Bridging Theory and Practice in Incident Response for Cyber-Physical Systems: Insights From the Brazilian Power Sector

Cyber-Physical Systems (CPS) connect physical devices to cyberspace in the operation of essential services and critical infrastructure. Considering the growing CPS presence, increasing number of cyber incidents, and cascading events starting in the power sector, the Incident Response (IR) process remains critical for both research and practice. Therefore, this research aims to analyze the main scientific approaches to IR for CPS and their empirical adherence in the power sector. This research combines a systematic literature review (SLR) in Scopus and Web of Science, moving from 408 to 20 papers selected for full analysis, and a case study that further discusses such scientific perspectives on IR in CPS within the Brazilian Power Sector (BPS). The SLR reveals three recurring frameworks for the IR process: linear, cyclical, and agile (feedback-driven). The study also develops a theory–practice comparison of IR phases, showing convergence between the main IR phases identified in the literature and NIST SP 800-61, a U.S. practice-oriented guideline reference for incident response developed by the National Institute of Standards and Technology (NIST). The case study indicates that these phases present descriptive correspondence with the empirical evidence observed in the specific context of the BPS. The cyclical framework is the representation that best corresponds to the empirical evidence observed; however, it provides limited support for dynamic feedback across IR phases during incident handling, a feature addressed by agile/feedback-driven frameworks. In the focal organization, agile adoption was perceived as difficult to operationalize due to resource and capacity requirements, the need for clearer role definitions, and the low frequency of complex reportable incidents. Future research could further address the barriers to adopting the agile framework and extend the analysis to other CPS domains and countries.