A method for ranking a plurality of systems based on their susceptibility to a selected risk that is determined from a plurality of risk indicators, is described herein. The method includes obtaining benchmark values for at least one benchmark system with a predetermined level of the predetermined risk; obtaining measured risk indicator values of the predetermined plurality of risk indicators in each of the plurality of systems, the predetermined plurality of risk indicators are the same in all of the plurality of systems; comparing the measured risk indicator values of each of the plurality of systems with the benchmark values of the at least one benchmark system; and ranking the plurality of systems based on the comparing to indicate the susceptibility of each of the plurality of systems to the predetermined risk.