Abstract
Decentralized cyber–physical systems (CPSs) improve scalability and fault tolerance but expose local controllers and neighbor-to-neighbor coordination to integrity, availability, and multi-agent attacks. This study presents a PRISMA-guided systematic mapping of cyber-resilience methods for decentralized CPSs and integrates the evidence into a taxonomy and assessment framework. A Scopus search exported on 14 September 2026 yielded 366 records; 337 primary records were screened, 163 underwent eligibility assessment, 79 were included, and 72 met a six-criterion quality threshold for Core synthesis. Power systems and microgrids represented 55.6% of Core studies, false-data/deception attacks were the largest primary attack family (31.9%), and only 18.1% evaluated explicit multi-vector or hybrid attacks. Simulation-only validation dominated (70.8%), while 29.2% provided strong experimental, real-time, hardware-in-the-loop, laboratory, or co-simulation evidence. The synthesis shows comparatively mature work on resilient control, detection, observer-based compensation, and consensus but limited evidence on recovery, self-healing, safety preservation, cross-domain transfer, and reproducible multi-vector evaluation. The proposed framework connects attack models, topology assumptions, resilience mechanisms, validation strength, and measurable outcomes, providing a traceable basis for comparing methods and designing stronger future evaluations.