal articles while the other half are conference papers. While reviewing the papers, we realized that some of them specifically address a certain CI sector. Therefore, in Table 5 we grouped the papers by the CI sector they focus on. The categories are extracted from the 16 CI sectors introduced by the Cybersecurity and Infrastructure Security Agency (CISA) of the United States [100]. As shown in the table, nine papers focused on the transportation system CI sector. More specifically, papers in this sector focused on the automotive [68; 101; 102], aviation [22; 103; 104; 105], and maritime [106; 107] domains. In the energy sector, eight papers were found, all of which addressed the smart grid domain. In the healthcare and public health sector, papers focused on Medical CPS [108], healthcare information systems [109], and healthcare cyber systems [110]. Finally, papers in the IT sector investigated artificial intelligence (AI) [111; 112] and cloud services [113]. The keyword analysis results in Figure 3 show the most frequently occurring keywords across the articles reviewed. Specifically, Figure 3 highlights a strong emphasis on