MASTERÂ Assignment
Cara: A Context-Aware Frame for Assessing Business Impact in Cybersecurity
Type : Master M-CS
Period: November 2025 - April 28, 2026
Student: Bozea, D.A. (Diana-Alexandra, Student)
Date Final project: April 28, 2026
Supervisors:
Abstract:
Despite the availability of well-established information security risk management frameworks, such as ISO 27001 and the NIST Risk Management Framework, organisations continue to struggle with their effective application in day-to-day IT operations. In practice, risk assessments are often conducted at a high level of abstraction, with limited integration into operational processes and decision-making structures. As a result, assessment outcomes frequently fail to adequately support prioritisation or timely mitigation of emerging risks.
This thesis investigates how context-aware tooling can support the operationalisation of IT risk management by bridging the gap between theoretical frameworks and organisational practice. It proposes the design and development of a context-aware system that leverages organisation-specific information, structures this information using a domain ontology, and applies a custom algorithm for risk identification and prioritisation. The system aims to transform risk assessment from a static compliance-driven activity into a dynamic and integrated decision-support mechanism.
The proposed approach is validated through the development and evaluation of a prototype within a real-world organisational setting at a software company operating in the international leasing sector. This case study enables an assessment of the system’s applicability, relevance, and alignment with genuine organisational risk management needs.