## 2 Materials and Methods  
The initial step in developing the flexible information security risk model involves an exhaustive study of existing information security standards related to risk assessment. This comprehensive process enables the compilation of an expert-generated list of information security risks. This initial list forms the basis for subsequent expansion and refinement. Conducting a study of information security risk management processes based on the analysis of ISO/IEC 27000, ISO/IEC 27001, ISO/IEC 27002, ISO/IEC 27003, ISO/IEC 27005, ISO/IEC 27014, ISO/IEC 15408, IEC 62443, ETSI EN 303 645, NIST 800-30, ISO/IEC TR 13335-3:1998, BS 7799 standards is necessary for establishing best practices [50]. These standards are recognized globally as best practices for information security (IS) and risk management. They provide guidelines, frameworks, and methodologies that organizations can follow to enhance their information security posture. Studying these standards helps organizations adopt industry-accepted practices. Many regulatory bodies and industry-specific organizations require adherence to these standards as a condition of doing business. Compliance with these standards may be mandatory for certain industries or organizations that handle sensitive information, such as healthcare, finance, or critical infrastructure. Conducting a study helps organizations ensure they meet these compliance requirements. Information security is critical for protecting an organization's assets, reputation, and customer trust. A study of these standards helps organizations identify and mitigate risks effectively, reducing the likelihood of security incidents, data breaches, and other cyber threats. These standards cover various aspects of information security, including risk management, security controls, incident response, and security governance. Studying them provides a comprehensive understanding of information security, allowing organizations to address security holistically rather than in isolation. Effective communication of security risks and controls within an organization is essential. These standards provide a common language and framework for discussing security risks, making it easier for stakeholders to understand and collaborate on security-related matters. To enhance the flexibility of the information security risk model, cluster analysis is employed using the k-means algorithm applied to the texts of information security standards. This data-driven approach aims to uncover hidden patterns and relationships within the standards that may not be immediately apparent through manual examination. The utilization of the k-means algorithm can allow for the grouping of similar textual elements, facilitating the identification of clusters representing potential information security risks [51]. The primary objective of this analysis is to broaden the existing list of information security risks by systematically categorizing and organizing related concepts. By doing so, the model can demonstrate its adaptability to evolving knowledge and insights in the field. This approach enables the inclusion of nuanced and emerging risks that might not have been explicitly addressed in traditional, expert-compiled lists. The k-means clustering method was chosen for its ability to handle large datasets and efficiently organize textual information into distinct groups. This facilitates a more nuanced understanding of the relationships between different elements within the information security standards. The expanded list of risks derived from this analysis can contribute to the model's flexibility, ensuring its relevance and applicability in dynamic and evolving information security landscapes. Despite the utilization of cluster analysis on a substantial corpus of standardized text, the methodology predominantly relies on data derived from existing information security standards. These standards may not comprehensively encapsulate all potential risks within a dynamically evolving threat landscape.