ARAMIS: A unified and scalable methodology for industrial cyber security risk assessment
Abstract
The rapid digitisation of critical infrastructure has made traditional fragmented risk assessment practices increasingly challenging to scale. For global industrial leaders managing hundreds of diverse projects, there is a real need for a unified methodology that ensures technical rigour, cross-project reproducibility, and scalability. This paper introduces the Advanced Risk Assessment Methodology for Industrial Systems (ARAMIS), an innovative framework developed through a strategic partnership between Airbus Protect and Alstom. ARAMIS merges the structured, requirement-driven security levels of ISA/IEC 62443 with the scenario-based approach of Expression des Besoins et Identification des Objectifs de Sécurité Risk Manager (EBIOS RM). The paper details the five-module structure of ARAMIS, its unique multilayered modelling of operational scenarios and its algorithmic approach to calculating security levels target (SL-T). Finally, it discusses the implementation of the methodology within the Fence risk management tool to ensure seamless reproducibility and knowledge capitalisation across global project portfolios. This article is also included in The Business & Management Collection which can be accessed at https://hstalks.com/business/.
The full article is available to subscribers to the journal.
Author's Biography
Serge Benoliel is the Head of Product Cybersecurity Governance and Expertise at Alstom. With more than three decades of experience in technology and 20 years in the rail industry, he has built a strong track record in engineering leadership, strategic transformation, and the integration of cyber security into complex industrial systems. Serge plays a central role within Alstom’s global product cyber security organisation, shaping governance frameworks, driving expertise development, and supporting the deployment of cyber security across the company’s portfolio. Serge acts also as Project Lead of the IEC 63452 Working Group, in charge of drafting the first International Standard on cyber security for railway.
Florence Foudrain is a Cybersecurity Risk Management Consultant at Airbus Protect. An engineer by training, she began her career in 2011 in reliability, availability, maintainability, and safety before turning to cyber security in 2017. This dual expertise provides her with extensive experience in protecting critical infrastructures, with a particular focus on the railway sector. Florence participated in the creation of ARAMIS methodology, and currently contributes to its deployment and the training of industry experts.
