Аннотация
This study describes a comprehensive methodology for analyzing cybersecurity risks in critical information systems of a transport company, with an emphasis on Supervisory Control And Data Acquisition (SCADA) systems, transport management platforms, and ticketing solutions. The proposed risk assessment approach complies with international standards and recommendations of the National Institute of Standards and Technology. The framework uses a multi-step process including asset identification, multi-criteria system criticality assessment, determination of system vulnerabilities, threat impact, threat likelihood assessment, risk assessment, countermeasure identification, and residual risk assessment. A case study involving a transportation operator demonstrates the effectiveness of the method by showing that SCADA systems, despite having a moderate attack probability, exhibit high risk levels due to severe operational impacts, while ticketing systems present lower risks but still require measures, such as monitoring, protection, and control. The results highlight the model’s ability to more accurately prioritize mitigation efforts than traditional methods by capturing subtle interactions between threat likelihood and impact. This approach not only addresses current infrastructure challenges but also adapts to emerging threats, making it a scalable solution for protecting critical systems.