The Anatomy of a Good Concept: A Systematic Review on Cyber Supply Chain Risk Management

Abstract

As contemporary global supply chains have become interconnected and exposed to diverse escalating cyber threats, Cyber Supply Chain Risk Management (C-SCRM) has rapidly evolved as a managerial imperative to safeguard security, robustness, and resilience, and hence ensure organizational sustainability and growth. While the concept of C-SCRM has recently received much attention among scholars, practitioners, and policymakers as an emerging field of study, its conceptual utility and theoretical foundation remain undeveloped. To address this gap, this paper provides a systematic literature review of C-SCRM using a hybrid approach that integrates bibliometric and concept evaluation analysis to ensure the goodness of the concept. A total of 175 relevant peer-reviewed scholarly articles from the Web of Science (WOS) Core Collection were collected and analyzed. The review reveals that the concept has many strengths, in terms of its interdisciplinary conceptual foundation and growing managerial relevance, but it also suffers from conceptual diffusion, overlapping terminology, and limited construct operationalization that inhibits theory development, hinders empirical accumulation, and limits practitioners’ ability to operationalize C-SCRM as a strategic resource. This review contributes to the C-SCRM literature by providing (1) a historical overview and intellectual structure of C-SCRM; (2) a synthesis and comparative analysis of the existing definitions; (3) an evaluation of the conceptual adequacy and theoretical relevance that underpin C-SCRM research based on established criteria and (4) conceptual and empirical research directions as well as an integrative framework. Based on the insights, our review might facilitate the improvement of multidimensional construct clarity and validation in future empirical studies and could be a useful tool for managers to benchmark C-SCRM maturity in practice.

1. Introduction

Have you ever heard about the global outage that occurred on 19 July 2024? Maybe you have heard about the disruptive event caused by the technical malfunction in CrowdStrike’s Falcon sensor software in the global news, which affected millions of devices and disrupted essential services across critical sectors [1,2]. The consequences of this global disruption were immediate and extensive, including, but not limited to, flight cancellations and delays in the airline industry, operational downtime in the banking sector, and service degradation in the telecommunications sector [2]. Beyond their immediate and extensive disruptions, these cyber incidents raise an important and intriguing question about the necessity of managing such cascading cyber risks throughout complex, volatile, and interconnected digital ecosystems [3].

In fact, today’s contemporary organizations have been operating within digital networks characterized by their interdependences, including firms, customers, developers, and suppliers, rather than through traditional linear buyer–supplier relationships [4]. These interconnected digital networks have also been known as cyber supply chain (C-SC) ecosystems, whereby diverse actors in the supply chain were more likely to generate innovation and new services through collaboration and value exchange [4,5,6]. In contrast, the heavy reliance on C-SCs has increased organizations’ exposures to diverse cyber risks [7]. As a result, these cyber risks jeopardize the integrity, confidentiality, and availability of supply chain assets, including systems and data beyond the focal organization, encompassing other stakeholders throughout the global supply chain network [7,8,9]. Accordingly, dealing with these risks no longer becomes a source of competitive advantage, but it has become a strategic necessity for business survival and growth [5].

The concept of C-SCRM has recently attracted scholarly attention that traces back to the original conceptual works by [10,11], who developed the strategic approach to managing cyber risks across the entire supply chain network. Since then, the concept C-SCRM has evolved into a multidisciplinary novel research domain, drawing from multiple disciplines, including engineering, management science, operations research, and others [12]. In this regard, some empirical studies reveal that C-SCRM practices achieve positive outcomes at multiple levels. At the organization level, one stream of studies found that effective practices were associated with enhanced financial and non-financial performance [3] and improved organizational resilience [13,14]. Another stream at the network level found that C-SCRM was associated with improved supply chain visibility, integration, and resilience [7,14,15,16] as well as strengthened internal security, external security, and overall supply chain performance [17]. However, to date, research on C-SCRM definitions, practices, antecedents, and outcomes remains fragmented and limited [3,5,18]. Several research gaps in the extant literature motivate this study to proceed.

