Chapter 4 — Critical infrastructure and sector security: core methods

Chapter 4 — Critical infrastructure and sector security: core methods

Lesson map

Lesson 04 published. Map, example, EX016.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["4.1 The risk-assessment cycle"]
  N2["4.3 Ownership and hygiene"]
  N3["4.4 Accepting risk"]
  N4["4.6 Practical activity"]
  N5["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX016"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["4.1 The risk-assessment cycle"]
  N2["4.3 Ownership and hygiene"]
  N3["4.4 Accepting risk"]
  N4["4.6 Practical activity"]
  N5["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX016"]

[Learning outcomes and connection]
    |
    v
[4.1 The risk-assessment cycle]
    |
    v
[4.3 Ownership and hygiene]
    |
    v
[4.4 Accepting risk]
    |
    v
[4.6 Practical activity]
    |
    v
[Chapter synthesis]
    |
    v
[Worked example] --> [Exercise EX016]

Learning outcomes and connection

After this chapter you should be able to:

• run a simple, repeatable risk-assessment cycle for an essential service and keep a usable risk register;
• explain why multiplying likelihood by consequence can mislead in critical infrastructure and how to rank by consequence first;
• make sure every risk has an owner, a treatment, a due date and a review date, and detect when it does not;
• record a risk acceptance properly, with authority, conditions and expiry.

Chapters 1–3 gave you language, context and records. This chapter turns them into the coordinator's central method.

4.1 The risk-assessment cycle

NIST describes risk assessment as a process of preparing, conducting, communicating and maintaining the assessment (NIST SP 800-30 Rev. 1). For a coordinator, a workable cycle has five steps:

1. Frame — which service, which time horizon, which consequences count and what the leadership's appetite is.
2. Identify — collect candidate risks from incidents, audits, staff conversations, supplier reviews, advisories and exercises.
3. Analyse — write each as cause-event-consequence; estimate likelihood and consequence with the people who know.
4. Decide — the risk owner chooses a treatment and a date; acceptance goes to the right level of authority.
5. Monitor — review on a schedule and when something changes; report the top risks upward.

The register is the memory of this cycle. If the register is out of date, the cycle has stopped, whatever the policy says.

4.2 Scales and their limits

Most organizations score likelihood and consequence on 1–5 scales. Make them meaningful by anchoring each level in your service's terms. A consequence scale for Kestrel Water might be:

The usual product, likelihood × consequence, is convenient but has two known problems. First, it lets a frequent minor problem outrank a rare catastrophic one (4 × 3 = 12 beats 2 × 5 = 10). Second, the numbers are ordinal labels, not measurements, so arithmetic on them is weaker than it looks. In essential services, a sensible convention is to rank consequence first — anything that can hurt people or exceed a critical customer's coping time goes to the top — and use the product only to order risks of similar consequence. Whatever rule you choose, write it down so that the ranking is reproducible and arguable.

4.3 Ownership and hygiene

A risk without an owner is a worry, not a managed risk. Register hygiene means each entry has: an owner with authority over the affected service; a treatment decision; a due date for the treatment; a last-review date; and a link to the evidence of progress. A coordinator checks hygiene regularly, because register decay is silent: nobody notices that a "high" risk was last reviewed eight months ago until something happens.

In Lab 4, R02 shows all three failures at once: no owner, a review seven months old and an overdue treatment, on a level-5 risk.

4.4 Accepting risk

Acceptance is a legitimate treatment — no organization can fix everything at once. A proper acceptance records who accepted the risk (at a level of authority matching its consequence), what compensating measures apply, under what conditions the acceptance lapses, and when it expires. NIS2 requires the management bodies of essential and important entities to approve cybersecurity risk-management measures and oversee their implementation (Directive (EU) 2022/2555, Article 20). Whatever your jurisdiction, risks with level-5 consequences should be accepted by the executive or board, never quietly by the coordinator.

4.5 Worked example: reviewing the register (synthetic)

In March, the coordinator reviews Kestrel Water's register before the board audit and risk committee. She uses Lab 4, which encodes the ranking convention and hygiene checks so that anyone can rerun them.

