## 5 Discussion
### Risk Assessment Governance for Cyber Resilience  
One of the most important regulations regarding cybersecurity is the NIS 2 directive [104; 109; 117; 128; 133]. It is a European Union (EU)-wide legislative act to 'achieve a high common level of cyber security' [145]. NIS 2 will set the baseline for cybersecurity risk management and reporting obligations across a wide range of sectors, including energy, transportation, health, and digital infrastructure [146]. As a compliment to NIS 2 and the EU Cyber Security Act (CSA) [121], the Cyber Resilience Act (CRA) was published to provide essential cybersecurity requirements for all hardware and software products with digital elements [123]. Another very important regulation addressed by studies on cyber resilient risk assessment is the EU General Data Protection Regulation (GDPR), which aims at raising the level of privacy for individuals [109; 117; 132]. The application of GPDR's requirements is significantly wide and transactional; this means that any sort of process performed on personal data needs to be compliant with it [147].  
Similar to standards and guidelines, regulations may also be domain-specific. Particularly, in the maritime sector, the Maritime Safety Management System (SMS) Requirements aim to integrate cyber risk management with maritime SMS [107]. Also, the Certification and Watchkeeping for Seafarers (STCW) is an international convention of general requirements for seafarers, which also includes cybersecurity [107]. In energy, the US Department of Energy Cybersecurity Frameworks provides guidelines for ensuring cybersecurity in the energy sector [131]. In the aviation sector, the International Civil Aviation Organization (ICAO) Aviation Cybersecurity Strategy is designed to manage cybersecurity risks in international civil aviation [105]. In addition, the European Union Aviation Safety Agency (EASA) concept paper outlines the approach to aviation safety and also includes cybersecurity. Moreover, the UN Regulation No. 155 on Cybersecurity focuses on cybersecurity management systems for vehicles in general. The Health Insurance Portability and Accountability Act (HIPPA) governs healthcare data security and privacy in the US healthcare sector [109]. Finally, the EU AI Act is a regulation proposed by the EU to govern AI and its security issues [112].  
The review of risk assessment regulations related to cyber resilience shows that although there have been many binding laws and acts to regulate cyber resilience issues, they are not comprehensive enough to manage risks at the organizational level [148]. On  
\begin{table}
\begin{tabular}{l l l} \hline \hline
**Scope of Application** & **Name** & **Description** \\ \hline \multirow{6}{*}{Human-Centric Focus} & ENISA Cybersecurity Skills & A report by the EU Agency for Cybersecurity aimed at developing \\  & Report & essential cybersecurity skills in the EU [110]. \\ \cline{2-3}  & IMO MSC.428 & Integrates cyber risk management into maritime operations, focusing on \\  & the roles and responsibilities of personnel onboard vessels [106]. \\ \cline{2-3}  & Safety4 Sea STCW & Provides guidelines for officers with a focus on cybersecurity, \\  & Convention Guidelines & emphasizing training and skills needed for cyber resilience in maritime \\  & environments [106]. \\ \hline \hline \end{tabular}
\end{table}
Table 10: _Cont._the other hand, cybersecurity regulations are not adequately incentivizing for CI sectors to implement [149].