INTEGRATION OF AUTOMATION SYSTEMS INTO CRITICAL ENERGY INFRASTRUCTURE: CYBERSECURITY AND RESILIENCE CHALLENGES

Abstract

Purpose. The purpose of this study is to examine the cybersecurity and resilience challenges associated with the increasing integration of supervisory control and data acquisition (SCADA) and programmable logic controller (PLC) systems into critical energy infrastructure. Particular attention is given to automation systems deployed across energy, transport, and gas supply facilities, where improvements in operational efficiency are accompanied by an expanding attack surface available to malicious actors. Methodology. The study applies an analytical and synthesis-based approach to the current body of knowledge on industrial control system cybersecurity. The analysis encompasses SCADA-related cyber threats, applicable cybersecurity standards and frameworks, including IEC 62443 and the NIST Cybersecurity Framework, resilience architecture design, and documented incident patterns across offshore extraction platforms, gas pipelines, and fuel storage facilities. The findings derived from the literature are synthesised to establish the conceptual and structural basis for assessing cyber-physical resilience maturity. Results. The analysis identifies a persistent pattern of reactive rather than proactive security governance, insufficient segmentation between information technology (IT) and operational technology (OT) networks, and inadequate industrial control system (ICS)-specific incident response planning across documented cases. Based on these findings, the study develops the Cyber-Physical Resilience Maturity Model (CPRMM), a four-level, four-domain assessment framework designed to enable operators and regulators to systematically evaluate and benchmark the cybersecurity posture of industrial control system environments. Practical implications. The CPRMM translates conceptual findings from the cybersecurity literature into a structured, practitioner-oriented scoring tool that can support operators and regulators in identifying cybersecurity weaknesses and assessing the maturity of cyber-physical resilience measures. The findings further indicate that addressing existing deficiencies requires both technical investment and a fundamental shift in organisational security culture. Value/originality. The principal original contribution of the study is the development of the Cyber-Physical Resilience Maturity Model as an integrated framework for the systematic assessment and benchmarking of cybersecurity and resilience within industrial control system environments. By combining four maturity levels with four assessment domains, the CPRMM provides a structured mechanism for translating established cybersecurity knowledge into an operational assessment instrument applicable to critical infrastructure.