# Cyber Resilience and Incident Response in Smart Cities: A Systematic Literature Review
## Materials and Methods
### Research Questions and Rationale  
The main aim of this research is to identify and present scientific evidence of gaps in current research and help inform the direction for further research. The aim can be achieved by answering the following three research questions (RQs):  
**RQ1:** How do existing frameworks and systems that address CPSs in smart cities support cyber resilience and what empirical evidence has been reported? Use cases and application of CPSs have diversified, and complexities of these ecosystems have evolved. In addition to frameworks, we investigate how complex systems support cyber resilience identifying commonalities. Within the many diverse definitions used in existing studies addressing smart cities [7; 8; 9; 10; 11; 12] and the numerous terminologies used in literature to describe frameworks and systems [51; 52; 63; 64; 65], providing an answer to RQ1 helps us conclude a list of all existing and relevant frameworks and systems that address CPSs in smart cities supporting cyber resilience as defined by the scope of this SLR.  
Figure 1: Phases conducted in this systematic literature review (SLR).  
**RQ2:** How do the identified frameworks and systems in smart cities address modern digital forensics and incident response (DFIR)? Application of DFIR in the context of a smart city is a new field of study [37]. Whilst the research focuses on the applications of IoT-enabled CPSs, smart cities are found to be vulnerable to cyberattacks [40]. It is acknowledged that DFIR methodologies are lacking in smart city sectors [17, 66] and research suggests that DFIR faces more challenges in smart cities than other forms of digital breach investigations [67]. However, apart from the complexity to the cyberspace, the IoT enabled CPSs to create opportunities to facilitate modern DFIR [44]. RQ2 investigates how the components of the CPS frameworks help address modern DFIR.  
**RQ3:** What are the current cross-sector proposals or applications in smart cities that attempt to utilise interactions in CPSs for the purpose of improving DFIR? This RQ explores the transferable solutions and cross-sector interactions between smart buildings, smart homes, smart healthcare, smart energy and others as illustrated in Figure 2. Despite digitalisation in smart cities, information security strategies are limited to the sector boundary with little evidence of cross-sector information security practice sharing [28]. We draw on the use of the term of cross-sector partnerships in reference [68] as intensive and long-term interactions between organisations from at least two sectors such as business and healthcare. Throughout this study, cross-sector collaborations are used as interactions to adopt, share or coordinate cyber defence practice between at least two different smart city sectors. To address the existing and emerging cyberattacks, transferable and innovative solutions should emerge from individual sectors within a smart environment to support modern digital forensics [28, 68]. RQ1, RQ2 and RQ3 help uncover key themes and gaps in current literature and suggestions for future research direction.  
The PICOC (population, intervention, comparison, outcomes, context) criteria as demonstrated in Table 1 is used from an engineering point of view, as proposed by [PERSON] and [PERSON] [62] to frame the research questions effectively.  
Figure 2: Core smart city sectors.