Requirements for a Quantum-Aware Ontological Cybersecurity Evaluation Model for Cyber-Physical Systems: A Systematic Literature Review

Abstract

The convergence of cyber-physical systems (CPS) with operational technology (OT) and critical infrastructure (CI) in an emerging quantum computing landscape exposes industrial operators to a twofold gap: the absence of semantic evaluation mechanisms to assess the alignment of a cybersecurity reference model with current regulatory frameworks, and the lack of instruments that systematically incorporate the post-quantum transition as a core evaluation dimension. This article presents a Systematic Literature Review (SLR) examining studies published between 2020 and 2026 on standards, practices, and ontological evaluation models for the cybersecurity of CPS and CI in the quantum era. The protocol combined PRISMA 2020, Kitchenham & Brereton, and the GQM framework with a standardized quality instrument. A total of 116 primary studies from seven sources were analyzed. Within the reviewed corpus, no study was found that simultaneously addressed the ontological and quantum dimensions (n = 0), indicating a structural gap between these two research lines. From the corpus, seven key requirements were derived to guide the future development of the Quantum Ontological Cybersecurity Evaluation Model (QOCEM), intended to support the semantic evaluation of industrial reference models ahead of the post-quantum transition.

1. Introduction

Critical infrastructure (CI)—power grids, water treatment systems, industrial plants—operates on cyber-physical systems (CPS), architectures that integrate computing, communications, and physical process control over operational technology (OT) designed in an era when connectivity was not a requirement [1,2]. Convergence with IP networks, Industrial Internet of Things (IIoT) devices, and cloud platforms has significantly expanded the attack surface of these environments, exposing legacy protocols such as Modbus, DNP3, and IEC 60870-5-104 to threat vectors that did not exist two decades ago.

Compounding this reality is an unprecedented disruptive factor: the time horizon of industrial equipment. Programmable logic controllers (PLCs), remote terminal units (RTUs), and supervisory control and data acquisition (SCADA) systems frequently exhibit life cycles exceeding twenty years [3,4]. A device installed today could still be operating when the first cryptographically relevant quantum computer (CRQC) becomes available—a threshold commonly referred to in the industry as “Q-Day,” denoting the point at which a quantum computer becomes powerful enough to break the public-key cryptography that currently secures most digital communications and stored data. Several agencies—including the United States National Institute of Standards and Technology (NIST), Germany’s Federal Office for Information Security (BSI), and the United Kingdom’s National Cyber Security Centre (NCSC)—have issued post-quantum cryptography (PQC) migration timelines with milestones between 2030 and 2035 [5,6,7]; these correspond to recommended transition schedules rather than firm predictions of when a CRQC will actually exist. Shor’s algorithm compromises the RSA, ECC (Elliptic Curve Cryptography), and Diffie–Hellman public-key schemes in polynomial time [8], while Grover’s algorithm reduces the effective security of AES-128 to a level equivalent to 64 bits [9]. The regulatory response arrived in 2024 with the publication of the FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) standards by NIST [10]; however, no current operational framework for OT and ICS environments incorporates a formal mechanism to assess whether a cybersecurity reference model can accommodate this transition coherently.

Ontologies emerge as a suitable instrument for addressing this gap. They enable the detection of terminological ambiguities among heterogeneous standards, support automated reasoning over concepts, and ensure semantic interoperability among frameworks such as IEC 62443, NIST SP 800-82 Rev. 3, and the new post-quantum cryptography (PQC) standards [11]. Their application in cybersecurity has gained ground, ranging from the Unified Cybersecurity Ontology to COMAT—an ontology built upon the MITRE ATT&CK taxonomy [12], and directly upon the MITRE ATT&CK for ICS framework itself [13]—and ontoMAT 4.0 for Industry 4.0 environments [14]. Nevertheless, their use as an instrument for evaluating reference models in CI remains a largely unexplored area within the reviewed literature, and no study identified in this search simultaneously integrated ontological evaluation, the cybersecurity of CPS in CI, and the quantum dimension into a single framework aimed at deriving formal requirements. This threefold absence, as observed in the corpus, frames the question guiding the present work:

What are the requirements for an ontological evaluation model capable of identifying opportunities for improving the cybersecurity of CPS and CI in the face of emerging quantum threats?

To address this question, this article develops a Systematic Literature Review (SLR) grounded in the Kitchenham & Brereton protocol [15] and PRISMA 2020 [16], complemented by the GQM (Goal-Question-Metric) model [17] and the PICOC-FINER scheme [18], and incorporating the CRRC quality instrument (Clarity, Rigor, Relevance, and Credibility). The search was conducted across seven data sources: four publisher databases with proprietary repositories (IEEE Xplore, ACM Digital Library, SpringerLink, and ScienceDirect), one multidisciplinary bibliographic index (Scopus), one academic search engine (Google Scholar), and Grey Literature as a complementary source to reduce publication bias. The resulting corpus comprises 116 primary studies published between 2020 and 2026.

The contributions of this work are fivefold: (i) a synthesis of the predominant cybersecurity standards and frameworks for CPS and CI—IEC 62443, NIST SP 800-82 Rev. 3, NERC CIP, MITRE ATT&CK for ICS—assessing their preparedness for quantum threats; (ii) a characterization of the impact of quantum computing on industrial cybersecurity practices; (iii) the identification and classification of emerging quantum vulnerabilities in legacy protocols; (iv) the determination of the seven key requirements for the Quantum Ontological Cybersecurity Evaluation Model (QOCEM), articulated with the FIPS 203/204/205 standards; and (v) a comparison between traditional and ontological evaluation models in the face of quantum attacks on CPS and CI. The review prioritized peer-reviewed English-language publications from the 2020–2026 period, complemented by a limited set of grey literature sources that satisfied the CRRC quality threshold (see Section 3.3), and excluded quantum cryptography studies without direct application to CPS, as well as books, theses, and low-credibility non-peer-reviewed reports.

The remainder of the article is organized as follows: Section 2 situates the work within the existing literature; Section 3 describes the methodological protocol; Section 4 presents the results with explicit answers to the five research questions; Section 5 discusses the findings and examines threats to validity; and Section 6 presents the conclusions.

2. Related Work

The literature review identified four thematic lines that converge with this research: the cybersecurity of CPS and CI as a consolidated field, the role of ontologies as an instrument of semantic representation, the emergence of quantum computing as a disruptive factor, and the evaluation models that have attempted to articulate these dimensions into a verifiable instrument. Within the 116 primary studies analyzed, no study was found that simultaneously integrated these three dimensions—ontological evaluation, the cybersecurity of CPS in CI, and quantum threats—into a single framework aimed at deriving formal requirements, suggesting that this integration remains an open line of inquiry.

Cybersecurity in CPS and Critical Infrastructure. The cybersecurity of CPS and CI has been one of the fastest-growing fields in security research over the past decade, with a notable acceleration beginning in 2020, concentrated on intrusion detection in industrial networks, risk management in OT and ICS environments, and operational resilience to incidents [1,2]. The literature has devoted particular attention to protecting protocols such as GOOSE, Modbus TCP/IP, and DNP3 against well-documented attack vectors, including command injection, replay attacks, and process-state manipulation in SCADA [3,4]. On the regulatory front, IEC 62443, NIST SP 800-82 Rev. 3, and NERC CIP have constituted the dominant references for operators and integrators. However, analysis of the corpus revealed that 76.7% of the primary studies did not address them substantively (n = 89 of 116), and that none of these frameworks incorporated semantic evaluation mechanisms oriented toward emerging quantum threats—underscoring the need for an instrument such as the QOCEM.

Ontologies Applied to Cybersecurity. Ontologies have become established as an instrument for the formal representation of knowledge in cybersecurity, as systematically documented by Borja & Gómez [11]. Specific initiatives illustrate the state of the art: COMAT, built upon MITRE ATT&CK for ICS [12,13], demonstrated the feasibility of formalizing attack tactics and techniques into reasoned and extensible schemas; ontoMAT 4.0 [14] extended this approach to the Industry 4.0 context. Nonetheless, 81.9% of the primary studies did not address ontologies in any form (n = 95 of 116), and no article in the corpus simultaneously integrated ontology, CPS and CI, and the quantum era (n = 0)—a result that quantifies, within the reviewed corpus, the magnitude of the gap that this work set out to address.

