A UNIFIED CYBER‑PHYSICAL INCIDENT RESPONSE AND BUSINESS CONTINUITY ARCHITECTURE FOR MANAGING HYBRID, SYSTEMIC, AND CASCADING RISKS ACROSS IT, OT, AND PHYSICAL SECURITY DOMAINS

Abstract

Cyber‑physical ecosystems now operate as hyper converged environments in which information technology (IT), operational technology (OT), and physical security systems interact continuously. But this convergence has increased the scale of the risk and impact of hybrid attack, system failures, and cascading risk effects that spread across domains. The way traditional Incident Response and Business Continuity (IRBC) methods work is still somewhat siloed, as they don't contribute to the cross-domain risk management and improve resilience in converged environments. But there are gaps that need to be filled, and this study suggests a single architecture for Incident Response and Business Continuity (IRBC) that unifies cross‑domain response policies, applies the Zero Trust approach, implements AI empowering analytics, and integrates recovery plans across cyber‑physical systems. The research utilizes a conceptual methodology which involves mapping the standards, building cross domain dependency models and using the synthesis of architectures. Cyber–physical resilience requirements were extracted from various existing international standards (ISO/IEC 27001:2022, ISO 22301:2019, ISO 31000:2018, NIST SP 800‑61, NIST SP 800‑34, NFPA 1600, etc. and other European standards. A dependency modelling diagram shows how hybrid, systemic, and cascading risks move across IT, OT, and physical domains, highlighting the need for IT, OT, and physical space collaboration and co-ordinated operational processes across physical and IT systems. The proposed IRBC architecture will help improve organisational resilience by consolidating incident response and continuity functions, share a common situational awareness based on integrated monitoring, limit lateral movement through the enforcement of Zero Trust and enrich recovery goals across the different domains. The framework is relevant to today's critical infrastructure operators, financial institutions, manufacturing settings and public sector organisations looking to build a more cyber‑physical resilient organisation and reduce risk of cascading failure in converged environments.