# Comprehensive Analysis of Maritime Cybersecurity Landscape Based on the NIST CSF v2.0
## 5 NIST CSF-Based Analysis of Maritime Cybersecurity
### Identify
#### 5.2.2 Risk Assessment
Software and network systems form the backbone of contemporary commercial and industrial operations, including those in the maritime industry. With technology becoming increasingly intertwined with these operations, the associated risks are rising, necessitating a comprehensive risk assessment. [PERSON] et al. 's [49] study delved deep into the importance of ICT security in the maritime industry by evaluating software vulnerabilities in commodity systems and providing detailed insights using the First Principles Vulnerability Assessment methodology. Their analysis brings out numerous significant vulnerabilities in the code, underscoring the absolute necessity for risk assessment. Further amplifyingthis, [PERSON] et al. [50] forecast the need for risk assessment in mitigating cybersecurity risks in the maritime industry. Their study identifies certain key areas, bound by legal and statutory limitations, that require assessment, including SCADA, information technology systems, and industrial controls. The authors proposed a specific risk assessment model tailored to the maritime infrastructure, placing risk assessment at the heart of managing the software and network systems in the maritime industry. The proliferation of technology in maritime operations has profoundly impacted ports worldwide, leading to increased efficiency and the emergence of'smart' port operations. However, these advancements have also introduced new cyber threats, making risk assessment at ports a topic of critical importance. This is adeptly discussed by [PERSON] et al. [51], who proposed a risk assessment methodology tailored to smart port operations while shining a light on the inherent cyber threats and defensive measures in the evolving maritime environment. Similarly, [PERSON] et al. [52] underlined the emerging vulnerabilities due to the integration of IT and OT systems in global ports, championing the use of tools such as security risk assessment and bow-tie analysis to manage these cyber-physical security susceptibilities while emphasising the importance of regulatory compliance and continuous evaluation. Additionally, a research paper on the Maritime Transportation System highlights the use of empirical data and expert insights to develop a risk assessment approach, primarily focusing on understanding potential financial losses due to cyberattacks on port IT and OT systems [53]. These studies indicate that assessing and managing cyber threats is a prerequisite for the seamless functioning of smart port operations. Risk assessment methodologies and frameworks are paramount in managing and mitigating the growing cyber threats in the maritime industry. [PERSON] et al. [54] discussed the critical role of integrating IT, OT, and human factors in maritime assets, which defines cyber-physical systems. These systems face evolving cybersecurity threats and risks. The use of external security risk assessment tools, along with the implementation of models such as NIST CSF and MITRE ATT&CK, can help mitigate these risks. Improved communication, increased security resilience, and heightened cybersecurity awareness are suggested as well. [PERSON] et al. [55] delved into this subject by examining the vulnerabilities introduced by wireless technology, stressing the susceptibility of third-party devices and satellite communications. Their study proposes a novel attack chain, revealing potential threats in maritime cyber-physical environments. Complementing [PERSON] et al. 's research, [PERSON] et al. [56] introduced a cyber risk assessment methodology called Cyber Risk Assessment for SHips (CRASH), focusing on the cybersecurity risks posed by the integration of IT and OT systems in modern vessels. Meanwhile, [PERSON] et al. [57] presented a practical case study connecting research and practice, aiming to move towards a predictive and proactive maturity level in maritime cybersecurity. Reflecting a country-specific lens, [PERSON] et al.