This doctoral dissertation investigates the impact of institutional determinants of the ISO 31000:2018 standard and behavioral determinants on the management of security risks in business operations in medium and large companies that, according to the national classification belong to one of the sectors of the national critical infrastructure of the Republic of Croatia. Although there are studies in the recent literature that study the relationship between the implementation of the ISO 31000:2018 standard and behavioral factors, a comprehensive analysis of their interrelationship and impact on the management of security risks in business has not yet been made. This doctoral dissertation is therefore providing an answer to the question of how and to what extent different behavioral factors and institutional determinants of the ISO 31000:2018 standard affect the management of security risks in medium and large companies from the national critical infrastructure sector of the Republic of Croatia. Statistically significant positive correlations were found between all examined constructs. A higher expression of the institutional dimension, both at the overall level and at the level of sub-dimensions, and especially the sub-dimension of acceptance of the basic principles of the ISO standard 31000:2018, was associated with a more pronounced management of security risks, both at the level of the overall result, and and at the level of subdimensions. A higher expression of the behavioral external dimension, at the overall level, as well as at the level of both subdimensions, was associated with a higher expression of the institutional dimension at the overall level and at the level of the subdimensions. When it comes to the behavioral internal dimension, its higher expression was also associated with a higher expression of the institutional dimension, at the overall level and at the sub-dimension level. Finally, a positive connection was established between the two behavioral dimensions, as well as the connection of each of them with the maturity level of the security risk management process. The application of the basic principles of security risk management was statistically significantly positively related to all aspects of security risk management. In other words, a higher level of implementation of the application of basic principles was associated with higher knowledge, identification and analysis, response, supervision and cooperation, which confirmed hypothesis 1 of this doctoral dissertation. The above was elaborated in more detail, by elements of evaluating the maturity of security risk management, and a statistically significant correlation of the implementation and application of the basic principles of the ISO 31000:2018 standard with all the elements used to evaluate the maturity of security risk management is visible. The results of the conducted scientific research not only deepen the understanding of the security risk management process, but also emphasize the importance of implementing norms and respecting behavioral factors in this specific business segment. In addition, differences were identified between the degree of implementation of the norm in medium-sized and large companies from the national critical infrastructure segment, and differences in the results of the analysis of behavioral determinants depending on the size of the company are also very clearly visible. The results of this research have the potential to be important for future research in the field of security risk management in companies from the segment of national critical infrastructure.