## 2 Background and Related Works
### Cyber Risk Management  
Risk management is a critical process that seeks to identify, evaluate, and control risks that threaten an organization's business objectives. In the realm of cybersecurity, risk management focuses on risks affecting digital information, including the availability, confidentiality, and integrity of systems. Numerous frameworks for cyber risk management have been developed in the literature and industry. Comprehensive reviews, analogies, and comparisons of these established frameworks can be found in [15, 16, 17]. Various frameworks, guidelines, and tools have been created in the cybersecurity industry to manage cyber risks effectively. Notable examples include ISO 27005 [18], a standard framework published by the International Organization for Standardization and the International Electrotechnical Commission. The US government has designed NIST Special Publication 800-30 [19] as a detailed risk management process for governmental organizations. OCTAVE [20] offers a flexible risk-based strategic assessment and mitigation planning framework, while EBIOS [21] is a workshop-based framework developed by the French National Agency for Cybersecurity (ANSSI) based on the ISO 27005 guidelines. MONARC [22] is a method that assists organizations in identifying and evaluating potential information security risks and implementing appropriate risk management measures, emphasizing a structured approach to risk assessment, asset identification, threat analysis, and vulnerability assessment. BSI200-2 [23] is a risk management standard developed by the German Federal Office for Information Security, offering a systematic approach to identifying, assessing, and managing information security risks. The European Union has introduced ITSRM [24], a risk management method for evaluating and certifying information technology products and systems. ISACA, a global professional association for information technology governance, has developed ITRAM2 [25] to help organizations identify, evaluate, and manage technology-related risks, focusing on integrating risk management processes. In addition to industry-established frameworks, the cybersecurity research literature has proposed novel frameworks, processes, and tools for effectively managing cyber risks in emerging technologies. Examples include ADAMANT [26], an information security management system compliant with ISO standards; LISRA [27], a risk assessment framework simplifying the construction of attack scenarios in specific domains; and CSCCRA [28], a risk assessment methodology designed for evaluating risks in dynamic cloud environments with multiple service providers. Some research contributions, like [29], have even suggested integrating the safety of cyber-physical devices into existing risk management frameworks based on ISO standards. Others, such as [30], have proposed layered cyber risk management frameworks tailored to the unique challenges of the Internet of Things. Moreover, innovative approaches like the blockchain-based risk and information system control framework introduced in [31, 32] leverage decentralized blockchain technology to ensure risk management security. EBIOS Risk Manager is among the more recent industry-based risk management frameworks that account for threat actors by addressing them as risk origins (ROs). EBIOS has evolved through multiple iterations, culminating in the EBIOS Risk Manager. This workshop-based approach strongly emphasizes collaboration among stakeholders within the same organization. It establishes security baselines and objectives, starting with risk sources and considering the ecosystem and adversaries. EBIOS Risk Manager employs a top-down approach and prioritizes efficiency over exhaustiveness. The EBIOS Risk Manager process consists of five workshops involving individuals from the assessed organization performing risk assessment and management. These workshops are [21]:  
* [rightmargin=*]  
be defined, contributing to improved risk management.