## 3 Results
### Study of Information Security Risk Management Processes Based on Standards Analysis
It focuses on establishing and maintaining a framework for governing an organization's information security activities and aligning them with overall business objectives. While it does not explicitly list specific information security risks, it provides guidance on how to manage information security within a governance context. There is a clear requirement in this standard that needs to be mentioned: Risk of Inadequate Resource Allocation; Risk of Lack of Buy-In by Senior Management; Risk of Human Errors Leading to Security Breaches; Risk of Inadequate Information Security Measures Associated with Proper Allocation of Budget and Personnel; Risk of Non-Compliance and Inadequate Security Practices; Legal Risk; Regulatory Requirements Risk. ISO/IEC 15408, commonly known as the Common Criteria (CC), is a standard that specifies a framework for evaluating the security properties of information technology products and systems. It provides a structured approach to evaluating the security features and capabilities of products and systems. While the CC does not explicitly list specific information security risks, it outlines the methodology and criteria for assessing and certifying the security of these products and systems. The methodology and criteria outlined in the standard contribute to effective risk management in the context of evaluating and certifying the security of information technology products and systems. IEC 62443 is a series of standards developed by the International Electrotechnical Commission that addresses the security of industrial automation and control systems, often referred to as industrial cybersecurity. These standards provide guidelines for establishing a systematic and comprehensive approach to managing the cybersecurity risks associated with industrial control systems (ICS). While IEC 62443 does not explicitly list specific information security risks, it defines processes and measures to mitigate risks in industrial environments. There is a clear requirement in this standard that needs to be mentioned: Risk of Including Access Control; Risk of Authentication; Risk of Encryption and Cryptographic Controls; Risk Associated with Third-Party Vendors; Risk Associated with Partners Involved in the Industrial Ecosystem; Risk Associated with External Connections. ETSI EN 303 645 specifically focuses on cybersecurity for IoT devices. There are common information security risks that are discussed in such a standard: Risk of Automated Attacks Against a Class or Type of Device; Licensing Risk; Risk of Authentication; Risk of Authorization; Risk of Insecure or Default Credentials; Risk of Unauthorized Access to IoT Devices; Lack of Secure Update Mechanisms; Risk of Connections to Insecure Network; Risk of Data Interception Through Communication Channels; Risk of Unauthorized Access to Sensitive Information Through Communication Channels; Risk of Encryption and Cryptographic Controls; Risk of Data Breaches; Risk of Vulnerable Interfaces; Risk of Vulnerable Interfaces APIs; Risk of Insufficient Physical Security; Lack of Privacy Controls; Risk of Insecure Software/Firmware; Risk of Weak Device Management; Denial of Service (DoS) Risk; Risk of Insecure Default Settings; Risk of Insecure Mobile Application Interfaces; Lack of Security Monitoring; Lack of Logging; Risk Appearing When Writing Code; Risk Associated with Third-Party Vendors; Device Integration Risk. NIST SP 800-30 is a guidance document from the National Institute of Standards and Technology (NIST) that provides guidance on risk assessment processes for information technology systems. It outlines various steps and considerations for conducting risk assessments. It does not provide a list of specific risks itself, but rather a framework for identifying and assessing risks.