First, prior research highlighted the absence of a unified and coherent concept of C-SCRM. Namely, scholars used a variety of interchangeable and overlapping terms in the existing literature to explore the phenomenon of interest including but not limited to cyber supply chain risk management (C-SCRM) [10,17,19,20], cyber supply chain security practices [21], cyber risk management in supply chain(CRM) [15], cyber-risks management in logistics firms for supply chain social sustainability [22], managing cyber risks in the supply chain [23,24], cybersecurity in supply chains [4,12,25], collaborative cybersecurity management capabilities along the supply chain [8], cybersecurity across the supply chain [26], cybersecurity risk management in supply chains [27], cybersecurity supply chain risk management [3], Supply chain cyber resilience/cyber resilience in supply chains [7,14], and supply chain cybersecurity management [18]. Consequently, this fragmentation and terminology inconsistency make it hard for scholars and practitioners to compare the findings across the studies and assess the coherence and maturity of the field of study [5,8,18,22,26].

Second, with respect to the authors’ best knowledge, the literature still lacks a comprehensive and theoretically grounded assessment of C-SCRM as an integrated management concept. Although there are some SLRs that examined specific isolated topics related to cyber risks in supply chains, such as cybersecurity behavior [28], information sharing [29,30], only few have explicitly addressed the conceptual adequacy, theoretical coherence and boundary conditions of an emerging construct of C-SCRM, e.g., [5,8,26]. As a result, C-SCRM still lacks an integrative framework that consolidates definitions, clarifies core attributes, and links C-SCRM to its underlying theoretical frameworks.

Third, recent years have witnessed a growing body of SLRs examining supply chain management trends and challenges, including but not limited to digitalization, resilience, sustainability, and risk management [31,32,33]. Yet, with the recent increase in academic reviews, SLRs on C-SCRM remain limited in number and demonstrate rigorous methodological shortcomings [8,26]. For instance, most prior SLRs focused on various review approaches, such as narrative or thematic synthesis, and did not systematically map the intellectual structure or the evolution of the field or provide an integrative framework, e.g., [5,12,24]. Furthermore, several reviews relied on a relatively small number of selected articles, which might limit their ability to capture the breadth and interdisciplinary nature of C-SCRM, e.g., [5,18,24]. Furthermore, scholars have increasingly called to adopt diverse science mapping techniques such as bibliometric methods besides SLRs to consolidate fragmented knowledge and advance cumulative academic discourse [26,32,34,35].

To fill these notable gaps and respond to prior calls, this review aims to synthesize and assess the concept of C-SCRM based on 175 articles published from 2014 to early 2025. This review addresses four research questions:

RQ1: How has C-SCRM research evolved in terms of bibliometric features, publication trends, and citation dynamics?

RQ2: How has C-SCRM conceptualization evolved in terms of the key intellectual and disciplinary perspectives?

RQ3: How has the conceptual adequacy of C-SCRM been assessed, and to what extent is the concept theoretically coherent?

RQ4: How could we advance the conceptual clarity of C-SCRM?

In doing so, this study can contribute to C-SCRM literature in several ways. First, to the best of the authors’ knowledge, this review is one of the first reviews that provides a rigorous conceptual clarification of C-SCRM by systematically synthesizing and evaluating existing definitions, boundary conditions, and core attributes using ref. [36]’s criteria. Second, it provides an integrated mapping of the field’s intellectual foundations and thematic evolution by combining bibliometric techniques and co-occurrence analysis to reveal the disciplinary roots, knowledge domains, developmental phases, and dominant research streams that have shaped C-SCRM scholarship between 2014 and early 2025. Third, it proposes an organizing framework that links antecedents, practices, mechanisms, and outcomes, thereby guiding future empirical research, survey design, and theoretical advancement. Finally, it offers a road map for future empirical studies and survey design in the measurement development of C-SCRM. Finally, the findings provide evidence-based insights into both theoretical development and practical implementation of C-SCRM in management and organizational studies.

The remainder of this paper is organized as follows. The following section provides the conceptual background of C-SCRM. This is followed by the systematic review methodology in Section 3. The results and discussion of the emerging thematic and conceptual patterns will be presented in Section 4. Finally, the theoretical and practical implications, limitations, and future research directions will be provided.

