## 3 Results
### Construction of an Ontological Model for Assessing Information Security Risks
The External Risks group includes the following risks: Environmental Risk; Climate Risk. The Information Security Triad Risks group includes the following risks: Risk of Information Confidentiality; Risk of Information Integrity; Risk of Information Availability. The Human Risks group includes the following risks: Phishing Risk; Social Engineering Risk; Risk of Misuse; Risk of Fraud; Risk of Human Errors Leading to Security Breaches; Risk of Insider Threats of Data; Risk of Error; Risk Appearing When Writing Code. The Malware and Virus Risks group includes the following risks: Malware Risk; Viruses Risk. The Loss Risks group includes the following risks: Risk of Data Disruptions; Risk of Leakage; Risk of Physical Loss or Theft of Critical Assets, Hardware, Software, Data; Risk of Virtual Loss or Theft of Critical Assets, Hardware, Software, Data. The Resource Allocation Risks group includes the following risks: Risk of Inadequate Resource Allocation; Risk of Lack of Buy-In by Senior Management; Risk of Inadequate IS Measures Associated with Proper Allocation of Budget and Personnel. The Third-Party Risks group includes the following risks: Risk Associated with Third-Party Vendors; Risk Associated with Partners Involved in the Industrial Ecosystem; Risk Associated with External Connections; Establishing Security Requirements for Third-Party Suppliers; Risk Associated with Stakeholders; Stakeholder Concerns. The Server and Data Center Risks group includes the following risks: Risk of Damaged Servers and Data Centers; Risk of Unauthorized Physical Access to Servers and Data Centers; Risk of Theft of Servers and Data Centers; Denial of Service (DoS) Risk; System Risk. The Security Monitoring and Logging Risks group includes the following risks: Lack of Security Monitoring; Lack of Logging; Monitoring Security Events and Measuring Security Metrics; Testing Risk; Verification Risk; Likelihood Risk. To facilitate the practical application of the thesaurus and ontology model, a structured guide for organizations is delineated. To ensure the thesaurus remains up-to-date and reflective of current cybersecurity landscapes, organizations are advised to establish a systematic updating schedule. The frequency of updates--whether quarterly, semi-annually, or annually--should align with the organization's specific exposure to evolving risks and technological advancements. A designated individual or team should be tasked with the maintenance of the thesaurus. This responsibility includes the continuous monitoring of emerging risks, the periodic updating of terminologies, and the integration of user feedback. To streamline this process, it is recommended that organizations implement a structured feedback mechanism. This could take the form of regular user surveys or a dedicated digital feedback platform, facilitating ongoing improvements to the thesaurus. Updates to the thesaurus should be prompted by specific triggers such as the adoption of new technologies within the organization, which may introduce novel security risks. Furthermore, any security incident should prompt an immediate review of the thesaurus to determine if it encompasses the newly encountered risks. Similarly, modifications in information security laws and regulations should be closely monitored to ensure the thesaurus accurately reflects compliance-related risks, thus maintaining its relevance and utility in dynamic regulatory environments. To enhance the management of the thesaurus and ontology within organizations, it is advisable to employ specific tools and software designed to automate and simplify updates. Prominent examples include Protege and Apache Jena, which necessitate proficiency in ontology management. Therefore, the recruitment or development of personnel skilled in these areas is crucial. Protege is available at no cost, whereas tools such as PoolParty and OntoText GraphDB may incur subscription fees or licensing costs, necessitating budget considerations.