National-level risk assessments: An analysis report

This report is based on a study and analysis of approaches to national-level risk assessment and threat modelling for cyber security which was conducted between April and October 2013. ENISA aims to provide an evidence-based methodology for establishing a National-level Risk Assessment in order to contribute to the wider objective of improving national contingency planning practices (NCPs). This report will help towards rationalising national risk assessments in EU Member States in order to reduce or eliminate vulnerabilities of critical Information and Communication Technology (ICT) services and infrastructures. This objective was articulated in the February 2013 European Cyber Security Strategy and thus sits within broader EU-wide efforts to improve crisis cooperation activities.

This report should be of use to policy-makers who are charged with implementing a CIIP or cyber security risk assessment programme. In addition, other interested parties may include regulators, researchers and senior industry representatives from Critical Information Infrastructure sectors.