2. Research Background: Setting the Conceptual Stage

C-SCRM has been an important topic of interest in multiple fields, such as supply chain management, risk management, and cybersecurity/information management [10,37]. Its conceptual developments have been extensively discussed separately, where each field offers distinct perspectives regarding how cyber risks originate, propagate, and can be mitigated across the interconnected supply chain networks [20].

Existing definitions of C-SCRM vary due to differing disciplinary perspectives. Early scholarly work in this area tended to focus on the academic definitions of C-SCRM as a novel field that integrates diverse elements, theories, and methods to strategically control critical IT systems and digital assets across the supply chain lifecycle [10,37]. Others broadened the conceptualization to include the social perspective in terms of inter-organizational coordination and integration [15,20]. Thus, the distinction between C-SCRM policies, processes, and controls of the entire supply network rather than isolated firm-level initiatives has been extensively highlighted [5,17,20].

Furthermore, practitioners play a crucial role in shaping the conceptualization of C-SCRM. For instance, the National Institute of Standards and Technology (NIST) CSF 2.0 provides an overview of C-SCRM [3].The framework has conceptualized C-SCRM as a key integral element of governance function, which has become a separate function in the risk management process [3]. NIST emphasizes that managing supply chain cyber risks requires social and technical measures in terms of executive oversight, policy alignment, and organization-wide integration, rather than a sole operational activity. Even more importantly, it was found that the terms of cybersecurity supply chain management and cyber supply chain risk management have been used interchangeably in the NIST Cybersecurity Frameworks.

Moreover,

Table 1. The most influential prior systematic literature review articles.

Authors (Year)	N	Time Span	Review Type	Search Strategy	Selection Criteria	Quality Assessment	Key Research Area	AC
[29]	NS	2003–2018	Framework-based (2W+1H: Who, What, How)	Limited	NS	NR	Information-sharing and public–private partnerships	13.5
[24]	39	1990–2017	Structured Review (no framework)	Comprehensive	ES	Basic	Cyber risk taxonomy and propagation mechanisms	45.6
[28]	NS	NS	Framework-based (ADO: Antecedents–Decisions–Outcomes)	NR	NS	NR	Employee cybersecurity behavior and organizational interests	8.5
[12]	160	2010–2019	Structured Review (no framework)	Adequate	ES	Basic	Cybersecurity countermeasures across supply chain	55.5
[18]	61	NS	Structured Review (no framework)	NR	NS	NR	Critical infrastructure supply chain security	9.5
[8]	137	2013–2022	Structured Review (no framework)	Comprehensive	ES	Basic	Collaborative cybersecurity management capabilities between firms	2.0
[5]	14	2012–2022	Framework-based (ADO)	Very Limited	NS	NR	Supply chain visibility and cybersecurity framework alignment	0.0

Note: N = total articles; NR = not reported; NS = not specified; ES = explicit specified; AC = total citations based on 2025.

shows that prior SLRs differ in their scope, time span, and methodological rigor. First, most of them employed fragmented methodologies without proposing guiding frameworks, e.g., [8,12,24]. Second, most reviews focus on specific subtopics, such as cyber risk taxonomy, countermeasures, employee behavior, or collaborative practices, rather than providing a holistic conceptual evaluation of C-SCRM as an emerging management construct. Third, although earlier reviews employ established analytical frameworks (e.g., ADO or 2W+1H), none of them provide a comprehensive conceptual assessment or integrate bibliometric or science-mapping techniques to examine the field’s intellectual structure and evolution.

As previously highlighted, the conceptualization and measurement of C-SCRM remain a core challenge, which creates critical difficulties for both researchers and practitioners. For researchers, definitional ambiguity of the concept poses difficulties for coherent theoretical building, operationalization, and comparative empirical testing of relationships. Without conceptual clarity, researchers could examine different constructs under the same label, which hinders cumulative knowledge development and integrative research streams. For practitioners, the absence of a unified measurement of C-SCRM poses substantial managerial challenges to benchmark practices, such as defining organizational roles and responsibilities, identifying effective governance mechanisms, and addressing human-resource and capability gaps across firms and industries.

In response to the above discussion, this study aims to systematically synthesize the intellectual landscape, evaluate the conceptual adequacy of existing definitions, and clarify the interdisciplinary construct’s theoretical boundaries of C-SCRM. We seek to propose a framework that could advance conceptual clarity of how C-SCRM functions as a coordinated governance and control system within digitally interconnected supply chains.