Quantum Threats and Post-Quantum Cryptography. Publications along the quantum axis increased from 6 studies in 2023 to 28 in the 2024–2025 biennium—more than quadrupling the previous annual output (see the annual trend data [available in the consolidated Zenodo repository—https://doi.org/10.5281/zenodo.21294852])—coinciding with the publication of the NIST FIPS 203, FIPS 204, and FIPS 205 standards in 2024 [10]. The harvest now, decrypt later (HNDL) strategy—which consists of capturing encrypted traffic today in order to decrypt it once sufficient quantum computing capability becomes available—has been formally acknowledged by national security agencies as an active adversarial practice rather than a purely theoretical scenario [19,20], building on the algorithmic foundations described by Shor [8] and Grover [9]. This threat is particularly critical for CI with assets whose life cycles exceed twenty years. Works such as Del Moral et al. [21], Singh et al. [22], and Ghosh et al. [23] advanced specific solutions for industrial environments—including regulatory analyses, PQC cryptographic primitives for SCADA, and multi-stage quantum-resistant frameworks—but none offered an instrument for the systemic evaluation of a complete reference model.

Evaluation Models. Cybersecurity evaluation in CPS and CI has been articulated primarily around two approaches. The first corresponds to organizational maturity models: Brezavšček and Baggia [24] synthesized the trends in this field, showing that most of the proposed instruments assessed institutional preparedness through progressive capability levels, without verifying the internal technical coherence of reference models. The second corresponds to risk taxonomies such as TRACI [25], which lack the semantic capability needed to detect inconsistencies among heterogeneous standards. The model closest to the type of formal evaluation pursued in this research was that proposed by Koza [26] for the prioritization of CVEs in CI, although its scope was limited to individual vulnerabilities and did not extend to the systemic assessment of a complete model. Apart from approaches that address the quantum dimension only tangentially, none of the evaluation models identified in the corpus incorporated it as a central evaluation dimension.

Table 1 summarizes the position of this work relative to the most directly related studies, showing that the combination of the three axes—CPS and CI, ontology, and the quantum era—was not addressed jointly by any of the studies retrieved in this review.

Table 1. Comparative analysis with related studies and reviews.

Reference	Focus	CPS/CI	Ontology	Quantum	Key Difference
Amador et al. [27] 2026	SLR on CPS cybersecurity in the quantum era—66 studies.	✓	—	✓	No ontological axis in search strings or research questions; does not derive requirements for QOCEM.
Amador et al. [28] 2024	MoRCiTO: OT reference model for the quantum era.	✓	—	✓	Proposes the model but does not evaluate it ontologically.
Borja & Gómez [11] 2021	SLR on cybersecurity ontologies—general IT—50 studies, 2010–2020.	—	✓	—	Does not address CPS/CI or the quantum era.
Del Moral et al. [21] 2024	PQC in CI—NIST standards perspective.	✓	—	✓	No ontological evaluation or reference models.
Brezavšček & Baggia [24] 2025	SLR on cybersecurity maturity models—96 studies, 2012–2024.	Partial	—	—	No ontological or quantum dimension; generic organizational scope.
This work	SLR on QOCEM requirements—116 studies.	✓	✓	✓	Integrates the three axes; the only study identified in the reviewed corpus to combine all three.

It is worth clarifying the relationship between this work and the authors’ previous SLR [27]: both share the same application domain—CPS and CI in the quantum era—but differ in their research question, protocol, and final output. The review in [27] was exploratory in nature and characterized the general landscape of the domain across 66 studies, without incorporating the ontological axis into either its search strings or its research questions. The present work addresses a different question—the requirements for an ontological evaluation model—through a new protocol featuring ontological and semantic-evaluation terms, two research questions with no antecedent in [27] (P4 and P5), the CRRC quality instrument, and a thematic co-occurrence analysis, none of which were present in the prior work. Whereas [27] delivered a mapping of the state of the art, this article derives a formal requirements specification as a direct input for the design of the QOCEM. A complementary output of the authors’ research line—the MoRCiTO reference model—is presented in [28].

3. Methodology

This SLR adopts a protocol that articulates three complementary methodological frameworks: the guidelines of Kitchenham & Brereton [15], the PRISMA 2020 standard [16], and the GQM (Goal-Question-Metric) model [17], under the PICOC-FINER validation scheme [18]. The protocol is organized into six sequential phases: (1) definition of objectives and research questions; (2) literature search and retrieval; (3) relevance assessment; (4) data extraction; (5) synthesis and analysis; and (6) report preparation. The complete flow is illustrated in Figure 1.

Figure 1. The SLR adopts a protocol.

3.1. Definition of Objectives and Research Questions

The general objective of the SLR is to analyze the literature on standards, practices, and ontological cybersecurity evaluation models applied to CPS and CI in the quantum era, in order to characterize the requirements necessary for the development of the QOCEM. Based on the GQM model [17], this objective was decomposed into five specific objectives (SO1–SO5), each linked to a research question directly oriented toward identifying the requirements of the QOCEM, and to a metric that enabled assessment of the degree of response achieved through analysis of the corpus, as presented in Table 2. The questions were validated using the FINER criteria (Feasible, Interesting, Novel, Ethical, Relevant) [18], and the search terms were structured using the PICOC framework: Population = CPS and CI; Intervention = ontological cybersecurity evaluation model; Comparison = traditional evaluation frameworks and models; Outcome = deriving the requirements for the QOCEM; Context = quantum era in CI. It should be noted that the quantum and ontological dimensions (IC3 and IC6 in Table 3) were treated as thematic relevance criteria rather than strict eligibility filters, allowing the corpus to include studies that substantively contribute to only one of the review’s thematic axes—a design choice further clarified in Section 3.2.

Table 2. GQM structure: specific objectives, research questions, and metrics.

SO	Objective	Research Question	Metric
SO1	Characterize cybersecurity standards and practices for CPS and CI.	P1. What are the main standards and frameworks used?	No. of documented standards.
SO2	Assess the influence of quantum computing on cybersecurity practices.	P2. How does quantum computing affect current standards in CPS and CI?	No. of articles on quantum effects.
SO3	Identify emerging quantum vulnerabilities in CPS and CI.	P3. What quantum vulnerabilities are emerging in the cybersecurity of CPS and CI?	No. of vulnerabilities identified.
SO4	Determine requirements for a QOCEM in CPS and CI.	P4. What are the key requirements for developing the QOCEM?	No. of categorized requirements.
SO5	Compare ontological models with traditional evaluation models.	P5. What differences exist between traditional and ontological models in the face of quantum attacks?	No. of comparative studies identified

Table 3. Inclusion, exclusion, and thematic relevance criteria.

Code	Inclusion Criteria (IC)	Code	Exclusion Criteria (EC)
IC1	Articles on cybersecurity in CPS and/or CI.	CE1	No cybersecurity focus on CPS or CI.
IC2	Studies with evaluation models or ontologies applied to cybersecurity.	CE2	Unrelated to ontological or evaluation models.
IC3 (a)	Research on the impact of quantum computing on CPS and CI.	CE3	No quantum threats in the cybersecurity context.
IC4	Peer-reviewed publications, 2020–2026.	CE4	Books, theses, technical reports, non-peer-reviewed abstracts.
IC5	Articles in English.	CE5	Articles in languages other than English.
IC6 (a)	Works on ontological models for preventing network attacks in CPS and CI in the quantum era.	CE6	No analysis of network attacks linked to quantum challenges.

^(a) Note: IC1, IC2, IC4, and IC5 operate as hard eligibility criteria that a study must satisfy to proceed to full-text screening. IC3 and IC6 operate as thematic relevance criteria: they score the degree to which a study addresses the quantum and/or ontological dimensions of the review, without requiring these to be its primary focus. This distinction explains why, although IC3 and IC6 were part of the screening instrument, only 31.9% and 18.1% of the final corpus substantively addressed the quantum and ontological axes, respectively (see Section 4.1)—these studies were retained because they satisfied the hard eligibility criteria and scored adequately overall, not because every included study centers on quantum or ontological content.

