12 pages (double space, 12 pt TNR)

Critical Infrastructure Protection requires the prioritization of critical assets and the evaluation of the criticality of infrastructures. However, criticality analysis is not yet standardized. In this paper we examine the relation between security risk and criticality. We analyze the similarities and differences in terms of scope, aims, impacts, threats and vulnerabilities and we suggest how existing risk analysis can be applied when examining Critical Infrastructures. Based on the identified relation between risk and criticality, we propose a generic risk-based Criticality Analysis methodology. We place key emphasis on the definition of examined impact types, which are social-centric and/or sector-centric, in contrast to traditional risk analysis methodologies that mainly examine organization-centric impacts. We propose a detailed list of impact criteria in order to assess the criticality level of an infrastructure.