Abstract: A method includes obtaining information defining a custom rule from a user. The custom rule is associated with a cyber-security risk. The custom rule identifies a type of cyber-security risk associated with the custom rule and information to be used to discover whether the cyber-security risk is present in one or more devices or systems of an industrial process control and automation system. The method also includes providing information associated with the custom rule for collection of information related to the custom rule from the one or more devices or systems. The method further includes analyzing the collected information related to the custom rule to identify at least one risk score associated with the one or more devices or systems and/or the industrial process control and automation system. In addition, the method includes presenting the at least one risk score or information based on the at least one risk score.