3. Methodology

This review adopted a hybrid systematic design that was selected for two primary reasons. First, prior SLRs relied on thematic or narrative methods, which have limited their ability to map the intellectual structure and structural evolution of the field (for more details, see Table 1). Second, bibliometric techniques are insufficient on their own to address the conceptual ambiguity and theoretical coherence of C-SCRM [8,32,34,35]. Therefore, this review integrates bibliometric analysis with qualitative conceptual evaluation to enhance the robustness of the findings and support a theoretically meaningful synthesis. Furthermore, it adapted the established guidelines and protocols of conducting systematic literature reviews in management, e.g., [34,38].A detailed description of the steps is presented as follows.

3.1. Data Sources and Search Strategy

This review used Web of Science (WoS) Core Collection as the primary database for conducting high-quality systematic reviews in management [38]. WoS was selected because it has been widely characterized by its rigorous selection criteria, comprehensive citation indexing, and suitability for identifying relevant articles while reducing duplication [38].

Further, a search strategy was developed using specific keywords such as “cyber supply chain risk management” and other associated terms that were derived from the existing articles. These keywords were applied to the articles’ titles and abstracts (see Figure 1). As a result, the initial search yielded 4157 documents.

3.2. Inclusion and Exclusion Criteria

Following the initial database search, several inclusion criteria were defined as proposed by [39] to ensure conceptual and methodological relevance of the selected articles (for more details, see Figure 1). Only documents that met the following criteria were considered including: (1) peer-reviewed journal articles published between 2014 and early 2025; (2) English-language publications; (3) articles with a business and management focus rather than purely technical or engineering perspectives; (4) journals in the Social Science Citation Index with impact factors ≥ 1.0; (5) journals ranked A* or A in the Australian Business Deans Council (ABDC) list. This stage resulted in 318 articles that were ready for screening.

3.3. Screening and Sample Selection

After removing records that did not meet the predefined criteria (e.g., non-journal articles, non-English publications, and records outside the time frame), the dataset of 318 articles remained for initial screening. Study selection was conducted in two main screening phases. The first one focused on screening titles, abstracts, and keywords, and non-relevant records were removed. The second involved full-text screening of all remaining articles based on conceptual alignment with our research objectives. This resulted in 175 articles, which were retained for subsequent analysis (see Figure 1).

3.4. Data Preparation and Coding

The final dataset of 175 articles that were exported from WoS in full-record format, including bibliographic information, author names and affiliations, abstracts, keywords, cited references, etc. The processed dataset was subsequently ready for subsequent data analyses.

3.5. Data Analysis Techniques

The cleaned and extracted dataset was analyzed using bibliometric and conceptual analyses. Bibliometric analysis was conducted to map and visualize the intellectual landscape and thematic structures of C-SCRM research over time. The analysis was primarily conducted using VOS viewer (version 1.6.19), which provides comprehensive bibliometric mapping and visualization of co-occurrence and citation networks [40]. To enhance methodological rigor and reduce tool-specific bias in science-mapping studies, the results were cross-validated using Biblioshiny, the web-based interface of the Bibliometrix R package 5.2.1.

In addition, conceptual analysis was conducted and presented to assess the conceptual adequacy of C-SCRM, using ref. [36]’s eight criteria: familiarity, resonance, parsimony, differentiation, coherence, field utility, theoretical utility, and depth.

4. Publication Trends and Growth

This section addresses RQ1: How has C-SCRM research evolved in terms of bibliometric features, publication trends, and citation dynamics? The annual publication counts and citation patterns were analyzed using bibliometric data extracted from Web of Science and verified using Bibliometrix R package 5.2.1 [40,41].

4.1. Temporal Evolution of C-SCRM Research

Figure 2 shows the annual distribution of C-SCRM publications and citations before applying the exclusion and inclusion criteria. It can be observed that there is a growing scholarly interest and impact over time, with a steady increase in the number of publications and citations.

Table 2. Temporal distribution of C-SCRM publications.