3.2. Literature Search and Retrieval

The bibliographic sources were selected using a matrix of eight criteria weighted on a scale of 1 to 5—thematic coverage, quality, accessibility, ease of use, scientific impact, document volume, impact factor, and compliance with the exclusion criteria—which led to the selection of seven data sources organized into four groups according to their nature: (i) publisher databases with proprietary repositories—IEEE Xplore, ACM Digital Library, SpringerLink, and ScienceDirect—which provide direct access to the full text of articles published by their respective publishers; (ii) a multidisciplinary bibliographic index—Scopus—selected for its coverage of multiple publishers within a single structured search system; (iii) an academic search engine—Google Scholar—included for its capacity to retrieve scholarly literature that is not always indexed in formal databases, thereby broadening the coverage of the protocol; and (iv) Grey Literature as a complementary source, consulted through manual searches in institutional and academic repositories with the aim of reducing the publication bias inherent to formal sources.

The base search string was constructed from the PICOC framework and subjected to a pilot test prior to its definitive application, in order to verify its precision and coverage. The resulting string was adapted to the specific syntax of each platform to ensure the semantic equivalence of the results, with uniform filters for time period (2020–2026) applied across all sources; publication-type filters (restricted to journal articles) were applied to the six formal bibliographic sources, while Grey Literature was searched without this restriction, consistent with its role as a complementary source for reducing publication bias. The complete search strings for each data source are available in the consolidated Zenodo repository (https://doi.org/10.5281/zenodo.21294852).

Scopus was the only source that contributed no studies to the final corpus: all 75 of its records corresponded either to duplicates already present in Google Scholar and ScienceDirect, or to articles that did not align with the thematic axes of the review during the full-text eligibility assessment against the IC/EC (Table 3), consistent with the PRISMA flow diagram in Figure 2. This outcome does not invalidate its inclusion in the protocol—whose function is to broaden search coverage—but rather confirms that the applied deduplication mechanisms operated correctly. Grey Literature, in turn, contributed 22 studies at the inclusion stage, of which 20 became part of the definitive corpus after the CRRC quality assessment, demonstrating the relevance of including it as a complementary source. It should be noted that the search was conducted through January 2026, which is why the number of retrieved articles corresponding to that year was small.

Figure 2. The PRISMA 2020 flow diagram. Source: Adapted from Page et al. [16].

Prior to the definitive execution of the search, six inclusion criteria (IC1–IC6) and six exclusion criteria (EC1–EC6) were established, presented in Table 3. These criteria are applied using a three-level quantitative scale: 1 (fully met), 0.5 (partially met), and 0 (not met), with a maximum score of 6.0 points per study. Studies scoring ≥ 4.0 are classified as highly relevant and included in the corpus; those scoring between 3.0 and 3.9 are considered of partial relevance and used as contextual support when their contribution justified it; and those scoring below 3.0 are excluded from the analysis.

3.3. Relevance Assessment—CRRC Instrument

The 133 relevant studies identified after full-text screening were evaluated using the CRRC instrument, composed of four criteria: Clarity (C), Methodological Rigor (R), Relevance (Re), and Credibility (Cr). Each criterion admits three responses: Yes (1.0 point), Partially (0.5 points), or No (0.0 points), with a maximum of 4.0 points per study. Table 4 describes the operational descriptors for each criterion, explicitly establishing the conditions that determine each response level and thereby ensuring the reproducibility of the instrument.

Table 4. Operational descriptors of the CRRC instrument.

Criterion	Yes (1.0 Point)	Partially (0.5 Points)	No (0.0 Points)
Clarity (C)	The article explicitly states its objective, research question, and scope, with consistent terminology throughout the text.	The objective or question is stated but incompletely or with significant terminological ambiguities.	The article does not state its objective, research question, or scope, or the terminology is so inconsistent that it prevents understanding the purpose of the study.
Methodological Rigor (R)	The study fully describes its method—design, data sources, criteria, and procedure—allowing the validity of the results and their replication to be assessed.	The method is partially described; some essential elements (sources, criteria, or procedure) are omitted or ambiguous.	The article does not describe the method, or the description is insufficient to assess the validity of the results.
Relevance (Re)	The study directly addresses at least one of the thematic axes of the SLR (cybersecurity, CPS and CI, ontology, quantum threats), and its results contribute to answering at least one of questions P1–P5.	The study addresses the thematic axes tangentially, or its results provide indirect evidence for the research questions.	The study bears no substantive relation to any of the thematic axes or to the research questions of the SLR.
Credibility (Cr)	The article is published in a peer-reviewed indexed journal, with verifiable institutional affiliation and complete bibliographic references.	The article partially meets the credibility indicators: peer-reviewed but in a non-indexed source, or with incomplete references.	The article has not been peer-reviewed, lacks verifiable institutional affiliation, or presents indicators of low editorial reliability.

The decision thresholds are as follows: ≥3.2 = high quality (direct inclusion); 2.1–3.1 = medium quality (individual review by consensus of the three researchers before deciding on inclusion or exclusion); and ≤2.0 = low quality (automatic exclusion). The direct-inclusion threshold was set at ≥3.2 out of 4.0—equivalent to 80% of the maximum score—following the criterion that a study must fully satisfy at least three of the four criteria to be considered high quality. This cut-off is more stringent than the threshold of 3.0 used in similar reviews [15,16], which reduces the risk of including methodologically weak studies, and less restrictive than 3.5, a threshold that would have excluded empirically relevant studies with minor reporting limitations. In operational terms, given that the CRRC instrument comprises four criteria scored at a maximum of 1.0 point each, a threshold of ≥3.2 requires a study to fully satisfy at least three of the four criteria while allowing partial fulfillment of the fourth (e.g., three criteria at 1.0 plus one at ≥0.2, or an equivalent combination); this operationalization was considered a reasonable balance between methodological rigor and inclusiveness for an emerging and still-consolidating research domain such as post-quantum cybersecurity for CPS and CI. The decision was validated through a pilot test on a random sample of 20 studies independently assessed by the three researchers, yielding an inter-rater agreement exceeding 85% prior to definitive application. Application of the instrument resulted in the exclusion of 17 additional studies, consolidating the definitive corpus at 116 primary studies with a mean CRRC score of 3.54/4.0. The distribution by data source is presented in Table 5.

Table 5. Distribution of included and excluded studies by CRRC.

Data Source	Type	Included IC (n)	Primary (n)	Excluded CRRC (n)
IEEE Xplore	Publisher database	10	1	9
ACM Digital Library	Publisher database	4	4	0
ScienceDirect	Publisher database	38	34	4
Google Scholar	Search engine	39	37	2
Scopus	Bibliographic index	0	0	0 *
SpringerLink	Publisher database	20	20	0
Grey Literature	Complementary source	22	20	2
TOTAL		133	116	17

* The 75 Scopus records were excluded at the full-text eligibility stage (IC/EC assessment) owing to duplication or thematic non-alignment, not by CRRC score; see Section 3.2 and Figure 2.

The high exclusion rate for IEEE Xplore (9 of 10 records) is attributed to the documentary composition of the results retrieved from this source, which did not reach the CRRC threshold of 3.2/4.0 despite passing the thematic screening.

3.4. Extraction, Synthesis, and PRISMA 2020 Flow

Data extraction was carried out using a structured Excel matrix with 29 fields per study: ID, DOI, authors, year, source database, keywords, contributions to research questions P1–P5 and to specific objectives SO1–SO4, among others. The complete matrix is available in the consolidated Zenodo repository (https://doi.org/10.5281/zenodo.21294852). The coding is binary: 1 = addresses the topic substantively; 0 = absent or tangential. The screening process and application of the CRRC instrument were performed independently by each of the three researchers, following the protocol described in PRISMA 2020 [16]. Inter-rater consistency was managed through a structured two-stage consensus process: in the first stage, each researcher applied the IC/EC and the CRRC instrument autonomously; in the second, cases with divergent decisions were discussed until unanimous agreement was reached. This iterative consensus mechanism is recognized in the software-engineering SLR literature as a valid alternative to Cohen’s kappa coefficient when the protocol relies on explicitly operationalized criteria that reduce interpretive ambiguity [15]. In this study, the operationalization of the four CRRC criteria through the three-level descriptors presented in Table 4 served precisely that function. As indirect indicators of consistency, the following are noted: the mean CRRC score of 3.54/4.0, reflecting a comparable quality profile across the seven data sources despite their uneven volume of contributed studies (Table 5), and the exclusion rate at the CRRC stage of 12.8% (17 of 133 studies), consistent with a well-calibrated prior screening process.

