## 5 Discussion
### Risk Assessment Standards for Cyber Resilience
\begin{table}
\begin{tabular}{l l} \hline \hline
**Category** & **Methods** \\ \hline Quantitative Methods & \(\bullet\) & Probability-impact matrix [22]—Uses probability and impact to assess risks within STRIDE categories. \\  & \(\bullet\) & Risk quantification (TV) [116]—Calculates risk based on threat, vulnerability, and impact factors. \\  & \(\bullet\) & CVSS [117]—Common vulnerability scoring system; for measuring vulnerability severity. \\  & \(\bullet\) & DREAD [9]—Evaluates threats based on multiple factors. \\  & \(\bullet\) & Vulnerability-Impact-Likelihood [108]—Quantifiles risk using vulnerability, impact, and likelihood. \\  & \(\bullet\) & Security Score Model [114]—Quantifiles security based on scoring criteria. \\  & \(\bullet\) & CCE scoring method [116]—Used for assessing impact in risk management. \\  & \(\bullet\) & Tail Threshold Detection [20]—Identififies risk event thresholds. \\ \hline Qualitative Methods & \(\bullet\) & OCTAVE [130]—OCTAVE is a self-directed approach, meaning that people from an organization assume responsibility for setting the organization’s security strategy. OCTAVE-S is a variation of the approach tailored to the limited means and unique constraints typically found in small organizations (less than 100 people). This method is usually implemented with qualitative evaluations. \\  & \(\bullet\) & Holistic Risk Assessements [121]—Consider interconnection between risks and emphasize studying cybersecurity risks and the cascading effects. \\  & \(\bullet\) & Event Tree Analysis [39]—Analyzes potential outcomes from initial events. \\  & \(\bullet\) & Direct Testing Method [130]—Uses audits, exercises, and testing. \\  & \(\bullet\) & Raising Awareness [132]—Focus on cybersecurity awareness among end users. \\ \hline Hybrid Methods & \(\bullet\) & SecRAM by SESAR SWP16.2 [22]—Combines probability-impact assessment with CIA triad. \\  & \(\bullet\) & PASTA [9]—Blends qualitative threat modeling with business objectives. \\  & \(\bullet\) & TARA [101]—Uses STRIDE and DREAD to analyze threats. \\  & \(\bullet\) & Cybersecurity Capability Maturity Model (C2 MZ) [117]—Asseses cybersecurity capabilities. \\  & \(\bullet\) & Five-Phase Resilience Assessment Framework [115]—Quantifiles resilience in phases. \\  & \(\bullet\) & Threat, Vulnerability, and Risk Analysis (TVRA) [117]—Combines threat, vulnerability, and risk. \\  & \(\bullet\) & RAMA [110]—Uses probability, impact, historical data, and context for risk analysis. \\  & \(\bullet\) & ICS Cyber Killchain [117]—Asseses risk impact through kill chain analysis. \\  & \(\bullet\) & Logical Attack Graph (LAG) [131]—Visualizes potential attack paths. \\ \hline Specialized Models & \(\bullet\) & STRIDE Threat Model [101]—Models threats across various categories. \\  & \(\bullet\) & FAIR [130]—Analyzes information risk factors. \\  & \(\bullet\) & Endsley’s Situational Awareness Model [109]—Conceptual model for situational awareness. \\  & \(\bullet\) & Extreme Value Theory (EVT) [20]—Models extreme events in cybersecurity. \\  & \(\bullet\) & Stochastic Hybrid Model [20]—Blends stochastic methods with traditional risk models. \\  & \(\bullet\) & Mission Impact Propagation Graph (MIPG) [131]—Asseses cyber-attack propagation. \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Categorized risk assessment/management methods for resilience enhancement. ISO 27005 provides more detail on information security risk management that supports the ISMS [109; 120; 122; 130; 133]. On the other hand, some other standards tighten their focus on risk assessment approaches that can be used in a wide range of domains. In this regard, ISO 31010 is one of the most well-known standards, which guides the selection and implementation of risk assessment techniques [22] that align with the risk management approach outlined in ISO 31000 [117; 132]. In addition, NIST SP 800-30 is a prominent risk assessment guideline adopted by several studies for conducting cyber risk assessment for cyber resilience [22; 68; 108; 118; 123].