## 2 General Background Review
### Literature Limitations and Research Gaps  
Almost all conventional risk management frameworks and standards suggest the use of a PIM for risk assessment [77] because of its simplicity and effectiveness in a long-shot perspective of a complex system, and in qualitatively prioritizing risks [78]. However, it has notable drawbacks, as follows:  
1. Subjectivity and bias: The PIM relies on expert judgment to estimate the probability and impact of risks [79]. Different stakeholders may have varying perceptions, leading to inconsistencies and biases in the scoring. This reliance on subjective opinions can undermine the matrix's effectiveness [79; 80].
2. Limited criteria consideration: Typically, there is a need for requirement analysis to select the right criteria in multi-criteria problems [81; 82; 83]. PIM considers only two factors: probability and impact. Real-world risks are often more complex and influenced by additional criteria such as time sensitivity, interdependencies, and resource availability [84; 85]. This oversimplification can lead to inaccurate prioritization.
3. Lack of precision: Although accuracy is a hot topic in uncertainty analysis [86; 87; 88; 89], PIM usually categorizes risks into broad, qualitative ranges (e.g., low, medium, high) rather than using precise quantitative values [90]. This lack of granularity can cause ambiguity, especially when risks fall near the boundaries of these categories, hindering effective decision making. On the other hand, the way that PIM is used raises some challenges and faces some limitations, as follows:  
1. Limitation in inability to handle interdependencies: Risks are often interconnected, with one risk potentially triggering or amplifying another. On the other hand, the emerging systems and infrastructures are also interconnected. The PIM does not adequately account for these interdependencies, leading to an incomplete understanding of the overall risk landscape [91].
2. Static nature challenge: PIM is typically used as a one-time assessment tool. However, risks evolve over time [92; 93], and their probability and impact can change. The static nature of PIM limits its ability to dynamically adjust to these changes. Updating the PIM periodically introduces several challenges. First, frequent updates require additional resources, including time, personnel, and funding, which can strain organizational capacity. Second, collecting accurate and up-to-date data to reassess risks can be complex, particularly if external conditions or internal structures change rapidly. Additionally, periodic updates may lead to inconsistencies in results if the assessment criteria or methodologies are not standardized over time. Finally, scheduling regular updates while maintaining accuracy and relevance adds logistical complexity, requiring careful planning to avoid disruptions to regular operations. Additionally, the wide range of risk assessment methods, standards, and regulations related to cyber resilience creates confusion due to overlapping frameworks, making it challenging for organizations to select appropriate security requirements that meet their needs and compliance obligations. Nevertheless, there is a significant gap in the literature to systematically examine the empirical use of risk assessment methods, standards, guidelines, and globally known legislation to enhance cyber resilience. This paper addresses the lack of a comprehensive review in this area by conducting an SLR on approaches that integrate cyber resilience engineering with risk assessment.