The synthesis follows an inductive thematic analysis approach deployed across four complementary areas: bibliometric distribution of the corpus, coverage of thematic keywords, evidence mapping by research questions and specific objectives, and thematic co-occurrence analysis.

The complete process of identification, screening, eligibility, and inclusion was documented in the PRISMA 2020 flow diagram presented in Figure 2, adapted from Page et al. [16]. Of the 1237 records identified across the seven data sources, 155 duplicates and 739 records were removed for non-correspondence with the inclusion criteria during title and abstract review, leaving 343 studies for full-text screening. Of these, 210 were excluded for failing to meet the inclusion criteria upon full reading—including the 75 Scopus records excluded due to duplication or thematic non-alignment—resulting in 133 relevant studies. After applying the CRRC instrument with a threshold of ≥3.2, 17 additional studies were excluded, yielding the definitive corpus of 116 primary studies. The complete list of the 116 primary studies, together with the reference number assigned to each of them, is presented in Appendix A (Table A1) of this manuscript.

In accordance with the PRISMA 2020 reporting guidelines, the completed PRISMA 2020 checklist is provided as Supplementary Materials. The review protocol was not registered in a prospective registry; instead, the full protocol and all artifacts generated throughout the PRISMA process—search strings per data source, inclusion and exclusion criteria, CRRC quality scores for the 133 assessed studies, the complete extraction matrix of the 116 primary studies, and the PRISMA flow summary—were made openly available in the Zenodo repository (https://doi.org/10.5281/zenodo.21294852), ensuring the transparency, traceability, and reproducibility of the entire process.

4. Results

The results were organized into five analytical components derived from the extraction matrix of the 116 primary studies: bibliometric characteristics, evidence mapping, thematic co-occurrence and gaps, synthesis of findings, and answers to the five research questions.

4.1. Bibliometric Characteristics and Evidence Mapping

The bibliometric analysis revealed sustained and accelerated growth in scientific output within the domain, with a notable inflection point beginning in 2023. The years 2024 and 2025 accounted for 69.8% of the corpus (n = 81 articles), coinciding with the publication of the NIST FIPS 203, FIPS 204, and FIPS 205 standards [10]—a regulatory milestone that appears to have accelerated the scientific community’s response to the quantum threat. Figure 3 illustrates the temporal distribution of the corpus. It should be noted that the year 2026 records lower output, given that the search was conducted only through January of that year. Of the corpus, 87.9% corresponded to peer-reviewed indexed journals (n = 102), complemented by a smaller share of grey literature sources included under the CRRC threshold described in Section 3.3, and 80.2% to empirical research (n = 93), reflecting a broadly consistent level of methodological rigor across the reviewed studies.

Figure 3. Annual publication trend of the corpus (n = 116). Source: own elaboration based on the extraction matrix available in the consolidated Zenodo repository (https://doi.org/10.5281/zenodo.21294852).

The mapping of the 116 studies against the seven thematic axes of the review revealed an asymmetric landscape: cybersecurity achieved universal coverage (100%), followed by critical infrastructure (n = 76; 65.5%), CPS (n = 62; 53.4%), quantum (n = 37; 31.9%), framework (n = 33; 28.4%), standard (n = 27; 23.3%), and ontology (n = 21; 18.1%). The mapping by research questions showed that P1 (standards) and P4 (QOCEM requirements) led coverage, with n = 108 (93.1%) and n = 106 (91.4%), respectively, whereas P2 (quantum impact) and P3 (quantum vulnerabilities) recorded significantly lower coverage, n = 45 (38.8%) and n = 47 (40.5%), suggesting that, within the reviewed corpus, the literature characterized the classical problem extensively but less frequently addressed it from the quantum and ontological perspectives. In addition, empirical validation—associated with project objective PO4 (PO4 denotes the fourth objective of the broader doctoral research program of which this systematic review constitutes one stage. It corresponds to the empirical validation of the QOCEM in a real critical-infrastructure environment—a subsequent phase that lies outside the scope of the present article (see Section 6.2, line of action LA2).) (validating the model through a case study in a real CI)—registered a coverage of 50.9% (n = 59), remaining among the least represented areas in the literature and pointing to what appears to be the most significant structural deficit identified in this field.

4.2. Thematic Co-Occurrence Analysis and Main Findings

The thematic co-occurrence map (Figure 4) cross-tabulated the seven axes against one another. The densest intersections corresponded to the cybersecurity–CI pair (n = 76; 65.5%) and the cybersecurity–CPS pair (n = 62; 53.4%), confirming the consolidation of these pairings as the core of the literature. The most significant figure was that recorded in the ontology × quantum cell: n = 0—no study in the corpus simultaneously addressed both dimensions. Co-occurrence was operationalized as the intersection of the two binary axis codes defined in Section 3.4: a study is counted in a given cell only when it was coded 1 on both axes, that is, when it addresses each dimension substantively rather than tangentially. Under this criterion none of the 116 studies met the condition for the ontology × quantum pairing, even though 21 studies were coded 1 on the ontological axis and 37 on the quantum axis when each axis is considered separately. Given that the search strings were specifically designed to capture this intersection, this result is unlikely to be a methodological artifact and is consistent with a genuine gap within the sources reviewed, although the authors acknowledge that a broader or differently constructed search could yield a modestly different figure (see Section 6.1, Limitations). Table 6 quantifies the gaps in the corpus.

Figure 4. Thematic co-occurrence map of the corpus (n = 116). Source: prepared by the authors based on the extraction matrix available in the consolidated Zenodo repository (https://doi.org/10.5281/zenodo.21294852).

Table 6. Thematic gaps in the corpus (percentage of studies without coverage).

Dimension	With Coverage	Without Coverage	Gap (%)
Cybersecurity	116 (100%)	0 (0%)	0.0%—universal axis.
Critical Infrastructure	76 (65.5%)	40 (34.5%)	34.5%
Cyber-Physical Systems	62 (53.4%)	54 (46.6%)	46.6%
Quantum	37 (31.9%)	79 (68.1%)	68.1%—significant gap.
Framework	33 (28.4%)	83 (71.6%)	71.6%—high gap.
Standard	27 (23.3%)	89 (76.7%)	76.7%—high gap.
Ontology	21 (18.1%)	95 (81.9%)	81.9%—Critical Gap.

Source: prepared by the authors based on the extraction matrix available in the consolidated Zenodo repository (https://doi.org/10.5281/zenodo.21294852).

The ontology × quantum cell records n = 0, indicating that, within this corpus, the simultaneous integration of both dimensions in the context of CPS and CI has not yet emerged as a line of research.

From the systematic analysis of the corpus, five findings were derived:

H1. Ontological gap. Only 18.1% of the corpus addressed ontologies substantively (n = 21), and the ontology × quantum co-occurrence in CPS and CI recorded n = 0. This gap was quantified across the 116 primary articles analyzed, indicating that, within the scope of this review, the QOCEM requirements had to be built through the cross-synthesis of research lines that had so far advanced independently.

H2. A rapidly expanding quantum field. The quantum dimension reached 31.9% of the corpus (n = 37), with publications along the quantum axis increasing from 5 studies in 2023 to 28 in the 2024–2025 biennium, coinciding with the publication of the FIPS standards in 2024 [10]. The scientific response, although accelerated, appeared fragmented and showed limited systemic articulation within the reviewed literature.

H3. Regulatory fragmentation without semantic evaluation. A total of 76.7% of the corpus did not address operational standards (IEC 62443 [29,30], NIST SP 800-82 Rev. 3 [31], NERC CIP [32]) substantively, and none of the studies reviewed proposed a mechanism to semantically evaluate the alignment of a reference model with those frameworks together with the new PQC standards.

H4. Empirical validation deficit. A total of 50.9% of the corpus provided evidence on the empirical validation dimension (n = 59). Research in the domain was predominantly propositional, oriented toward designing models, but less frequently validated under real operational conditions.