Lab 4 (save as lab04.py, run with python3 lab04.py):

# Lab 4 - consequence-led risk register review (offline, standard library only; all data synthetic)
import datetime as dt
TODAY = dt.date(2026, 3, 2)
# id, title, owner, likelihood 1-5, consequence 1-5, service affected, last review, treatment due
REGISTER = [
    ("R01", "Remote vendor access to station RTUs without MFA", "A. Mensah", 4, 5, "drinking water", "2026-01-10", "2026-04-30"),
    ("R02", "Single engineer knows chlorine dosing logic",       "",          3, 5, "drinking water", "2025-08-01", "2026-02-01"),
    ("R03", "Billing portal phishing of customer accounts",      "C. Okafor", 5, 3, "billing",        "2026-02-20", "2026-06-30"),
    ("R04", "Historian backups never test-restored",             "J. Tan",    3, 4, "drinking water", "2025-12-15", "2026-01-31"),
    ("R05", "Grid supply loss at pumping station KW-07",         "A. Mensah", 2, 5, "drinking water", "2026-02-01", "2026-09-30"),
    ("R06", "Office printer firmware outdated",                  "IT desk",   4, 1, "office IT",      "2026-02-25", "2026-05-31"),
    ("R07", "Hospital not told of planned pressure work",        "L. Ferreira",3, 4, "hospital supply","2025-06-30", "2026-03-31"),
]
SERVICE_WEIGHT = {"drinking water": 3, "hospital supply": 3, "billing": 1, "office IT": 0}
rows = []
for rid, title, owner, l, c, svc, rev, due in REGISTER:
    score = l * c
    flags = []
    if not owner: flags.append("NO OWNER")
    if (TODAY - dt.date.fromisoformat(rev)).days > 180: flags.append("REVIEW STALE")
    if dt.date.fromisoformat(due) < TODAY: flags.append("TREATMENT OVERDUE")
    if c == 5: flags.append("SEVERE CONSEQUENCE")
    rows.append((score, c, SERVICE_WEIGHT[svc], rid, title, flags))
print("Ranked by score only:")
for score, c, w, rid, title, flags in sorted(rows, key=lambda r: (-r[0], r[3])):
    print(f"  {rid} score={score:2d}")
print("Ranked by consequence, then service weight, then score:")
for i, (score, c, w, rid, title, flags) in enumerate(sorted(rows, key=lambda r: (-r[1], -r[2], -r[0], r[3])), 1):
    print(f"  {i}. {rid} c={c} w={w} score={score:2d} {'; '.join(flags) or 'ok'}")
print("Needs governance action:", ", ".join(r[3] for r in sorted(rows, key=lambda r: r[3]) if any(f != 'SEVERE CONSEQUENCE' for f in r[5])))

Expected output (Python 3.13.5):

Ranked by score only:
  R01 score=20
  R02 score=15
  R03 score=15
  R04 score=12
  R07 score=12
  R05 score=10
  R06 score= 4
Ranked by consequence, then service weight, then score:
  1. R01 c=5 w=3 score=20 SEVERE CONSEQUENCE
  2. R02 c=5 w=3 score=15 NO OWNER; REVIEW STALE; TREATMENT OVERDUE; SEVERE CONSEQUENCE
  3. R05 c=5 w=3 score=10 SEVERE CONSEQUENCE
  4. R04 c=4 w=3 score=12 TREATMENT OVERDUE
  5. R07 c=4 w=3 score=12 REVIEW STALE
  6. R03 c=3 w=1 score=15 ok
  7. R06 c=1 w=0 score= 4 ok
Needs governance action: R02, R04, R07

Read the two rankings. By score alone, the billing phishing risk R03 (15) ties with R02 and sits above R05 — a grid supply loss at a pumping station that could leave thousands without water. Ranked by consequence then by the importance of the affected service, the three level-5 drinking-water risks come first. The hygiene flags show where governance, not technology, is failing: R02 (a single engineer who understands the chlorine dosing logic) has no owner, has not been reviewed for seven months and its treatment is overdue; R04's restore test is overdue; R07's review is stale. These three go to the committee as governance actions, with a proposed owner for R02 (A. Mensah, who owns dosing).

Note what the lab does not do. It does not tell you whether "likelihood 4" for R01 is right — that comes from conversation with people who know the supplier and the threat. It makes the ranking rule explicit and the hygiene checks repeatable; it does not make the judgement for you.

