Relevance of the study is driven by significant and constant growth of cyber threats to critical infrastructure, in particular to transport and logistics centers (TLCs), which are key nodes in global supply chains. Attacks on TLCs lead to serious conse-quences, namely: financial losses, disruption of logistics, and data compromise. This creates urgent need for effective ap-proaches to information security (IS) risk management adapted to the specifics of the TLC. Existing methods for assessing IS risks do not sufficiently take into account unique operational processes, integrated IT and OT systems, and technological landscape of TLCs, which jeopardizes their sustainability.The main problem addressed in this study is fragmentation of knowledge and insufficient adaptation of existing IS risk assessment methodologies to the specific conditions of TLCs. General approaches do not take into account unique attack vectors (via WMS, TMS), specific IT/OT vulnerabilities (SCADA), and cascading effects on physical operations. This mismatch makes it difficult to build effective cyber defense, which is critical for the sustainability of operations and data protection.The purpose of the article is to comprehensively systematize existing approaches to assessing IS risks, identify their advantages/disadvantages, and determine their relevance to TLCs.The study analyzed scientific works, standards and practices, which confirmed insufficient coverage of the specifics of TLCs' IS. The categories of security risks for TLCs are systematized. Risk assessment methodologies (FAIR, EBIOS, NIST, ISO/IEC 27005:2023, etc.) are classified and compared, their suitability for TLC is assessed, and advantages, disadvantages, and difficulties of adaptation are identified. The use of the combined, multi-level approach to selection of methods is proposed.The scientific novelty lies in development of classification and systematization of modern methods of assessing IS risks for TLC, as well as in the analysis of relationships between risk assessment methods, attack detection methods and approaches to their implementation in the context of TLC. This forms the knowledge base for making informed decisions by the TLC management on IS management. Practical value is possibility of improving the cybersecurity of TLCs through implementation of the recommended combined approach. At the same time, limitations of existing methods have been identified, including: fragmentation, insufficient consideration of the specifics of TLCs (especially IT/OT convergence) and potential resource intensity.Conclusions confirm achievement of the goal and substantiate urgent need for further research to develop the integrated, specialized methodology for assessing IS risks specifically for TLCs.
Trunov et al. (Mon,) studied this question.