Data use and data needs in critical infrastructure risk analysis

This paper provides an overview and mapping of needs and use of data related to formal risk analysis within the context of critical infrastructures, including activities of risk assessments and risk modelling as a part of preventive work against major accidents and crises. The aim is to contribute to a greater understanding of the type of data that is actually used in published sources where different risk assessment or risk analysis methods are applied for critical infrastructure protection. The study focuses specifically on the presentation of applications of quantitative or semi-quantitative risk analysis in the scientific literature within the domain of societally important services and critical infrastructures. The survey was delimited to peer reviewed research papers between the years 2010 and 2020 and resulted in a total number of 183 papers subject for evaluation. The results provide insights into the type of data that is used, missing or difficult to obtain for an application of the identified methods. To obtain a comprehensive critical infrastructure risk analysis data needs are related to three different data dimensions; geospatial topology data, socio-economic data, and infrastructure data. However, no databases are currently available with the explicit purpose to support critical infrastructure risk analysis. Even though this is not viewed as a problem in the examined papers, collecting that data is resource intensive which is a barrier for a more systematic use of formal risk analysis methods.