IMPROVING QUALIMETRIC APPROACHES TO RISK ASSESSMENT OF ENERGY COMPANIES TAKING INTO ACCOUNT CYBERSECURITY ASPECTS

The article considers the possibility of applying qualimetric approaches to risk assessment, taking into account modern aspects of cyber threats arising in energy enterprises. For the purpose of risk assessment and management, the scientific, technical and regulatory framework was analysed and an algorithmic scheme was proposed that takes into account the cyber component, which is both a separate threat to the functioning of an energy enterprise and can influence other threats of various nature, and as a result increase the overall risk level. In the course of the study, a scientifically based methodology for assessing the level of enterprise security, taking into account cyber threats, was developed. The proposed approach combines qualimetric methods and a modified system of weighting coefficients, which made it possible to form an integrated risk analysis model that provides a more comprehensive view of the state of security of the and enables the timely detection of critical vulnerabilities both at the stage of planning security measures and during the adoption of management decisions in the course of operations. The study analysed the basic threats to a nuclear power plant, which made it possible to identify hidden threats, namely, it was established that the failure of cooling systems can be caused not only by physical malfunctions, but also by deliberate interference with software or distortion of sensor signals, which is taken into account when assessing risks. The paper presents a visualisation of risk assessment in the form of a 3D risk matrix with a cyber component, which provides a better understanding and helps energy company managers quickly identify the most critical risks in which the cyber factor significantly increases the threat. The application of the integrated model has shown that the actual level of risk at a nuclear power plant increases significantly due to the cyber component. Compared to the baseline assessment, the integrated risk indicator, taking into account the cyber component, increases by 10–25%, confirming the need for the systematic inclusion of cyber protection measures in the overall nuclear energy security policy.