## 5 Discussion on Risk Assessment Capability  
There are numerous use case approaches in the literature to model cybersecurity and privacy requirements [27]: multilateral, unified modeling language (UML)-based, goal-oriented, problem frame-based, risk/threat analysis-based, and common criteria-based approaches. In particular, the use case approach proposed in this work is based on misuse cases extending UML diagrams and relies on a form of risk/threat analysis to capture various cybersecurity and privacy risks, to elicit threat scenarios in a structured form. Furthermore, it provides mitigation recommendations relaying on CUREX solution, or accordingly, directions given by other cybersecurity and information privacy risk assessment solutions. Therefore, the dimension of assessment capability attained in the proposed use case is large, where a list of contemplated requirements allowed to be assessed are shown in Table 6.  
The requirements listed in Table 6 are not particular to the CUREX solution but general to other cybersecurity and information privacy risk assessment solutions, contemplating both functional and non-functional requirements, and they can be enlarged following best-practice guidelines, privacy-by-design methodologies and IT standards [28]. Furthermore, the described requirements in Table 6 encompass some mandatory as well as optional requirements, regarding cybersecurity and privacy risks. Mandatory level is considered when the requirement is a must, without which the described functionality cannot be provided. However, optional level is assigned when the requirement is only recommended to have an appropriate performance of the tool/service. The assigned level of mandatory requirements has been qualitatively weighted and agreed between different stakeholders (software developers, healthcare providers, and researchers) within the CUREX consortium. Where the qualitative weighting has been assigned by mapping the requirements' urgency by the end-users to the performance goals elicited by the technical development of the specific CUREX tools. Moreover, the requirements' considerations detailed in our use case, in some part, are highly valid since they are also considered in other information risk analysis works as [4; 29; 30; 31; 32]. Hence, the methodology followed can be applied to other use cases and risk assessment solutions [33; 34]. \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Cybersecurity and Privacy Requirements** & **Priority/Domain** & **Description** \\ \hline Securing integrity information regarding risk assessment and interactions with the infrastructure & Mandatory/Cybersecurity & The complete monitoring and assessment flow must be reflected in the private blockchain contents providing support for the fact that end components can connect and disconnect without prior notice. & The complete blockchain must be reflected in the private blockchain contents providing support for the fact that end components can connect and disconnect without prior notice. & The complete blockchain must be passed between steps, from the medical staff, which informs them on the system, to the SAVAC system. Each step must get and pass the credentials through the next step. The CUREX system should monitor, as an important part of its risk assessment phase whether these holds. & The patient must provide a valid identification number to the medical staff in order to search for his/her history. The system needs a way to correlate the patient history number with a European unique patient history number. & The patient must provide a valid identification number to the medical staff in order to search for his/her history. The system needs a way to correlate the patient history number with a European unique patient history number. & The patient must travel safely between database and front-end HIS application. Communication network must ensure no data sniffing or data loss, and no third party can change the data between the database and the front-end. Patient data is involved.