## 6 Conclusions  
In this study, an SLR on risk assessment for cyber resilience was conducted to investigate related methods, standards, and regulations. The review started with 173 papers, and after the screening process following the PRISMA statement 40 papers were included for a thorough review to extract resilient risk assessment methods, standards, and regulations. The key results of this review are as follows:  
* The concept of cyber resilience is relatively young in the context of safeguarding critical systems, and its integration with risk assessment is at its starting stages. This is reflected by the fact that more than half of the papers on this topic have been published only in the past two years. * Studies that address risk assessment for cyber resilience, focus only on a small number of CI sectors, namely, transportation, energy, healthcare, IT, and emergency services. * The intersection of risk assessment methods and cyber resilience is continuous monitoring. In order to establish and maintain cyber resilience, cyber risks have to be constantly monitored to identify new threats and vulnerabilities and mitigate the corresponding risks. * Risk assessment methods for cyber resilience can differ based on how they define risk and which sectors they are designed to cover. * Cyber resilience in risk assessment standards is often addressed through risk management procedures to realize pre- and post-disturbance protection. * Although there are some well-designed regulations that cover risk assessment for cyber resilience, such as NIS 2 and CRA, CI sectors are still not motivated enough to implement them. The SLR in this paper resulted in a comprehensive list of methodologies, frameworks, standards, guidelines, regulations, and legislation in different domains that can support risk assessment from a resilience perspective. They collectively represent the current status of research and practices and can offer researchers a broad perspective on the related knowledge area. Moreover, these lists can provide valuable information for cybersecurity managers, decision-makers, policymakers, and practitioners as a guide to selecting the methods and frameworks and complying with the standards and regulations that are most suitable according to the specific organizational and business features and the sectors in which they operate. Insights derived from the current article support more effective decision making in IT-empowered and cyber-sensitive CI governance. By focusing on key regulatory requirements and best practices, decision-makers can allocate resources more effectively, improving overall organizational resilience. From a strategic point of view, the study highlights the need for standardized cyber resilience practices and increased collaboration among stakeholders. Consequently, the study's findings can help align cyber resilience strategies with both organizational goals and regulatory frameworks, enabling managers to adopt a cohesive approach to managing cyber risks and ultimately enhancing the security and resilience of CI systems. The categorization of risk assessment methodologies in Section 5.1 brings out the wide range of existing methodologies to enhance resilience. These include quantitative methods, which are especially useful for data-driven organizations; qualitative approaches, which are more suited for smaller companies with limited resources; and hybrid and specialized techniques for complex, critical systems. The method selection depends on an organization's resources, the complexity of its risk environment, and the level of technical expertise available. Moreover, the classification in Section 5.2 reveals the different fields to which standards related to risk assessment apply. This helps organizations to find appropriate standards that match their needs for improving resilience. Knowing the relevant focus areas, organizations can implement targeted strategies toward building resilience against cyber threats at various layers of their operational and technical infrastructure.