Taxonomy of Cyber Risk Mitigation Cost Benefit Analysis Methods for Energy Infrastructure

Cybersecurity is a critical aspect for the energy industry to defend against cyber attacks. However, justifying the costs of cybersecurity measures is essential. A cost-benefit analysis (CBA) is commonly used to support decision-making for risk mitigation, helping to identify strategies that optimally balance mitigation costs and risk reduction. In this survey, we analyse existing approaches and provide a taxonomic overview of methods for cyber risk mitigation cost-benefit analysis, focusing on key aspects that determine their applicability to energy systems. The survey includes both general and contextual works, employing various methodologies for CBA, whether analytical or criteria-based. We conclude with an analysis of future directions based on recent developments in these methods. As an emerging area, this taxonomy could serve as a foundation that can be expanded with more data from other publications in the field, offering an opportunity to advance knowledge in energy systems.