Abstract
This article proposes a combined method for managing information system security risks based on expert assessments and risk-oriented BPMN models integrated with CVSS metrics. Particular attention is paid to smart-city infrastructures with Internet of Things support, where distributed, heterogeneous components significantly increase the attack surface. This method proposed is more of a predictive than a reactive one. Thus, it supports the early prediction of likely vulnerabilities and risks that can be prioritized proactively before any incident occurs. The suggested approach can be adopted in both SOC and CERT environments to enhance the quality of decision making and reduce response time in large distributed infrastructures.