Cyber Incident Damage Assessment Frameworks: A Comparative Review

Abstract

Quantitative assessment of damage caused by cybersecurity incidents remains dispersed across four largely independent families of work - risk-management process standards, monetary loss models, regulatory severity schemes and empirical cost studies - none of which was designed for the consequences that dominate when the affected asset is a state digital platform or a critical digital object. This review asks how existing approaches quantify incident damage and where they fail in that setting. Sixty-eight sources, retrieved from Scopus, Web of Science, IEEE Xplore and ScienceDirect and complemented by normative documents of ISO, IEC, NIST, ENISA, CISA, OECD and the European Union, by industry loss reports and by the national legal database of the Republic of Kazakhstan, were coded against nine damage dimensions and four methodological criteria. Process standards define an assessment cycle but no comparable formulas, leaving impact criteria to each organisation. Monetary models such as FAIR, annualised loss expectancy and cyber value-at-risk produce currency-denominated results but presuppose loss frequency data that most jurisdictions do not collect. Regulatory schemes classify the significance of an incident without measuring its cost. Empirical benchmarks embed the price and wage levels of the economies from which they are drawn. Four dimensions are covered weakly or not at all across the whole corpus: cross-sector cascading effects, continuity of public services, technological sovereignty and human safety. Three recurrent methodological defects are identified: uncontrolled double counting between direct, indirect and systemic loss; multiplication of dimensionless severity indices by financial bases; and inconsistent comparison bases. A draft national methodology prepared in Kazakhstan is then analysed as one response to these gaps, together with the calibration and validation agenda it still requires.