Quantifying OT/ICS Cyber Resilience: An Expert-Weighted Maturity Model and Empirical Field Validation
APPLIED SCIENCES, cilt.16, ss.9611-9626, 2026 (SCI-Expanded, Scopus)
- Yayın Türü: Makale / Tam Makale
- Cilt numarası: 16
- Basım Tarihi: 2026
- Doi Numarası: 10.3390/app16199611
- Dergi Adı: APPLIED SCIENCES
- Derginin Tarandığı İndeksler: Applied Science & Technology Source, Scopus, Science Citation Index Expanded (SCI-EXPANDED), Compendex, INSPEC, Directory of Open Access Journals
- Sayfa Sayıları: ss.9611-9626
- Dokuz Eylül Üniversitesi Adresli: Evet
Özet
Industrial organizations increasingly rely on maturity assessments to evaluate Operational Technology and Industrial Control Systems (OT/ICS) cyber resilience, yet such models are seldom validated against field data. This study examines the measurement layer of an expert-weighted OT/ICS maturity model incorporating 71 controls across nine domains, including a workforce and security culture domain. Aggregated expert-derived criticality weights were applied to an anonymized assessment dataset of 25 structured maturity assessment records containing control-level maturity ratings for all 71 controls. The weight distribution was narrow and top-heavy (mean 4.47 of 5, standard deviation 0.30), with 93% of controls rated at or above 4.0 of 5.0. Scoring each record under expert-derived weights and under uniform weights produced a mean difference of 0.11 points on a 0–100 scale; no record differed by more than 0.63 points, and no reported maturity level changed. The lowest-scoring domain, which determines remediation priority, differed in 2 of 25 records. Domain-level decomposition proved more informative, with domain means ranging from 48.3 to 58.4 and broad distribution within domains. In this dataset, domain structure rather than control-level weighting explains the practical value of the assessment approach. The assessment framework is aligned with the ISA/IEC 62443 series, incorporates expert elicitation for control criticality weighting, and is evaluated using empirical field assessment records from industrial environments.