## Data Sources of Included Studies
### Applicability, Threat Actor, and Implementation Criteria  
The characteristic applicability is used to comprehend the type of evaluation that is acquired from the developed methodologies. In this SLR, it is observed that 37 out of 64 studies ensure risk management in the proposed system for identifying, analyzing, evaluating, and treating loss exposures, as well as monitoring risk control and financial resources, to mitigate the adverse effects of loss. There are three main stages: identifying, assessing, and evaluating risk. The procedure for assessing risk is the main element in the risk management process. Generally, there are two sorts of risk assessment approaches, including quantitative and qualitative strategies. The qualitative assessment techniques primarily rely on proficient knowledge and attention for revealing the risks. In contrast, the quantitative assessment methods can compute the risk value of the system and emphasize the system's quantitative performance under the risks. In general, the quantitative methods are chosen to conduct risk analysis and assessment, owing to the accurate explanations of system risks that can optimize the distribution  
Figure 6: The used data sources for developing BN and GT models. of protected resources. Whereas 10 out of 64 perform the task of vulnerability assessment for evaluating whether the network is vulnerable to any identified vulnerabilities, allocates severity levels to those susceptibilities, and recommends remediation or mitigation, if and whenever required. Moreover, 3 out of 64, 2 out of 64, and 2 out of 64 perform attack analysis, fault analysis, and safety assessment, respectively. Besides, 10 out 64 studies perform distinct functionalities, comprising of [PERSON] et al. [43], [PERSON] et al. [51], [PERSON] et al. [55], [PERSON] et al. [56], [PERSON] et al. [58], [PERSON] et al. [64], [PERSON] et al. [67], [PERSON] et al. [68], [PERSON] et al. [91], and [PERSON] et al. [94], holistic event investigation, resilience quantification, cyber impact assessment, root cause analysis, intrusion detection, trust computation, anomaly detection, reliability assessment, software verification, and water traffic management, respectively. In this SLR, the threat actor is used to identifying that the included studies help prevent the attack. It is observed that the threat actor is classified into two types, such as external and internal. It is observed from Figure 7 that 7 out of 64 and 2 out of 64 studies have mentioned that the developed methodology is applicable against external and internal threats, respectively. Moreover, 2 out 64 developed approaches help prevent both internal and external threats. However, the remaining 53 included articles have not specified any particular kind of threat but rather concentrated on warnings and alarms, which may be suitable for various possible threats. Implementing GT- or BN-based models is vital to measure network performance, transform strategic plans to monitor failures and risks in the system, and apply the necessary actions to achieve integrated safety and security for different applications. During the review process, it is observed that GT- or BN-based development scenarios are an association of nodes, modules, and the implementation subsystems. This SLR suggests that 42%, 31%, and 27% of the included studies performed simulated, real-time, and preliminary analysis, respectively, as shown in Table 4. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Study** & **Implementation Criteria** & **Threat Actor** \\ \hline [PERSON] et al. [42] & Simulation & Not Specified \\ [PERSON] et al. [43] & Simulation & Outsider \\ [PERSON] et al. [44] & Simulation & Not Specified \\ [PERSON] et al. [45] & Real-time & Insider \\ [PERSON] et al. [46] & Real-time & Outsider \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Threat Actor and Implementation Criteria of Included Studies. Figure 7: Threat Actor in Included Studies.