H5. Regional distribution. The corpus brought together scientific output from 38 countries, reflecting the global nature of the analyzed domain. The United States (n = 18; 15.5%) and India (n = 15; 12.9%) accounted for the largest output, followed by the United Kingdom (n = 8; 6.9%). Colombia, Greece, Germany, and Italy shared fourth place (n = 5; 4.3% each). In the Latin American context, Colombia was the most represented country in the analyzed corpus, with contributions derived mainly from the accumulated trajectory of the GTI Group at the Universidad del Cauca [27,28,33,34] and the In2Lab Group at the Universidad de Antioquia.

4.3. Answers to the Research Questions

P1. What are the main cybersecurity standards and frameworks for CPS and CI? With n = 108 studies (93.1%), P1 constituted the best-covered area of the corpus, reflecting that the scientific community has paid sustained attention to the regulatory field of industrial cybersecurity—although that attention has not extended to the quantum dimension with equal intensity. The analysis identified nine frameworks organized into five categories: OT/ICS regulatory (IEC 62443 [29,30], NIST SP 800-82 Rev. 3 [31], NERC CIP [32], and ISA/IEC 62443-3-3 [30]), cross-cutting (NIST CSF v2.0 and ISO/IEC 27001/27002), post-quantum (NIST FIPS 203/204/205), threat framework (MITRE ATT&CK for ICS [12,13,14]), and communications protocol (IEC 61850).

The most significant finding of P1 was not the diversity of frameworks identified but their shared limitation: only the NIST FIPS 203/204/205 standards offered full coverage of the quantum dimension, and exclusively for the cryptographic layer. Percentages reported in this subsection are computed over the n = 108 studies that provided evidence for P1, not over the full corpus of 116. The operational frameworks with the greatest presence in the corpus—IEC 62443 [29,30] (n = 42; 38.9%), NIST SP 800-82 Rev. 3 [31] (n = 38; 35.2%), and NERC CIP [32] (n = 29; 26.9%)—were developed for classical IT/OT environments and, at the time of their most recent publication, either predate or show no formal integration with the finalized post-quantum standards. In particular, NIST SP 800-82 Rev. 3 was finalized in September 2023 [31], approximately eleven months before the publication of FIPS 203/204/205 in August 2024 [10], which explains the absence of native PQC coverage rather than an incomplete or partial reference to it. None of these frameworks incorporates formal semantic evaluation mechanisms oriented toward Q-Day, which means that a CI operator applying them today obtains no assurance regarding their preparedness for the post-quantum transition.

This gap recurs across the remaining categories. The cross-cutting frameworks NIST CSF v2.0 [35] (n = 24; 22.2%) and ISO/IEC 27001/27002 [36] (n = 19; 17.6%) incorporate no quantum extension in any of their current versions. MITRE ATT&CK for ICS [12,13,14] (n = 22; 20.4%), whose strength lies in the classification of attack tactics and techniques in industrial environments, operates with an entirely classical threat taxonomy without coverage of quantum vectors. IEC 61850 [37] (n = 15; 13.9%), a critical standard for substation communications through the GOOSE, SMV, and MMS protocols, lacks quantum-resistance mechanisms in its current architecture. Table 7 summarizes the complete distribution by framework, category, quantum coverage, and corpus references.

Table 7. Predominant standards and frameworks in CPS and CI cybersecurity (P1, n = 108).

Standard/Framework	Category	Main Scope	Quantum Coverage	No. of Studies	% P1 (n = 108)	Refs.
IEC 62443	OT/ICS Regulatory.	Cybersecurity in IACS; zones and conduits.	Partial—no native PQC.	42	38.9%	[27,28,29,30,33]
NIST SP 800-82 Rev. 3	OT/ICS Regulatory.	ICS/SCADA/OT cybersecurity guidance.	Absent—finalized in September 2023, predating FIPS 203/204/205 (August 2024); no PQC integration	38	35.2%	[28,31,33]
NERC CIP	OT/ICS Regulatory.	Protection of North American electric CI.	Absent—no PQC layer.	29	26.9%	[28,32,33]
NIST CSF v2.0	Cross-cutting.	Framework: Identify, Protect, Detect, Respond, Recover.	Absent—no quantum extension.	24	22.2%	[35]
ISO/IEC 27001/27002	Cross-cutting.	ISMS—information security controls.	Absent—no quantum extension.	19	17.6%	[36]
MITRE ATT&CK for ICS	Threat Framework.	Tactics and techniques in industrial environments.	Absent—classical classification.	22	20.4%	[12,13,14]
NIST FIPS 203/204/205	Post-quantum.	ML-KEM (FIPS 203) · ML-DSA (FIPS 204) · SLH-DSA (FIPS 205)	Full—PQC Reference.	45	41.7%	[10]
IEC 61850	Protocol/ Standard.	Substation communications: GOOSE · SMV · MMS.	Absent—no native quantum resistance.	15	13.9%	[37]
ISA/IEC 62443-3-3	OT/ICS Regulatory.	Security requirements for IACS; levels SL-1 to SL-4.	Partial—no formal quantum extension.	18	16.7%	[28,30]

Source: prepared by the authors based on the extraction matrix available in the consolidated Zenodo repository (https://doi.org/10.5281/zenodo.21294852).

P2. How does quantum computing affect current practices? A total of 38.8% of the corpus (n = 45) provided evidence, identifying four impact mechanisms: (i) imminent cryptographic obsolescence due to Shor’s algorithm [8] applied to RSA, ECC, and Diffie–Hellman in OT/SCADA environments; (ii) reduction in symmetric security due to Grover’s algorithm [9], which reduces AES-128 to security equivalent to 64 bits; (iii) the HNDL (Harvest Now, Decrypt Later) strategy, formally documented by national security agencies as an active adversarial practice rather than a purely theoretical scenario [19,20]; and (iv) pressure on regulatory update cycles generated by the publication of the FIPS standards in 2024 [10], with no formal integration into OT/ICS frameworks as yet.

P3. What emerging quantum vulnerabilities affect CPS and CI? A total of 40.5% of the corpus (n = 47) provided evidence, enabling the inductive identification of seven categories of emerging quantum vulnerabilities, presented in Table 8.

Table 8. Emerging quantum vulnerabilities in CPS/CI (P3, n = 47).

Category	Affected System/Protocol	Mechanism
Asymmetric cryptography break	RSA, ECC, Diffie–Hellman in OT/SCADA.	Shor’s algorithm.
Symmetric security reduction	AES-128, 3DES in industrial protocols.	Grover’s algorithm.
HNDL—Harvest Now, Decrypt Later	SCADA telemetry, encrypted process data.	Mass storage for future decryption.
Legacy Modbus/DNP3 vulnerabilities	PLCs/RTUs without quantum authentication.	Command injection following authentication break.
Industrial PKI compromise	X.509 certificates in OT/SCADA networks.	Shor invalidates RSA/ECDSA certificate signatures.
Attacks on poorly implemented QKD	QKD in microgrids and CPS.	Side-channel attacks on implementations.
Long-term key obsolescence	SCADA with life cycle > 10 years	Keys compromisable before normal rotation.

Source: prepared by the authors based on the extraction matrix available in the consolidated Zenodo repository (https://doi.org/10.5281/zenodo.21294852).

The three categories of greatest operational risk were the breaking of asymmetric cryptography, HNDL [19,20], and long-term key obsolescence—the latter being especially critical for CI with industrial life cycles exceeding twenty years [27,33].

P4. What are the key requirements for the QOCEM? With n = 106 studies (91.4%), P4 recorded the second-highest coverage. However, only 18.1% (n = 21) addressed ontologies substantively, which meant that the requirements had to be constructed through the cross-synthesis of partial evidence. Table 9a presents the seven derived requirements.

Table 9. (a): Key requirements for the QOCEM (P4, n = 106). (b): Requirements traceability matrix (P4, n = 106).

