Engineering Cyber Resilience Under Resource Constraints for Critical Infrastructure Protection

This research is situated at the intersection of cybersecurity risk management and critical infrastructure protection, where traditional security approaches are challenged by evolving threats and resource constraints. Although consequence-driven cyber-informed engineering (CCE) offers a powerful methodology for protecting critical infrastructure, its resource requirements challenge organizations with limited financial capacity, personnel availability, or technical expertise, for example municipalities operating water supply and wastewater treatment. This paper addresses the fact that no simplified version of CCE exists that, while requiring fewer resources to implement, maintains the essential protective capabilities. This study investigates the principles of CCE and how adaptation to resource constraints can be feasible to strengthen smaller organization's ability to handle cyber threats and maintain public services. To this end, the CCE and the literature on cyber resilience, resource constraints and organizational adaptation strategies are examined about resource requirements, specific characteristics and suitable proposals for adaptations. The results also provide valuable insights into municipal wastewater practice. The paper contributes a comprehensive outline of the CCE and recommendations for practice on how to adapt this framework to be more attainable for organizations with limited resources. It highlights the potential of the adapted CCE to reduce resource requirements while maintaining the fundamental protection logic.

Keywords: Consequence-driven, resilience engineering, cyber resilience, critical infrastructure, public service, local governance, wastewater.