## 4 Results
### Risk Assessment-Related Governance and Lawmaking  
This study considers all elements in the context of lawmaking and governance including regulations, legislation, and directives, because each plays a crucial role in shaping the legal and operational landscape of cyber resilience. Specifically, legislation provides the foundational legal framework that establishes broad principles and mandates for cybersecurity across jurisdictions. On the other hand, regulations offer specific, enforceable rules derived from this legislation, ensuring compliance and setting detailed standards for cyber defense mechanisms. For instance, the General Data Protection Regulation (GDPR) in the EU directly influences how organizations manage data security and respond to breaches. Finally, directives, particularly in the European context, set goals for member states to achieve in areas like CI protection, allowing each country to implement the necessary measures through national laws.  
The legal obligations, compliance requirements, and strategic frameworks that influence the development and implementation of cyber resilience strategies are extracted from the literature and studied in depth to answer the related research question. Table 8 details the identified regulations, directives, legislation, and acts.  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Ref.** & **Name** & **Description** & **Cat.** \\ \hline (117; 119) & NERC-CIP & North American Electric Reliability Corporation CI Protection standards for securing bulk power systems. & Std. \\ \hline (106) & IMO MSC.428 (Maritime Cyber Risk Management) & Guidelines for integrating cyber risk management into the safety management systems (SMSs) of vessels. & Gdl. \\ \hline (106) & IACS E26 and E27 & Cybersecurity guidelines for new vessels, issued by the International Association of Classification Societies. & Gdl. \\ \hline (106) & BIMCO Cyber Security Guidelines & Guidelines provided by the Baltic and International Maritime Council for managing cybersecurity on ships. & Gdl. \\ \hline (106) & Safety4 Sea STCW Convention Guidelines & General guidelines for officers under the STCW Convention, with a focus on cybersecurity. & Gdl. \\ \hline (119) & Cybersecurity and Infrastructure Security Agency (CISA) Report & Report by CISA providing insights into cybersecurity threats and defense strategies. & Rpt. \\ \hline (110) & ENISA Cybersecurity Skills Report & Report by the European Union Agency for Cybersecurity on developing cybersecurity skills in the EU. & Rpt. \\ \hline (127) & Cyberthreat Defense Report (CDR) & Annual report highlighting trends and data on cyber threats and defenses. & Rpt. \\ \hline \hline \end{tabular}
\end{table}
Table 7: _Cont._  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Ref.** & **Name** & **Description** & **Cat.** \\ \hline (104; 109; 117; 128; 132; 133) & NIS Directive & Directive focusing on the security of network and information systems in the EU. & Dir. \\ \hline (132) & EU Proposal for NIS 2.0 & Proposal for an updated Network and Information Systems Directive. & Dir. \\ \hline (104) & European Community EC/216/2008 Regulation & Regulation concerning data security and protection in the European Community. & Reg. \\ \hline \hline \end{tabular}
\end{table}
Table 8: Risk assessment-related regulations (Reps.), directive (Dirs.), regulatory framework (RegFs), acts (Acts) and others (Oths.). The column Cat. shows the category of the row.