(a)
Requirement		Description		Priority
Semantic formalization		Represent CPS/CI cybersecurity concepts through OWL 2/RDF with automated reasoning.		High
Classical regulatory alignment		Semantically map IEC 62443, NIST SP 800-82 Rev. 3, and NERC CIP onto the evaluated model.		High
Post-quantum regulatory alignment		Integrate FIPS 203/204/205 as an evaluation dimension for the cryptographic layer.		High
Inconsistency detection		Identify terminological contradictions among standards through OWL 2 axioms (HermiT, Pellet).		High
Semantic interoperability		Be interoperable with UCO, STIX 2.1, and MITRE ATT&CK for ICS through ontological alignment.		Medium
Component-based evaluation		Evaluate each layer of the model independently: network, cryptography, authentication, key management.		High
Empirical validation in real CI		Validate in at least one real CI domain with verifiable metrics		Medium
(b)
QOCEM Requirement	Evidence Source IDs (n)	Related Standard(s)	Evidence Type	Evidence Strength
Semantic formalization	IDs 21, 25, 40, 45, 46, 47, 48, 49, 50, 51, 53, 55, 59, 60, 61, 62, 63, 64, 67, 72, 109 (n = 21)	OWL 2/RDF, STIX 2.1, UCO	Theoretical	Medium
Classical regulatory alignment	IDs 14, 15, 19, 21, 28, 33, 34, 35, 39, 40, 41, 45, 46, 47, 52, 53, 56, 57, 59, 62, 68 (n = 21)	IEC 62443 [29,30], NIST SP 800-82 Rev. 3 [31], NERC CIP [32]	Standard-based	High
Post-quantum regulatory alignment	IDs 43, 44, 69, 70, 100, 112 (n = 6)	FIPS 203/204/205 [10]	Standard-based	High
Inconsistency detection	IDs 45, 46, 48 (n = 3)	OWL 2 reasoners, SWRL/SPARQL	Theoretical	Low
Semantic interoperability	IDs 46, 47, 61, 62 (n = 4)	UCO, STIX 2.1, MITRE ATT&CK for ICS [13]	Theoretical	Medium
Component-based evaluation	IDs 19, 28, 34, 39, 43, 44, 52, 56, 59, 62, 69, 70, 100, 112 (n = 14)	IEC 62443 [29,30], NIST SP 800-82 Rev. 3 [31]	Standard-based	High
Empirical validation in real CI	n = 59 (full ID list available in the consolidated Zenodo repository)	CI case-study metrics	Empirical (general); ontology-specific validation remains scarce (5 of 26 comparative studies; see Table 10, D6)	Medium (general)/Low (ontology-specific)

Source: prepared by the authors based on the extraction matrix available in the consolidated Zenodo repository (https://doi.org/10.5281/zenodo.21294852). The ID-to-requirement assignment was derived from logical combinations of the thematic coding in the extraction matrix (e.g., Standard = 1 AND Quantum = 1 for post-quantum regulatory alignment), complemented by full-text verification for the two smallest categories (inconsistency detection and semantic interoperability). Source: prepared by the authors based on the extraction matrix available in the consolidated Zenodo repository (https://doi.org/10.5281/zenodo.21294852).

Within the corpus analysed in this review, no study proposed in the ontological literature on CPS and CI was identified in this review; no study in the corpus proposed a formal mechanism to semantically evaluate the post-quantum readiness of an industrial reference model, which represents a distinctive contribution of the proposed QOCEM within the scope of the studies reviewed. The empirical validation requirement was the one with the lowest coverage among the four objective dimensions mapped in the corpus (50.9%; n = 59) and is regarded by the authors as the most decisive for establishing the practical utility of the instrument. Table 9b traces each requirement back to the specific studies that support it, together with the related standards, the type of evidence, and the strength of the available support.

P5. What differences exist between traditional and ontological models in the face of quantum attacks? A total of 57.8% of the corpus (n = 67) provided evidence to answer this question. The seven comparison dimensions emerged inductively from the thematic analysis of the corpus, following the approach stated in Section 3.4, without having been predefined in the extraction matrix. Their identification responds to the recurring patterns observed in the literature when contrasting the capabilities described for each type of model in the context of CPS and CI in the face of quantum threats. Table 10 presents the seven dimensions, together with the model that reported the greatest documented capabilities in each case, the number of studies supporting them, and the nature of the evidence underpinning them.

Table 10. Emerging comparison dimensions between ontological and traditional models (P5, n = 67).

	Dimension	Model with Greater Capabilities	No. of Studies	Basis
D1	Knowledge representation	Ontological—OWL 2/RDF with logical axioms vs. static taxonomies.	59	Theoretical
D2	Inconsistency detection	Ontological—automated with HermiT/Pellet reasoners vs. manual.	8	Theoretical
D3	Quantum threat coverage	Ontological—extensible with PQC modules vs. absent in current frameworks.	30	Theoretical
D4	Interoperability among standards	Ontological—semantic, with SPARQL vs. manual translation.	10	Theoretical
D5	Reasoning capability	Ontological—inference over implicit relations vs. explicit rules.	16	Theoretical
D6	Empirical validation in CPS and CI	Traditional—21 of the 26 studies with validation are traditional; only 5 are ontological.	26	Empirical
D7	Ease of implementation.	Traditional—greater operational maturity and lower adoption curve	15 ★	Theoretical

★ Includes IDs 54, 68, and 74, assigned through content review by the three researchers. Source: prepared by the authors based on the extraction matrix available in the consolidated Zenodo repository (https://doi.org/10.5281/zenodo.21294852).

The analysis of the corpus made it possible to characterize the functional capabilities documented in the literature for each type of model. In five of the seven dimensions—knowledge representation (n = 59), quantum threat coverage (n = 30), reasoning capability (n = 16), inconsistency detection (n = 8), and interoperability among standards (n = 10)—the studies reported greater capabilities for ontological models. It is important to specify that this comparison is based on the functional capabilities described in the analyzed literature and not on empirical studies that have directly confronted both types of models under equivalent operational conditions; consequently, these five results must be interpreted as a synthesis of the theoretical and technical capabilities documented in the corpus, not as an empirical validation of superiority in real environments.

In the two remaining dimensions, traditional models reported greater capabilities. Empirical validation in CPS and CI constitutes the only direct empirical finding of the corpus in this comparison: of the 26 studies in the comparative subset that report validation in real environments, 21 correspond to traditional models and only 5 to ontological approaches, confirming that ontological models are predominantly propositional within this corpus. At the scale of the complete corpus, barely 21 studies (18.1%) address the ontological axis, which gauges the magnitude of the gap. Ease of implementation and operational adoption (n = 15) represents the second dimension favoring traditional models, supported by their greater technological maturity and the lower adoption curve they require in industrial environments, in contrast to ontological models, which require OWL reasoner infrastructure and specialized competencies for their deployment. It should be noted that three studies in this dimension—IDs 54, 68, and 74, available in the consolidated Zenodo repository (https://doi.org/10.5281/zenodo.21294852)—were assigned through content review by the three researchers, upon verifying that they apply traditional risk-evaluation methodologies in CPS and CI without the framework thematic axis being explicitly marked in the extraction matrix.

Both gaps—empirical validation and implementation—precisely delimit the contribution space of the QOCEM: an instrument that must demonstrate not only technical superiority in formal capabilities, but also verifiable operational viability in at least one real CI domain.

Table 11 summarizes the answers to the five research questions, articulating for each one the empirical support, the central finding, the identified gap, and the specific contribution to the QOCEM. Considered as a whole, the corpus evidence suggests a clear diagnosis: the field possesses solid regulatory frameworks and a growing understanding of quantum threats, but appears to lack, within the reviewed literature, semantic instruments that connect both dimensions in a formal evaluation process. That is precisely the space the QOCEM proposes to occupy.

Table 11. Synthesis of answers to the research questions.

