Risk and vulnerability assessment in critical energy infrastructure requires methodological frameworks capable of integrating diverse risk drivers, multi-level organizational decision-making. This paper presents a comprehensive and scalable methodology developed and applied within large hydropower-based energy systems. The framework builds on established international standards for risk governance—including COSO ERM, ISO 31000, ISO 31010 and IEC 62443. The methodology employs a structured sequential workflow for identifying unwanted events and evaluating probability and consequences. Explicit assessment of uncertainty, controllability, and vulnerability are recorded alongside each event. Standardized assessment forms ensure methodological transparency, reproducibility, and uniformity across facilities. A key methodological component is the use of group based expert workshops, designed to promote interdisciplinary agreement. A defining feature of the framework is its multitier structure, enabling aggregation of risk information from individual facilities up to organizational and system wide levels. Each analytical tier—hydropower plant, maintenance group, regional, and corporate—applies harmonized classification schemes, allowing risk patterns at each tier to be synthesized into higher level decision support tools. By combining standard aligned principles, structured expert judgment, and a hierarchical analytical architecture, the methodology provides an internationally transferable model for risk and vulnerability analysis in critical infrastructure. It facilitates consistent decision making under uncertainty and supports strategic risk governance in an era where aging energy systems face increasing operational, climatic and security related challenges.