### Surveys on IS Risk Management Frameworks
One potential alternative approach to establishing security requirements is to integrate them into the requirements engineering process as an integral part of project development. This allows for a more comprehensive and systematic consideration of security needs right from the early stages of the project. By considering security requirements in conjunction with other project requirements, potential vulnerabilities can be identified and addressed proactively, leading to a more secure final product. The Security Quality RequirementsEngineering (SQUARE) methodology was created at Carnegie Mellon University as a framework for effectively identifying and prioritizing the security requirements of IT systems [39]. One significant benefit of this approach is that security concepts are integrated into the initial stages of system development [1]. The SQUARE model consists of nine essential steps. These include identifying safety and security objectives, categorizing requirements based on their level, conducting risk assessments, prioritizing and inspecting requirements [40]. The main results of this [1] scientific paper include the development and evaluation of a fuzzy expert system for information security risk assessment in learning management systems. The authors demonstrate that their approach outperforms traditional methods in terms of accuracy and effectiveness. By utilizing fuzzy logic, the system effectively handles uncertainty and imprecision inherent in risk assessment processes. The novelty of this research lies in the application of a fuzzy expert system specifically tailored for analyzing information security risks in learning management systems. While existing approaches often rely on quantitative or qualitative methods, this paper introduces a novel methodology that leverages fuzzy logic to capture and represent imprecise knowledge related to security risks. The authors of this paper [41] develop a security assessment framework for CPDPS under intrusion attacks. This framework considers the impact of different types of attacks on the power system's security, reliability, and stability. The novelty of this scientific paper lies in its thorough analysis of the security assessment of cyber-physical distribution power systems under intrusion attacks. The authors provide a comprehensive framework for evaluating the security of such systems and introduce several security metrics to help identify vulnerabilities and improve the overall security of the power grid. \begin{table}
\begin{tabular}{c c c} \hline
**Framework** & **Description** & **Key Components** \\ \hline NIST SP 800-39 & Focuses on managing information security risks across an organization. Provides a holistic approach that integrates risk management into the organization’s governance structure. & 1. Risk framing 2. Risk assessment 3. Risk response strategy 4. Risk monitoring \\  & Is dedicated to IT security risk assessment. It outlines a process to identify, prioritize, and manage IT security risks, specifically aimed at protecting organizational operations and assets. & 1. Risk Assessment Preparation 2. Risk Assessment 3. Risk Communication and Consultation \\  & Provides guidelines for information security risk management. Part of the ISO/IEC 27000 series focusing on aspects of information security management systems (ISMS). & 1. Risk measurement 3. Risk measurement 4. Risk monitoring 5. Risk review \\  & Geared towards enterprise risk management, integrating IS risks with broader organizational risks and aligning them with strategy and performance. & 1. Risk assessment 4. Risk management 5. Risk response 6. Control activities \\  & Designed for IT governance and management, it aligns IT activities with business objectives through a comprehensive set of processes and best practices. & 1. Management objectives 2. Performance management 3. Risk optimization 4. Value delivery \\ \hline \end{tabular}
\end{table} 
Table 1: Traditional IS risk management frameworks.