## 1 Introduction
In particular, a cybersecurity threat is a potential attack that exploits a vulnerability of the system to cause damage, whilst a threat scenario is a flow of events or attacks containing interactions between a malicious actor and a system to cause damage. On the other hand, privacy risk assessment as indicated in [7] aims to \"analyze and quantify the privacy risks associated with new systems\". Accordingly, considerable research has been devoted to eliciting and analyzing cybersecurity and privacy risk assessment [6; 7; 8; 9; 10]. However, the applicability of these approaches in the context of cybersecurity and privacy risk assessment modeling for POC systems in healthcare ecosystems shows limitations with respect to (i) their support for explicitly specifying various types of cybersecurity threats, (ii) the definition of threat scenarios and (iii) the specification of mitigation and preventing actions (e.g., cyber hygiene) for these threats. Moreover, the above risks have to be properly communicated and accounted in the overall operational structure of organizations. For instance, in business, financial value may be acceptable as the ultimate unit, which is used to quantify direct cost--even reputation and human lives. However, certainly the healthcare sector does not only operate on a competitive or financial basis, and may prefer units that more closely relate to the concept of privacy risk. Therefore, to assess the cybersecurity requirements of POC systems, it is necessary to take into consideration the characteristics of the specific service being developed and of the device types on which the service is going to be deployed. Accordingly, use cases are one of the most common means adopted by software engineers and end-users to elicit requirements because they ease the communication between stakeholders to assess specific requirements [11]. Additionally, to achieve widespread applicability, the need for integrating cybersecurity and privacy requirements with use case modeling warrants the development of reusable templates in different applications, and in particular for healthcare applications. Systematic approaches to eliciting cybersecurityrequirements based on use cases, with emphasis on description and methods guidelines have been proposed [12]. However, existing approaches lack reusable templates for misuse cases, as opposed to only well behaving use cases [12; 13; 14; 15]. However, with slight modifications, use cases can aid the integration of misuse case scenarios, with functional and non-functional requirements, when considering cybersecurity and privacy risk [16]. In the direction to remediate the limitations described above, we propose a use case approach, including misuse cases, in the framework of a real-based healthcare IT infrastructure for POC cybersecurity and privacy risk assessment. In particular, the objectives of this work are to (i) detail a use case that sustains the specifications of cybersecurity and privacy requirements, (ii) address the above challenges by including the modelling based on risk management capability model (RMCM), and (iii) produce an approach tailored to accounting POC in healthcare ecosystems. In this regard, the paper is organized as follows. Section 2 introduces the context of our use case approach and proposed scenarios, compared to the state-of-the-art, to provide the motivations behind POC systems in healthcare. Sections 3 and 4 describe the technical developments, proposed pilot plan and risk assessment capability for POC use cases in healthcare environments, respectively. This is followed by Section 5, which discusses the results connected with the outcomes in several dimensions of cybersecurity and privacy risks. Finally, Section 6 summarizes the work, provides conclusions, and proposes future research.