Incorporating technologies across all sectors has meant that cybersecurity risk assessment is now a critical step in cybersecurity risk management. However, risk assessment can be a complicated process for organizations. Therefore, many authors have attempted to automate this step using qualitative and quantitative tools. The problems with the tools and the risk assessment stage in general are (1) not considering all the sub-steps of risk assessment and (2) not identifying the variables necessary for an accurate risk calculation. To address these issues, this article presents a systematic mapping review (SMR) of tools that automate the cybersecurity risk assessment stage based on studies published in the last decade. As a result, we identify and describe 35 tools from 40 primary studies. Most of the primary studies were published between 2012 and 2020, indicating an upward trend of cyber risk assessment tool publication in recent years. The main objectives of this paper are to: (I) identify the differences (reference models and applications) and coverage of the main qualitative and quantitative models, (II) identify relevant risk assessment variables, (III) propose a risk assessment model (qualitative and quantitative) that considers the main variables and sub-stages of risk assessment stage, and (IV) obtain an assessment of the proposed model by experts in the field of cybersecurity. The proposal was sent to a group of 28 cybersecurity experts who approved the proposed variables and their relevance in the cybersecurity risk assessment stage, identifying a majority use of qualitative tools but a preference of experts for quantitative tools.

Una de las etapas de la gestión de riesgos de ciberseguridad es el monitoreo y la revisión. Esta etapa forma parte del proceso de mejora continua de un sistema de gestión de riesgos de ciberseguridad. Este artículo tiene como objetivo llevar a cabo una exploración de una guía de auditoría de riesgos de ciberseguridad tomando como referencia objetivos comunes y guías de la auditoría de riesgos de ciberseguridad. Para ello se tomó como partida una Revisión Sistemática de Literatura (SLR) considerando los estudios de los últimos diez años (2012-2022), a partir de los cuales se identificaron 23 estudios que mencionaban objetivos y guías de auditoría de riesgos de ciberseguridad. Además, se propusieron atributos que deben ser considerados para la creación de un guía de riesgos de ciberseguridad. Posteriormente en el presente trabajo se define una guía de auditoría de riesgos de ciberseguridad (CRAG). Finalmente, se expone la aplicación de CRAG por medio de un caso de estudio considerando los parámetros identificados en los estudios previamente mencionados.