Question	n (%)	Central Finding	Identified Gap	Contribution to the QOCEM
P1— Standards	108 (93.1%)	IEC 62443, NIST SP 800-82, and NERC CIP dominate; FIPS 203/204/205 as an emerging PQC reference.	No framework natively integrates PQC into OT/ICS.	The QOCEM semantically maps current frameworks + FIPS PQC
P2— Quantum	45 (38.8%)	Shor/Grover, HNDL, and cryptographic obsolescence are the documented vectors.	Only FIPS responds; no formal integration into OT frameworks.	The QOCEM evaluates the cryptographic layer against quantum algorithms.
P3— Vulnerabilities	47 (40.5%)	Seven categories: asymmetric break, HNDL, Modbus/DNP3, PKI, and deficient QKD lead the risk.	No ontological catalog of quantum vulnerabilities for OT.	The QOCEM includes a quantum exposure dimension by protocol.
P4— QOCEM reqs.	106 (91.4%)	Seven requirements; PQC alignment and empirical validation are the least covered; ontology × quantum = n = 0.	No QOCEM specific to CPS/CI in the literature.	Define the scope, structure, and requirements of QOCEM.
P5— Ontology. vs. Traditional	67 (57.8%)	Ontological models surpass traditional ones in 5 of 7 dimensions; deficit in empirical validation.	No ontological model validated in real CI with a quantum dimension; traditional models show greater implementation maturity.	Justifies the ontological approach and defines the differential advantage of the QOCEM.

Source: prepared by the authors based on the extraction matrix available in the consolidated Zenodo repository (https://doi.org/10.5281/zenodo.21294852).

5. Discussion

The results presented in the previous section did not constitute merely a bibliometric inventory of the field, but rather the diagnosis of a domain that has accumulated a solid base of knowledge on classical threats and regulatory frameworks, yet has faced a twofold pressure that this base was not in a position to resolve on its own: the accelerated maturation of quantum computing and the inadequacy of the available formal evaluation mechanisms.

5.1. The Ontological Gap: An Unoccupied Space

The most compelling finding of the review was also the simplest to state: of the 116 primary studies analyzed, none simultaneously integrated ontologies, CPS and CI, and the quantum era (n = 0). Given that the search strings were specifically designed to capture this intersection, this absence does not appear to stem from insufficient search coverage but rather reflects the state of the field as observed within the reviewed corpus. Figure 5 illustrates this triple intersection and the magnitude of the identified gap.

Figure 5. Triple thematic intersection of the corpus. Source: prepared by the authors based on the extraction matrix available in the consolidated Zenodo repository (https://doi.org/10.5281/zenodo.21294852).

The most widely adopted cybersecurity ontologies—such as COMAT [12] and MITRE ATT&CK for ICS [13]—were built to solve semantic interoperability problems in classical IT/OT domains, without contemplating the quantum dimension. Research on PQC and quantum threats, in turn, emerged and grew in parallel, concentrated on implementations for resource-constrained environments [22] and on the regulatory analysis of Q-Day for critical sectors [21]. The two communities advanced independently throughout the reviewed period, with no work bridging them in the specific context of CPS and CI within the corpus analyzed. This absence meant that CI operators lacked a formal instrument to assess whether their reference models were genuinely prepared to withstand quantum threats. Within the scope of this review, the QOCEM represents a systematic approach aimed at closing this gap in a verifiable and replicable manner.

5.2. The Quantum Field: Real Speed, Fragmented Response

The increase in publications on quantum cybersecurity applied to CPS and CI, which rose from 5 studies in 2023 to 28 in the 2024–2025 biennium, confirmed that the topic transitioned from academic speculation to applied research with concrete operational implications. However, the speed of this response contrasted with its fragmentation. The contributions identified in the corpus were concentrated in specific technical solutions: PQC cryptographic primitives for SCADA [22], multi-stage quantum-resistant frameworks [23], and quantum-resistant architectures for industrial networks. Each was valuable within its own scope, but none offered the systemic perspective needed to assess whether a complete reference model—with all its protection layers, regulatory links, and authentication mechanisms—was prepared for the post-quantum transition. A CI operator who had attempted to answer that question using the available literature would not have found a unified instrument, but rather a mosaic of partial solutions that were not articulated with one another. The QOCEM was conceived precisely to provide that integrative instrument.

5.3. Regulatory Frameworks and Q-Day: The Urgency of Semantic Updating

IEC 62443, NIST SP 800-82 Rev. 3, and NERC CIP proved to be robust instruments for managing cybersecurity in industrial environments within the classical domain, but analysis of the corpus showed that none of these frameworks contemplated mechanisms to assess the readiness of a reference model against quantum threats. The problem did not lie in an isolated omission, but in a structural limitation: the post-quantum transition did not constitute a patch on the cryptographic layer, but rather a transformation that simultaneously affected multiple layers of the reference model, as illustrated in Figure 6.

Figure 6. Layers of the reference model affected by the post-quantum transition. Source: prepared by the authors based on the extraction matrix available in the consolidated Zenodo repository (https://doi.org/10.5281/zenodo.21294852).

Evaluating this transformation through compliance checklists or maturity frameworks proved insufficient, given that these instruments verified the presence or absence of predefined controls but could not reason about the relationships among them, nor detect inconsistencies arising from the coexistence of classical and post-quantum standards within the same model. This twofold gap—both regulatory and semantic—constituted the most precise technical argument justifying the development of the QOCEM.

5.4. Implications for the Actors in the Field

The findings had differentiated implications for three types of actors, as synthesized in Figure 7.

Figure 7. Implications of the review findings for the three main stakeholder groups (CI operators, standards developers, and researchers). The reference to active Harvest-Now-Decrypt-Later (HNDL) exposure in the “CI Operators” column corresponds to Amador-Donado et al. [33,34]. n = 116 primary studies (2020–2026). CI: Critical Infrastructure; CPS: Cyber-Physical Systems; PQC: Post-Quantum Cryptography; HNDL: Harvest Now, Decrypt Later. Source: prepared by the authors based on the extraction matrix available in the consolidated Zenodo repository (https://doi.org/10.5281/zenodo.21294852).

For CI operators: current cybersecurity reference models have not been formally evaluated against quantum threats, and the HNDL strategy has transformed this deficit into a present operational risk [19,20]. Telemetry data encrypted with RSA-2048 or ECC-256 may already be being stored for future decryption; for installations whose assets have life cycles extending beyond the PQC migration horizon (2030–2035, according to the transition timelines issued by NIST, BSI, and NCSC [5,6,7]), this threat was operationally probable. For standards developers: IEC 62443, NIST SP 800-82 Rev. 3, and NERC CIP require specific extensions that address quantum resistance with verifiable metrics across all layers—such as authentication, key management, access control, and field protocols—not only in the cryptographic layer. For researchers: findings H1 and H4 delimited two verifiable priorities: the development of evaluation ontologies with a quantum dimension for CPS and CI, whose co-occurrence recorded n = 0 in the corpus, and the production of case studies that empirically validate these instruments in real environments—a space that the 50.9% coverage of the empirical validation dimension confirmed as one of the most significant deficits and the field’s opportunity for original contribution.

5.5. Threats to Validity

Following the taxonomy of Wohlin et al. [38], threats were identified and mitigated across four categories of validity.

Construct validity. The intersection of four thematic dimensions may have favored technical-regulatory approaches over organizational perspectives; this threat was mitigated by validating the questions with the FINER criteria [18] and the PICOC framework, without restrictions on the methodological approach of the includable studies. In addition, post-quantum terminology was not fully stabilized during the analyzed period—post-quantum, quantum-resilient, quantum-safe, and quantum-resistant were used interchangeably in the literature—as a mitigation measure, the main terminological variants were incorporated, and a pilot test was conducted in each source prior to the definitive search.

Internal validity. The CRRC threshold of ≥3.2 led to the exclusion of 17 studies with possible contributions to minority dimensions of the corpus; this threat was mitigated through individual review by consensus of the three researchers for all cases in the 2.1–3.1 range. It is further acknowledged that three of the groups whose publications form part of the corpus [27,28,33,34] correspond to the authors’ affiliation groups; their inclusion was independently verified and responded exclusively to the IC/EC of the protocol. In particular, reference [27] does not introduce circularity into the findings: that study did not address the ontological axis and therefore did not contribute to the ontology × quantum cell (n = 0) or to the derivation of the QOCEM requirements, which constitute the central contributions of this work. Its relationship to and differentiation from the present article are detailed in Section 2.

External validity. The restriction to English-language publications (EC5) may have excluded relevant contributions in Spanish, Portuguese, German, or Mandarin; this limitation is acknowledged as inherent to the protocol and is partially offset by the international breadth of the corpus, which spans 38 countries. In addition, Grey Literature was incorporated as a complementary source to mitigate publication bias, contributing 20 studies to the corpus. The closing of the search in January 2026 implies that subsequent scientific output is not represented, although the structural findings regarding the ontological gap do not depend on that temporal margin.

