Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Hagenberg Risk Management Process (Part 1): Multidimensional Polar Heatmaps for Context-Sensitive Risk Analysis

Eckehard Hermann, Harald Lampesberger

TL;DR

The paper addresses the need for context-sensitive risk analysis in complex infrastructures under regulatory regimes such as NIS2 and DORA, highlighting the limitations of traditional two-dimensional heatmaps. It introduces the multidimensional polar heatmap as a formal state-space model that generalizes to two dimensions when restricted to two axes. The approach defines a polar embedding, slice concept, and per-axis thresholds, and explains how to aggregate and visualize risk across context while remaining compatible with established methods like FMEA, HAZOP, LOPA, FAIR, and STPA. A data-center cooling scenario demonstrates improved context exploration, and the method is implemented in the Riskomat platform as a practical step in the Hagenberg Risk Management Process.

Abstract

Traditional two-dimensional risk matrices (heatmaps) are widely used to model and visualize likelihood and impact relationships, but they face fundamental methodological limitations when applied to complex infrastructures. In particular, regulatory frameworks such as NIS2 and DORA call for more context-sensitive and system-oriented risk analysis. We argue that incorporating contextual dimensions into heatmaps enhances their analytical value. As a first step towards our Hagenberg Risk Management Process for complex infrastructures and systems, this paper introduces a multidimensional (ND) polar heatmap as a formal model that explicitly integrates additional context dimensions and subsumes classical two-dimensional models as a special case.

Hagenberg Risk Management Process (Part 1): Multidimensional Polar Heatmaps for Context-Sensitive Risk Analysis

TL;DR

The paper addresses the need for context-sensitive risk analysis in complex infrastructures under regulatory regimes such as NIS2 and DORA, highlighting the limitations of traditional two-dimensional heatmaps. It introduces the multidimensional polar heatmap as a formal state-space model that generalizes to two dimensions when restricted to two axes. The approach defines a polar embedding, slice concept, and per-axis thresholds, and explains how to aggregate and visualize risk across context while remaining compatible with established methods like FMEA, HAZOP, LOPA, FAIR, and STPA. A data-center cooling scenario demonstrates improved context exploration, and the method is implemented in the Riskomat platform as a practical step in the Hagenberg Risk Management Process.

Abstract

Traditional two-dimensional risk matrices (heatmaps) are widely used to model and visualize likelihood and impact relationships, but they face fundamental methodological limitations when applied to complex infrastructures. In particular, regulatory frameworks such as NIS2 and DORA call for more context-sensitive and system-oriented risk analysis. We argue that incorporating contextual dimensions into heatmaps enhances their analytical value. As a first step towards our Hagenberg Risk Management Process for complex infrastructures and systems, this paper introduces a multidimensional (ND) polar heatmap as a formal model that explicitly integrates additional context dimensions and subsumes classical two-dimensional models as a special case.
Paper Structure (25 sections, 21 equations, 4 figures, 1 table)

This paper contains 25 sections, 21 equations, 4 figures, 1 table.

Table of Contents

  1. Introduction and problem statement
  2. State of the Art
  3. Qualitative and semi-quantitative risk matrices
  4. Methodological limitations of classical risk matrices
  5. FMEA and FMECA
  6. HAZOP
  7. LOPA
  8. Standards-based IT and cyber risk models
  9. FAIR
  10. STPA
  11. Summary and positioning with respect to ND polar heatmaps
  12. Positioning the ND polar heatmap as a formal representation layer
  13. Formal definition of an ND polar heatmap
  14. Axes, levels and state space
  15. Risk classes and mapping function
  16. ...and 10 more sections

Figures (4)

  • Figure 1: Stylised ND polar heatmap for $d=3$. Annular sectors encode discrete levels per axis; colors encode risk classes $G$ according to $H$ in \ref{['eq:Hdef']}. Black arcs indicate example acceptance thresholds $\bm{a}$.
  • Figure 2: Comparison: 2D risk matrix as a context-indexed slice $M_{\bm{\sigma}}$ vs. ND polar heatmap with axis-specific numbers of levels (5/5/4/3) and highlighting of the active layers.
  • Figure 3: Comparison (Maintenance = due): 2D slice $M_{\bm{\sigma}}$ with adjusted matrix colouring vs. ND polar heatmap with highlighted active layers.
  • Figure 4: Comparison (Maintenance = overdue): 2D slice $M_{\bm{\sigma}}$ with UI-conform matrix colouring (incl. red) vs. ND polar heatmap with highlighted active layers.