Performing risk assessment for critical infrastructure protection: an investigation of transnational challenges and human decision-making considerations

This paper investigates the influence of transnational challenges and decision-making heuristics and biases on the implementation of risk assessment (RA) process in the context of Critical Infrastructure Protection (CIP). The investigation, which is based on a review of existing literature and a critical analysis of the ISO31000:2018 process, suggests that contemporary RA models and processes fail to adequately consider the domain-based characteristics of transnational Critical Infrastructure (CI) characteristics. They also fail to recognize the full extent of the human decision-making influence on the RA process itself, as well as the relative lack of homogeneity across assets, stakeholders, countries, paradigms, and people in transnational CI environments. The findings from this work provide a theoretical contribution towards a better understanding of the complexities introduced by the transnational nature of CIP and the effect of human decision-making. They can provide the impetus for further research in the fields of CIP and RA.