Conclusion validity. The binary coding did not capture the intensity with which each study addressed each thematic axis; this limitation was mitigated through the parallel recording of qualitative narrative contributions and the resolution of ambiguities by consensus among the three researchers. The protocol did not provide for the systematic recording of individual decisions prior to consensus, which precludes the retrospective calculation of Cohen’s kappa coefficient. As an alternative indicator of internal consistency, the mean CRRC score reached 3.54/4.0, reflecting a comparable quality profile across the six data sources that contributed primary studies, despite their uneven volume of contributions (Table 5), and the exclusion rate at the quality stage was 12.8% (17 of 133 studies).

6. Conclusions

This systematic literature review analyzed 116 primary studies published between 2020 and 2026, with a mean CRRC quality score of 3.54/4.0, providing, to the best of the authors’ systematic search, a traceable and quality-verified corpus on ontological cybersecurity in CPS and CI in the face of quantum threats. The results allow conclusions grounded in the evidence of the corpus to be formulated. The most significant gap identified within the reviewed corpus was quantified through the co-occurrence analysis: the simultaneous integration of ontology, CPS and CI, and the quantum era recorded n =  0 across the 116 primary studies (0% of the corpus). This result did not stem from limitations in the search strings—specifically designed to capture that intersection across seven data sources—but reflects the actual state of the literature within the scope of this review. The most widely adopted cybersecurity ontologies were built to address semantic interoperability in classical IT/OT domains, advancing in parallel with research on quantum threats, with no work bridging both lines in the specific context of CPS and CI. This structural disconnection—evidenced by the co-occurrence analysis of the reviewed corpus—constitutes the central argument justifying the QOCEM as an integrative instrument.

The corpus evidenced a genuine acceleration of the scientific response to Q-Day: 69.8% of the studies were concentrated in 2024 and 2025 (n  =  81), with publications along the quantum axis increasing from 5 studies in 2023 to 28 in that biennium, driven by the publication of the NIST FIPS 203, FIPS 204, and FIPS 205 standards in 2024 [10]. However, this acceleration did not translate into systemic evaluation instruments. The contributions identified were concentrated in specific technical solutions—PQC cryptographic primitives for SCADA [22], multi-stage quantum-resistant frameworks [23], and regulatory analyses of Q-Day in CI [21]—none of which offered a formal ontological mechanism to assess whether a complete reference model is prepared for the post-quantum transition. The HNDL strategy, formally acknowledged by national security agencies as an active adversarial practice rather than a purely theoretical scenario [19,20], confirms that this evaluation cannot be postponed.

The analysis of standards, supported by n  = 108 studies (93.1%), revealed that IEC 62443 [29,30], NIST SP 800-82 Rev. 3 [31], and NERC CIP [32] exhibit partial or no coverage of quantum threats, and that 76.7% of the corpus did not address them substantively. No study in the corpus proposed a mechanism to semantically evaluate the alignment of a reference model with those regulatory frameworks together with the PQC standards. NIST SP 800-82 Rev. 3 was finalized in September 2023—approximately eleven months before the publication of FIPS 203/204/205 in August 2024 [10]—which explains the absence of native PQC coverage as a structural temporal limitation rather than an omission. The coexistence of classical and post-quantum standards within the same industrial reference model generates inconsistencies that current instruments—based on checklists or maturity levels—are not in a position to detect. The seven requirements derived from the corpus for the QOCEM—semantic formalization, classical and post-quantum regulatory alignment, inconsistency detection, semantic interoperability, component-based evaluation, and empirical validation—respond directly to this structural limitation and are supported by the evidence of 106 primary studies (91.4%), as traced in the requirements traceability matrix (Table 9b).

The comparison between ontological and traditional models, supported by n  =  67 studies (57.8%), showed that in five of the seven emerging dimensions—knowledge representation, inconsistency detection, quantum threat coverage, interoperability among standards, and reasoning capability—the literature reports greater functional capabilities for ontological models. This comparison is based on theoretical capabilities described in the literature and not on direct comparative empirical studies; these five results must therefore be interpreted as a synthesis of documented formal capabilities, not as an empirically validated claim of superiority in operational environments. The dimension in which traditional models reported greater capabilities was empirical validation in real environments: of the 26 studies in the comparative subset reporting validation, 21 correspond to traditional models and only 5 to ontological approaches. This deficit is reflected in the 50.9% coverage of the empirical validation dimension in the corpus (project objective PO4; n =  59)—the lowest among the four objective dimensions mapped—precisely delineating the most urgent contribution space for the subsequent experimental phases of the QOCEM project.

The question guiding this work—what are the requirements for an ontological evaluation model capable of identifying opportunities for improving the cybersecurity of CPS and CI in the face of emerging quantum threats?—found an articulated answer across four complementary perspectives grounded in the corpus. From the regulatory perspective, IEC 62443, NIST SP 800-82 Rev. 3, and NERC CIP require semantic extension to incorporate the FIPS 203/204/205 standards as an evaluation dimension for the cryptographic layer and for the authentication, key management, and access control layers. From the technical perspective, the legacy protocols Modbus, DNP3, and IEC 60870-5-104 emerged as the vectors of greatest quantum vulnerability in CPS and CI, particularly in installations with life cycles exceeding twenty years. From the methodological perspective, the corpus yielded seven key requirements structured into two priority levels—post-quantum regulatory alignment and empirical validation being those with the lowest coverage in the existing literature, as documented in Table 9b. From the comparative perspective, the corpus findings support the ontological approach in five of the seven analyzed dimensions, justifying its adoption over risk taxonomies or organizational maturity frameworks, without overlooking the empirical validation gap that the QOCEM itself proposes to close. Within the scope of this review, the QOCEM does not constitute the closure of this line of research, but rather its formal point of departure toward empirical validation in real industrial environments.

6.1. Limitations

Like any systematic review, this work operates within methodological boundaries that should be made explicit. The restriction to English-language publications from the 2020–2026 period may have excluded relevant contributions in Spanish, Portuguese, German, and Mandarin—languages with growing output in industrial cybersecurity—and the temporal cut-off in January 2026 may have underestimated the field’s actual growth rate during its phase of greatest acceleration. The CRRC instrument, although applied with explicit criteria and resolved by consensus among the three researchers, does not entirely eliminate the element of interpretive judgment inherent to any quality assessment. Finally, the binary coding of the extraction matrix recorded the presence or absence of a thematic axis, but not the depth with which each study addressed it; a graded coding scheme might identify studies that touch on the ontological and quantum dimensions in a partial or tangential manner, which the binary criterion classifies as absent. Even under such a scheme, however, all indications suggest that the co-occurrence would remain marginal, without altering the central conclusion regarding the magnitude of the identified gap.

6.2. Future Research Agenda

The findings not only describe the state of the field but also precisely delineate the actions that would advance it. In the short term, the most urgent step is the design and formalization of the QOCEM itself (LA1): the seven requirements derived from the corpus constitute its initial specification, but their realization in an OWL 2 ontology with verifiable reasoners requires a knowledge-engineering effort that remains pending. In the medium term, three lines run in parallel: the empirical validation of the QOCEM in at least one real CI with verifiable metrics (LA2), whose absence represents one of the field’s most significant deficits according to the analysis of the empirical validation dimension of the corpus; the extension of the model to incorporate the FIPS 203/204/205 standards as an evaluation dimension for the cryptographic layer (LA3); and the construction of an ontological taxonomy of quantum vulnerabilities specific to OT/ICS environments (LA4), which the corpus identified as an unaddressed void. In the long term, the QOCEM will need to be tested comparatively against established instruments such as C2M2, CMMI-OT, and TRACI [25] (LA5), and the SLR protocol will need to be replicated with explicit coverage of Ibero-American sources to offset the linguistic bias identified as a limitation (LA6). The complete description of each line—objectives, achievement indicators, time horizon, and linkage to the corpus findings—is presented in the consolidated Zenodo repository associated with the manuscript (https://doi.org/10.5281/zenodo.21294852).