## 4 Discussions
### Comparative Analysis of E3R Model  
This section seeks to compare and contrast the E3R model against traditional risk and resilience paradigms. A summary of the frameworks investigated is shown in Table 1.  
The 'Social Dimension' criteria refers to whether the study specifically addressed any social factors in their development of risk metrics. These had to consider the actions and behaviors of people as individual agents within the larger system. The 'Emergence' criteria refers to whether the risk model had any flexibility or consideration for emergent phenomena or events that could occur outside the typical risk boundaries of the models presented. The 'Resilience' criteria addresses whether the model specifically attempted to develop outcomes, decisions or recommendations for mitigation based on the risk statements developed, providing actionable data for cyber security practitioners to apply. The 'Dynamic Adaptive Systems' criteria refers to whether the model was intentionally built to work flexibly with fluctuating systems with changing input parameters that are representative of modern complex systems. The 'Feedback Loops' criteria specifies whether the model had any mechanisms for outputs of information to form inputs back into the modeling process. Finally, the 'Asset Mission Value' criteria refers to whether the model linked the criticality of cyber assets with their organizational priority, either directly or indirectly as part of a mission assurance framework. One of the standards for risk management in this space comes from ISO 31000:2018, particularly the risk management process defined within clause 6 [93; 94]. In this process, the context is established, the risk is assessed, and the risk is treated, whilst concurrently a communication and consultation and a monitoring and review process occur [94]. This thematically builds the baseline from which many future cyber risk models are derived from. Vulnerabilities was one major theme of focus in the literature of risk modeling. One model discussed in the literature utilized a Bayesian approach to identify the effect that vulnerabilities and mitigations had on overall architecture risk [95]. Another model using Fuzzy Inference focused on the four risk factors, those being vulnerability, threat, likelihood, and impact, to determine risk to a system [96]. A time-to-compromise model for cyber risk reduction was described in the context of Supervisory Control and Data Acquisition (SCADA) environments, where potential attacker paths are mapped through a target system [97]. A cloud provider cyber risk model (CSCCRA) is also described in the literature as a framework to determine risk value via supplier security assessments, supply chain mapping, cyber risk listing, and quantitative risk analysis [101]. The CRAM framework takes an insurance approach to this risk equation, focusing on the impact of loss and the premium of coverage based on attack severity, security investment, and probability of attack [99]. This is the opposite of applying a mitigation or resilience-based approach from a mission assurance context, as risk trade-offs are favored over mission outcomes. Two studies identified specifically considered how cyber assets affected mission value within their risk models. A three phase assessment methodology was presented for distributed information systems, which includes a threat assessment, asset valuation and vulnerability assessment, in which the asset valuation specifically delineated the functional value of cyber infrastructures based on purpose within the organization [98]. Within the maritime cyber environment, the Maritime Cyber-Risk Assessment (MaCRA) model for risk assessment characterizes cyber risks and then identifies systems that would benefit most from additional security protection and inform human decision support [100]. One of MaCRA's strengths was its ability to map the effects of a cyber-attack through the system and subsequent maritime technology connected to it, creating valuable system-of-system risk insight [100].