Abstract: In a method and an apparatus for assessing of security of components, in particular, of components involved in safety-critical infrastructures, the assessment of security of the safety-critical component has an assessing of risks of the respective component and deriving of security measures for the component. Further, an assessing of a level of implementation for each standardized security measure is performed defined by a standard and/or requirement document for the component as well as evaluating of a resilience of the component against attacks directed to the component by performing test attacks against the component which are arranged by use of test cases defined by use of risk assessing results, and by use of implementation level assessing results for each standardized security measure. Thus, improved assessing of the security of components is enabled which can be used, e.g., for insurance of the security of safety-critical components and infrastructures.