Abstract: As information and communication technologies, real-world physical systems, and people become interconnected in critical infrastructure, attention has shifted to the operations of Cyber-Physical-Social Systems (CPSS). CPSS are progressively integrated in core critical infrastructure organisational processes to achieve a combination of benefits. However, the high degree of integration of technology into human society and mission-critical processes leads to an increase in complexity and introduces novel risks and vulnerabilities. These novel constraints extend beyond what is known from previous cyber-physical and critical infrastructure systems studies and prompt the need for revised risk perception and identification methodologies. This paper aims to develop a novel qualitative risk identification framework that is used in the identification of risk and vulnerability in CPSS ecosystems deployed in critical infrastructure or mission-critical organisational processes. The framework emphasizes interactions between humans and the system making it possible to identify and under-stand how non-technical risk impacts the CPSS ecosystem.