As critical transportation infrastructure has been an appealing target for threat sources (e.g., terrorist) due the level of impact that can be obtained from its disruption, the application of an IoT based WSN in the sensing layer is increasing the risks of cyber-attacks [17]. Thus, the cyber-physical risk assessment of an IoT enabled transportation infrastructure against cyber-physical attacks in the sensing layer has become more crucial than ever. Although approaches to assess the risks of transportation infrastructure against natural hazards (e.g., earthquake) have been proposed in previous work [18], those aimed to assess risks against cyber-physical attacks are limited. For example, an increased need for security awareness, has been outlined for railway systems [19]. However relevant studies, such as the EU projects PROTECTRAIL [20], SECRET [21], CARONTE [22], CIPSEC [23; 24], target to inform stakeholders, about emerging security issues (e.g., access control, electromagnetic attacks etc. ), rather than assessing the risk brought by the exploitation of vulnerabilities of IoT devices. Other approaches in the transportation domain (see Section 2 for more details), integrate cyber security international standards, mainly derived from the National Institute of Standards and Technology (NIST), such as NIST SP800-30 [25]. By considering a qualitative likelihood-impact matrix, based on organizational deficiencies (e.g., lack of employees training), stakeholders can assess risks and apply control measures strictly related to business organization assets (e.g., disclosure of sensitive data) and operations overlooking the impact to physical space. Additionally, despite the recent advances of machine learning methods (e.g., signature-based method) in the critical infrastructure domain these are mainly implemented for network anomaly detection as a second line of defence rather than the proactive management of risk [26], which is the main focus of this paper. Other limitations of machine learning methods include the possibility of adversarial machine learning (i.e., an attacker performs reverse engineering to avoid detection) [27] and the complexity of converging both cyber and physical detection methods [28], due to coexistence of a physical infrastructure that is enabled through operation in cyberspace. The gradual transformation to an IoT enabled transportation infrastructure has created a knowledge gap, in cyber-physical risk assessment, leading to the consideration of cyber threats as separated from the physical ones [29]. This knowledge gap rises due to under-reporting, that has led to a lack of statistical data about cyber-attacks [30]. Additionally, new threat sources based on complex human profile characteristics (e.g., motives), and vulnerabilities have arisen from cyber space [31]. The absence of unified risk assessment methodologies for critical infrastructure domains makes it more difficult to identify how cyber-physical risks can be managed [32]. To bridge this gap, this paper contributes by providing a cyber-physical risk assessment approach for IoT enabled transportation infrastructure subjected to cyber-physical attacks at the sensing area that can be applied by stakeholders who act as assessors (i.e., operators, civil and security engineers). The approach aims to enable stakeholders to manage the cyber-physical risk in the sensing area in a proactive manner. In our approach, cyber-physical risk is computed as the product of three main aspects: (i) the vulnerabilities of IoT devices; (ii) the threat source who can exploit the vulnerabilities; and (iii) the physical impact resulting from the successful exploitation of the vulnerabilities. Vulnerabilities and threats are assessed based on combined cyber and physical characteristics, while physical impacts are assessed considering previous related work in the security and civil engineering domain. Quantitative scores are employed to assess the level and importance of the cyber-physical characteristics.