###### Abstract  
This paper presents a significant advancement in information security risk assessment by introducing a flexible and comprehensive model. The research integrates established standards, expert knowledge, machine learning, and ontological modeling to create a multifaceted approach for understanding and managing information security risks. The combination of standards and expert insights forms a robust foundation, ensuring a holistic grasp of the intricate risk landscape. The use of cluster analysis, specifically applying k-means on information security standards, expands the data-driven approach, uncovering patterns not discernible through traditional methods. The integration of machine learning algorithms in the creation of information security risk dendrogram demonstrates effective computational techniques for enhanced risk discovery. The introduction of a heat map as a visualization tool adds innovation, facilitating an intuitive understanding of risk interconnections and prioritization for decision makers. Additionally, a thesaurus optimizes risk descriptions, ensuring comprehensiveness and relevance despite evolving terminologies in the dynamic field of information security. The development of an ontological model for structured risk classification is a significant stride forward, offering an effective means of categorizing information security risks based on ontological relationships. These collective innovations enhance understanding and management of information security risks, paving the way for more effective approaches in the ever-evolving technological landscape. information security risk; assessment model; information security standards; k-means; dendrogram; heat map; thesaurus; ontological model +
Footnote †: journal: Medical Intelligence  
0000-0001-9000-0001-9000][PERSON]  
0000-0001-9000-9000-9000-9000-9000-9000-9000-9000-9000-9000-9000-9000-9000-9000-9000-9000-9000-9000-90  
critical challenge when it comes to existing IT security standards, as they may not be dynamically flexible enough to accommodate new technologies [5]. The current standards not only fall short in addressing the intricate nature of advanced technology but their implementation also comes with significant costs and reduced effectiveness in managing IT risks [6]. With the expansion of digitalization, organizations are confronted with an escalating number of information technology threats. This situation has been further aggravated in the post-COVID-19 landscape [7; 8; 9]. The evident shortcomings of current IT risk management frameworks are becoming more apparent. There are several noteworthy drawbacks associated with this approach. These include the use of outdated methodologies, complex implementation processes, an excessive emphasis on compliance, and the need for hybrid approaches to address gaps between controls and compliance requirements [10; 11]. Given the circumstances, it is essential to conduct a comprehensive evaluation of the efficacy of existing IT risk management frameworks. Despite extensive research on IT risk management, there remains a notable gap in the literature. Many studies have concentrated on specific contexts, leaving a lack of comprehensive analysis regarding the effectiveness of current IT risk management frameworks [12; 13; 14]. The absence of a systematic analysis presents an intriguing research challenge, which this paper aims to address. The contributions of paper are as follows:  
* The research successfully integrates machine learning methods, ontological modeling, and expert knowledge with established standards, creating a multifaceted approach to understanding and managing information security risks. This holistic approach allows for a more robust foundation to address the complex and evolving risk landscape. * The application of k-means clustering to analyze information security standards and the use of a heat map for visualizing risk interconnections are notable advancements.