## 3 Results
### Construction of an Ontological Model for Assessing Information Security Risks  
Building IS risks ontology is highly relevant and beneficial in the field of cybersecurity and information technology for providing a structured and standardized way to represent knowledge about information security risks. It defines the key concepts, relationships, and attributes relevant to this domain, making it easier for security professionals, researchers, and decision makers to understand and work with this information. An ontology for information security risks can help organizations assess and manage these risks more comprehensively. It can facilitate the identification of vulnerabilities, threats, and potential consequences, leading to more informed risk mitigation strategies. Also, ontology can help organizations map their security practices and risk management processes to regulatory requirements, ensuring compliance and reducing legal risks. Creating \"IS risks\" ontology based on the created thesaurus is a practical and logical approach for providing a standardized and accepted set of terms and synonyms related to a specific domain. When creating an ontology, it is essential to use standardized terminology to ensure clarity and consistency in how information security risks are described and categorized. Relying on a thesaurus helps maintain this consistency. By basing an ontology on an established thesaurus, it ensures that the concepts and terms used in the ontology align with the common understanding and language used by professionals in information security. This makes the ontology more accessible and relevant to practitioners. When constructing the ontology, we combined all 67 risks into 14 groups for better understanding and classification of information security risks. These information security risk groups are displayed in Figure 5.  
Risks are divided into the following groups: Compliance Risks; Data Protection Risks; Server and Data Center Risks; Loss Risks; Communication Channel Risks; Information Security Triad Risks; Business Impact Risks; Resource Allocation Risks; Third-Party Risks;  
Figure 5: Information security risk groups. Device and IoT Risks; Security Monitoring and Logging Risks; Malware and Virus Risks; Human Risks; External Risks. The Communication Channel Risks group includes the following risks: Risk of Eavesdropping Through Communication Channels; Risk of Data Interception Through Communication Channels; Risk of Unauthorized Access to Sensitive Information Through Communication Channels. The Business Impact Risks group includes the following risks: Risk to Potential Business Impact; Residual Risk (Remaining Risk After Implementing Controls); Reputational Risk; Organization's Specific Risk; Operational Risk; Risk of Prolonged Disruptions to Operations. The Compliance Risks group includes the following risks: Information Security Policies and Procedures; Risk Related with Document; Defining Roles and Responsibilities; Legal Risk; Regulatory Requirements Risk; Risk of Non-Compliance and Inadequate Security Practices; Risk of Expectations; Risk of Authentication; Risk of Authorization; Risk of Unauthorized Access to Data; Risk of Unauthorized Changes in Data; Risk of Identification. The Data Protection Risks group includes the following risks: Risk of Data Breaches; Risk of Encryption and Cryptographic Controls; Cryptography Risk. The Device and IoT Risks group includes the following risks: Risk of Automated Attacks Against a Class or Type of Device; Licensing Risk; Risk of Insecure or Default Credentials; Risk of Unauthorized Access to IoT Devices; Lack of Secure Update Mechanisms; Risk of Connections to Insecure Network; Risk of Vulnerable Interfaces; Risk of Vulnerable Interfaces APIs; Risk of Insecure Mobile Application Interfaces; Risk of Insufficient Physical Security; Lack of Privacy Controls; Risk of Insecure Software/Firmware; Risk of Weak Device Management; Device Integration Risk; Risk of Insecure Default Settings; Technology Risk.