## 1 Introduction  
The modern world has become increasingly interconnected thanks to recent disruptive advancements in information and communication technology (ICT). The complexity of systems in the digitalized era and the cyber-physical nature of emerging technologies have raised new issues regarding their safe and secure operation [1]. These issues become even more serious in the case of CIs, in which cyber incidents may have severe and vital consequences [2, 3]. CIs are complex systems that provide a vital service to society, consisting of essential systems such as energy, transportation, and healthcare [4, 5]. The complex and hyper-connected nature of these systems have made cyber resilience an ever-growing concern in CIs [6] and a crucial challenge to address [7]; it revolves around maintaining operational reliability to protect digitally interconnected systems from the negative impacts of cyber incidents [8]. Cyber resilience is defined in different ways depending on the application domain. Several meanings may be inferred from the term 'cyber resilience', ranging from just a by-product of security practices to a set of distinct processes that lead to the adaptive capacity of the system [8]. According to [PERSON] et al. [9], cyber resilience is the system's ability to 'roll back' and resume normal operation once an incident disrupts it. From another perspective, cyber resilience may be inferred as dealing with 'unknown unknowns', i.e., it involves readiness for 'unpredictable, unforeseeable, and unexpected' cyber threats [10]. For the purpose of this study, cyber resilience refers to the ability of a system to prepare for, absorb, recover from, and adapt to adverse effects, particularly those arising from cyber-attacks [11]. It involves implementing reactive techniques such as alternative operations and dynamic feature composition to build resilient systems [12]. The primary objective of cyber resilience is to ensure business continuity by maintaining service delivery during adverse cyber events [13]. Consequently, analyses should focus on the business continuity, the minimum required vital services, and post-disturbance behavior of the system as a priority, rather than on IT systems or financial costs [14; 15; 16; 17; 18]. The resilience field traditionally emerged as a complementary component of risk assessment but gradually proliferated to the extent that resilience analysis is now an integral part of the risk field [19]. Cyber risk analysis on the other hand also plays a key role in fostering the resilience of a society [20]. Risk assessment is therefore a core part of both cybersecurity and resilience [21] as it enables embedding security controls, which is the main step towards the realization of secure-by-design and consequently ensures cyber resilience [22]. While risk assessment is essential to study uncertain threatening disruptions and to focus on the hazardous event, resilience ensures these systems can withstand and recover from disruptions, safeguarding the system's stability and focusing on the system's capability to face the disruptive events. Nevertheless, conventional risk assessment methods such as those outlined in ISO 31000 [23], COSMO (Committee of Sponsoring Organizations) Enterprise Risk Management (ERM) [24; 25], PMBOK (Project Management Body of Knowledge) [26], and other risk management standards and frameworks based on a probability-impact matrix (PIM) often fail to address the complexities and dynamic nature of modern digital and cyber-physical systems (CPSs) [27; 28; 29; 30]. Specifically, a PIM evaluates risks based on their likelihood and potential impact, providing a snapshot of risk severity [23; 31]. Yet, this method does not account for the nuanced interactions between different risk factors, nor does it consider the resilience of the system itself in adopting or recovering from these risks [32]. Cyber resilience engineering integrated with risk assessment offers a significant advancement in CI protection, covering both pre-disturbance and post-disturbance stages.