4.6 Practical activity

Change the ranking key in Lab 4 to sort by score alone and show the result to a colleague. Ask which order they would defend at a board meeting after a pressure failure at the hospital. Then write your organization's ranking rule in two sentences.

Notice where R03 and R05 land in each order, because that is the argument you would face after an outage: a billing phishing risk ranked above loss of supply at a pumping station is hard to defend. Then add one invented risk with consequence 5 and likelihood 1 and check where it falls under each rule. Finally, run the hygiene checks with a different TODAY date, such as six months later, and see which reviews and treatments become stale or overdue without anyone noticing.

4.7 Common errors and limits

• Scales without anchors, so "4" means different things to different people.
• Arithmetic on ordinal scores presented as precision ("risk 13.6").
• Owners who are coordinators or committees instead of managers with authority.
• Acceptances without expiry, which become permanent by default.
• Registers that list technologies ("SCADA") instead of risk statements.

• Treating the register as the goal; it is only the memory of decisions.

• Letting a level-5 risk sit without an owner because nobody wants it, as R02 did for months.

• Scoring likelihood without talking to the people who know the supplier or the threat, so the number reflects the coordinator's guess.

Exercises — chapter 4

EX016 — Anchor a scale. Objective: make likelihood meaningful. Inputs: the consequence scale in 4.2. Steps: write a five-level likelihood scale anchored in time and evidence. Expected evidence: the scale. Rubric: 3 = levels tied to periods or evidence (for example 5 = has occurred here in the last year or is being actively attempted in the sector; 1 = no known occurrence in the sector, would need multiple unlikely conditions); notes that existing controls are taken into account; 2 = periods only; 1 = words like "high"; 0 = none.

EX017 — Read Lab 4. Objective: interpret ranking and hygiene. Inputs: Lab 4 output. Steps: explain why R03 moves from joint second to sixth and why R05 moves up; list the governance actions and who should own each. Expected evidence: explanation and list. Rubric: 3 = R03 has consequence 3 on billing; R05 has consequence 5 on drinking water; actions: R02 owner (A. Mensah) and overdue treatment, R04 overdue restore test (J. Tan with A. Mensah as service owner), R07 stale review (L. Ferreira, or move to the coordinator for the hospital liaison); 2 = explanation without owners; 1 = repeats output; 0 = none.

EX018 — Accept a risk properly. Objective: record acceptance. Inputs: the board decides it cannot fund replacing station controllers at KW-10 this year. Steps: draft the acceptance record. Expected evidence: record. Rubric: 3 = names the risk statement, accepting authority (chief executive or board, given consequence), compensating measures (for example no remote access, monitoring by KVROC, spare parts), conditions that end the acceptance (new advisory, incident), expiry date and review owner; 2 = no expiry; 1 = "accepted"; 0 = none.

EX019 — Extend the lab. Objective: encode another hygiene rule. Inputs: Lab 4. Steps: add a flag "ACCEPTANCE EXPIRED" using a new field, test it with one expired and one valid acceptance and show the output. Expected evidence: code change and output. Rubric: 3 = field added for every row, rule correct, two test cases demonstrate both outcomes, and "Needs governance action" includes the expired one; 2 = works without tests; 1 = rule only; 0 = none.

EX020 — Present to the committee. Objective: communicate the register. Inputs: Lab 4 output. Steps: write the one-page summary for the audit and risk committee. Expected evidence: summary. Rubric: 3 = top consequence-ranked risks in plain language with owners and dates, governance actions with requested decisions, explicit statement of the ranking rule and its limits, no single "score"; 2 = lists risks without asks; 1 = pastes the table; 0 = none.

Chapter synthesis

Risk assessment is a cycle — frame, identify, analyse, decide, monitor — and the register is its memory. Anchor scales in your service's terms, rank by consequence first in essential services, and treat scores as ordinal. Every risk needs an owner with authority, a treatment, dates and evidence; acceptance is legitimate only with matching authority, conditions and expiry.

Continue studying — chapter 04 of 12

← Chapter 03 · Course chapter index · Chapter 05 →

Continue to the next authored lesson.