## 5 Discussion
### Risk Assessment Methods for Cyber Resilience  
Risk assessment with a perspective of cyber resilience is manifested by a'security-by-design' mindset, enabled by continuous risk assessment and risk mitigation through suitable security measures [105]. Therefore, continuous monitoring is what connects risk assessment with cyber resilience [110; 123]. In other words, to build and sustain cyber resilience, cybersecurity measures need to be continuously assessed and examined [119]. Researchers have used a variety of risk assessment methodologies to address cyber resilience, with noticeable differences and similarities. The difference between some methodologies emerges from different views on the elements that constitute risk. [PERSON] et al. [108] considered risk as vulnerability, impact, and likelihood. Their risk assessment approach included asset identification through the Cyber Resilience Review (CRR) framework, threat source identification, vulnerability identification, attack model generation, impact estimation, and risk calculation. Conversely, [PERSON] et al. [116] and [PERSON] [119] viewed risk as the threat, vulnerability, and impact. [PERSON] et al. [116] quantified threat impacts using the Cyber-informed Engineering (CCE) scoring method. [PERSON] and [PERSON] [119], on the other hand, calculated the impact by estimating the drop in resiliency before and after the occurrence of the threat event. They used the C2M2 model and suggested translating the vulnerabilities into vulnerability scores using the common vulnerability scoring system (CVSS) score [117]. For vulnerability, [PERSON] et al. [116] utilized the common attack vectors that exist in different systems' layers. Other types of risk assessment methods are based on the PIM approach, which consists of a threat analysis followed by a risk analysis method, often referred to as TARA. For threat analysis, studies mostly benefited from the STRIDE framework [9]. Examples of this are the System Security Risk Assessment (SSRA) [103], the TARA performed by [PERSON] et al. [101], Threat, Vulnerability, Risk Analysis (TVRA) [110; 117], and the probability-impact risk assessment presented by [PERSON] et al. [102]. For risk analysis, the most used framework is DREAD [9; 101; 103]. Moreover, some papers proposed their own factors for determining the probability and impact of threats. For probability, [PERSON] and [PERSON] [105] proposed factors such as required knowledge or expertise, historical data of occurrence of such threats, and cost and accessibility of the tools used to conduct the attack. For the impact, they considered the worst-case scenario of each threat, considering impacts on safety, efficiency/effectiveness, and financial, political, and reputational consequences. [PERSON] et al. [99] introduced a tailored Security Risk Assessment SecRAM, previously adopted in another study [PERSON] et al. [22], which also utilizes the probability-impact approach. For impact, they identified a set of primary assets. Then, they considered several critical impact areas, categorized as personnel, capacity, performance, economic, branding, regulatory, and environment. Then, they evaluated the impact based on the compromise of confidentiality (C), integrity (I), and availability (A). The probability, on the other hand, was divided into exposure to the threat source, and the potentiality that the threat source would occur. Another approach to incorporating cyber resilience in risk assessment observed in the literature is to consider the probability and impact of threats and add other cyber resilience factors to the risk elements. [PERSON] et al. [110] presented the Risk Assessment and Medical Applications (RAMA), in which the risk analysis factors are probability, impact, historical data, and contextual relevance. They proposed RAMA as a multi-layer solution to evaluate the attack surface and resilience. [PERSON] and [PERSON] [68] presented a TARA methodology, called Probability, Impact, Exposure, and Recovery, with the aim of enhancing cyber resilience through risk assessment.