# Comprehensive Analysis of Maritime Cybersecurity Landscape Based on the NIST CSF v2.0
## 5 NIST CSF-Based Analysis of Maritime Cybersecurity
### Identify
#### 5.2.2 Risk Assessment  
Risk assessment refers to the organization's understanding of the cybersecurity risk to its resources, employees, mission, functions, image, or reputation. Risk assessment is an essential first step in protecting personal information and lowering the likelihood of harm to individuals, property, other organizations, and nations. This specific investigation led to the following conclusions regarding the maritime sector. The rapid advancements in digital technologies in maritime operations have led to increased efficiency and profitability; however, these advancements have also ushered in a host of new challenges, particularly those linked to maritime security and cyberattacks. A study by [PERSON] et al. [39] examined the impact of these changes, including the influence of IoT devices and new security frameworks on confidentiality, integrity, and availability, urging the need for potent security policies and continuous maritime cybersecurity assessment. Similarly, [PERSON] et al. [40] addressed the susceptibility of merchant shipping to cyberattacks, particularly focusing on the threats impacting embedded technologies, and underscored the need for efficient threat management. Complementing this perspective, [PERSON] et al. [41] presented an evaluation of security threats to maritime autonomous surface ships, further illuminating AI algorithm vulnerabilities. [PERSON] et al. [42] suggested a methodology for cyber risk assessment, particularly for autonomous ships, emphasizing the need for implementing measures such as firewalls and intrusion detection systems. Concurrently, research on maritime supply chains highlights human factors and cybersecurity risk assessment methods, implying the necessity of considering human dynamics alongside technological threats in the maritime sector [43]. Collectively, these studies underscore the critical importance of a comprehensive and multidimensional approach to managing the increasingly complex landscape of maritime security risks. It is evident that effective risk assessment is a critical component of modern ship operations, requiring constant vigilance and adaptability to protect against ever-evolving cyber threats. The literature on this subject explores various aspects of risk assessment, including staff training, network control, threat detection, vulnerabilities in satellite and GPS systems, autonomous shipping, and many others. [PERSON] et al. [44] conducted a comprehensive study addressing the cybersecurity vulnerabilities prevalent in digitized shipping operations utilizing guidelines from the IMO [6] and ISO/IEC 27001 [72], highlighting the need for enhanced staff training and robust threat detection systems. Meanwhile, [PERSON] et al. 's [45] systematic review explored the widespread cyber threats encountered in shipping operations, particularly focusing on vulnerabilities in satellite and GPS systems, and emphasized the need for implementing robust strategies and technology to tackle these threats. Furthermore, [PERSON] et al. [46] proposed an innovative approach to hazard identification and ranking within maritime autonomous shipping, bringing attention to cybersecurity considerations during the design phase. In addition, [PERSON] et al. [47] underscored the critical importance of cybersecurity in ensuring ship and shipping safety and presented a probabilistic assessment model to identify potential cybersecurity breaches and resulting losses. Meanwhile, [PERSON] et al. [23] conducted a quantitative human risk assessment, emphasizing the necessity for proactive actions and effective strategies to safeguard shipping assets against cyber threats while using AIS system as a specific case study. Lastly, [PERSON] et al. [48] suggested a novel risk assessment framework combining failure mode and effects analysis (FMEA) with a rule-based Bayesian network (RBN), which can serve as a useful tool for stakeholders in managing increasing cyber threats.