National Risk Assessment Framework for Securing Industrial Internet of Things (IIoT) Critical Infrastructure: Policy, Governance and Cyber Resilience Guidelines

Critical infrastructure is increasingly dependent on Industrial Internet of Things (IIoT) technologies, creating new cybersecurity challenges across sectors such as energy, water, healthcare, transportation, telecommunications, and manufacturing. This working paper introduces the National IIoT Risk Assessment Model (NIRAM), a structured framework for identifying, assessing, and prioritising cybersecurity risks affecting IIoT-enabled critical infrastructure. NIRAM evaluates risk using three technical factors—threat, vulnerability, and exposure—and three consequence factors—operational impact, safety impact, and national impact. The proposed model provides governments, regulators, and critical infrastructure operators with a practical risk-based approach for cybersecurity decision-making, resilience planning, and critical infrastructure protection at the national level.