Critical Infrastructures Risk Manager – The Basic Requirements Elaboration

Abstract

The paper concerns the risk assessment and management methodology in critical infrastructures. At the beginning a review is performed of the state of the art, regulations, best practices, EU projects, and other relevant documents. On this basis a set of the most preferable features of a CI risk management tool is identified. These features allow to specify basic requirements for the risk management tool. As the core of the solution is the bow-tie model. A risk register is proposed as an inventory of the hazardous events, along with other data structures for hazards/threats, vulnerabilities, consequences, and barriers. Risk factors and results measures, i.e. likelihood and consequences measures as well as a risk matrix are discussed. Next, a new concept is proposed how to integrate different bow-tie models through internal and external dependencies. These requirements can be implemented on the available software platform for further experiments and validation.