## 5 Discussion
### Risk Assessment Standards for Cyber Resilience
Some other standards and guidelines used in the literature are domain-specific, i.e., they are designed to address the cybersecurity of a specific CI sector. ISO 21434 is a standard for automotive cybersecurity, focusing on the cybersecurity of road vehicles [102]. ISO/SAE 21434 is another standard in this domain, providing guidelines for cybersecurity engineering in road vehicles [39]. In the energy sector, standards and guidelines used by previous studies are IEEE 1547.3 [116], NISTIR [115], IEC 61850 [134], and NERC-CIP [117; 119]. Additionally, for maritime transportation, there are IMO MSC.428 (Maritime Cyber Risk Management), IACS E26 and E27, the BIMCO Cyber Security Guidelines, and the Safety4 Sea STCW Convention Guidelines [106]. In the emergency sector, the Sendai Framework for Disaster Risk Reduction 2015-2030 and the UN Guidelines on Man-Made and Technological Hazards [121] are mentioned. Moreover, NIST AI RMF is designed for AI-related cyber risks [111] and DO326A/ED-202A provides guidelines for cybersecurity in aviation [22]. Finally, the Cyber Resilience Framework (CRF) and the CERT Resilience Management Model (CERTRMM) provide guidelines for ensuring resilience [9]. Table 10 categorizes various standards, guidelines, and frameworks based on their scope of application, enhancing the understanding of each approach's intended focus. \begin{table}
\begin{tabular}{p{56.9 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Scope of Application** & **Name** & **Description** \\ \hline \multirow{8}{*}{System Level} & ISO 21434 & Targets automotive cybersecurity, providing guidelines for protecting vehicle systems from cyber threats [102]. \\ \cline{2-3}  & IEEE 1547.3 & Guides the cybersecurity of distributed energy resources within electric power systems [116]. \\ \cline{2-3}  & IEC 61850 & Focuses on communication networks and systems in substations, crucial for electric power system resilience [134]. \\ \cline{2-3}  & DO326A/ED-202A & Provides guidelines for cybersecurity in aviation, protecting aircraft systems from cyber incidents [22]. \\ \cline{2-3}  & NISTIR: Guidelines for Smart Grid Cybersecurity & Addresses cybersecurity issues within smart grid environments [115]. \\ \hline \multirow{8}{*}{Organizational Level} & ISO/IEC 27001 & An information security management standard covering a broad range of organizational security aspects [120; 133]. \\ \cline{2-3}  & COBIT & Framework for IT governance and management that aligns IT processes with business goals [112]. \\ \cline{2-3}  & NIST Cybersecurity Framework (CSF) & Offers guidelines for CI resilience by establishing security protocols for organizational use [133]. \\ \cline{2-3}  & ISO 31000 & General risk management guidelines applicable across organizations for identifying and mitigating risks [117]. \\ \cline{2-3}  & MITRE Framework & Supports threat analysis and mitigation, helping organizations to manage and understand their threat landscapes [129]. \\ \cline{2-3}  & & \\ \hline \hline \end{tabular}
\end{table} 
Table 10: Categorization of risk assessment standards, guidelines, and frameworks based on scope of application. System-level standards, such as ISO 21434 and IEEE 1547.3, focus on securing specific technical systems or sectors, addressing risks directly associated with their operations. These standards play a critical role in safeguarding vital systems in domains like automotive and power systems. Organizational-level standards, including ISO/IEC 27001 and the NIST Cybersecurity Framework, offer a more comprehensive approach by establishing policies, processes, and frameworks for cyber resilience across organizations. These guidelines aid in ensuring that the entire organization, not just isolated systems, adopts a robust cyber resilience posture. Finally, human-centric standards, such as ENISA's Cybersecurity Skills Report and IMO MSC.428, emphasize the significance of human elements in cyber resilience. They target skill development, awareness, and role-specific training to strengthen resilience through an informed and prepared workforce.