Phase	Years	N	%	CAGR	Key Characteristics	Research Orientations	Key Incidents
Foundational	2014–2016	2	1%	NA	Nascent	Special issue
Emerging Phase	2017–2019	20	11%	115.4%	Early expansion	Case studies	NotPetya
Expansion Phase	2020–2022	60	34%	44.2%	Methodological diversification	Practical frameworks	SolarWinds, Colonial Pipeline, Kaseya attack
Maturation Phase	+2023	93	53%	24.5%	Theoretical framework development	Cross-disciplinary integration	CrowdStrike
	Total	175	100%	-	-

Note: CAGR = Compound Annual Growth Rate calculated as percentage change from the previous period. Source: Authors’ own elaboration.

further reveals the four distinct phases in the development of C-SCRM research, which reflect the field’s maturation from a nascent conceptual idea into a multidisciplinary research domain shaped by escalating cyber incidents, digital transformation, and increasingly interconnected supply networks.

First, the foundational phase began, with two main articles published in a Technovation special issue [11]. That special issue had set the conceptual boundaries between C-SCRM and other related domains such as cybersecurity, risk management, and supply chain management [10,21]. It was found that these early works were primarily conceptual and descriptive in nature rather than empirical studies that tested specific hypotheses.

Second, the emerging phase, where articles sharply increased to 20 with a 115.4% compound annual growth rate (CAGR). This phase was marked by the 2017 NotPetya attack propagated globally through interconnected supply networks [42]. Consequently, researchers differentiated between cyber supply chain risks and traditional cybersecurity threats and supply chain disruptions [23]. It was found that most studies relied heavily on qualitative research methods, such as case studies.

Third, the expansion phase, where its articles surged to 60 with a CAGR of 44.2%. It was revealed that the annual output nearly tripled compared to the previous phase. This phase was characterized by three key factors, including COVID-19 pandemic disruptions, rapidly accelerated digital transformation initiatives, and high-profile breaches. It was found that methodological approaches in this phase were diverse, including quantitative modeling, survey-based studies, and theoretical frameworks [26].

Finally, the maturation phase, accounting for more than half of the total articles, with a CAGR of 24.5%. In this phase, researchers shifted toward more sophisticated analytical approaches, developing complex models that examine how multiple variables interact and build predictive frameworks for cyber risk assessment [3,23].

Overall, it can be concluded that C-SCRM remains an active research area, where the field is moving from exploration to theoretical refinement and integrative model development as depicted in Figure 3 and Figure 4.

4.2. Journal Distribution and Publication Landscape

There were 175 reviewed articles on C-SCRM published in 64 academic journals. We ranked journals based on total publications; those having more publications receive better rankings (see Appendix A 

Table A1. Classification of C-SCRM Research across academic fields and time.

Core Research Areas/Field	Journal	N	Foundational Phase	Emerging Phase	Expansion Phase	Maturation Phase
Supply Chain Management (N = 17)	Supply Chain Management: An International Journal	5	-	1	2	2
	International Journal of Physical Distribution & Logistics Management	2	-	2	-	-
	Transportation Research Part E: Logistics and Transportation Review	1	-	-	1	-
	Transport Policy	2	-	1	1	-
	Production and Operations Management	2	-	1	1	-
	International Journal of Production Research	2	-	2	-	-
	European Journal of Operational Research	1	-	1	-	-
	Industrial Management & Data Systems	2	-	-	-	2
Information systems (N = 115)	Computers & Security	16	-	4	12	-
	Information & Management	6	-	3	3	-
	Information Systems Frontiers	3	-	-	3	-
	Information Systems Journal	1	-	-	1	-
	Information Systems Research	1	-	-	1	-
	European Journal of Information Systems	3	-	1	2	-
	International Journal of Information Management	4	1	2	1	-
	Journal of Computer Information Systems	2	-	-	2	-
	Journal of Enterprise Information Management	4	-	1	3	-
	Journal of Information Systems	2	-	-	2	-
	Journal of Management Information Systems	3	-	-	3	-
	Journal of Organizational Computing and Electronic Commerce	2	-	1	1	-
	Journal of Strategic Information Systems	2	-	1	1	-
	Journal of the Association for Information Systems	1	-	-	1	-
	MIS Quarterly	4	-	2	2	-
	MIS Quarterly Executive	9	-	2	7	-
	Data Base for Advances in Information Systems	2	-	-	2	-
	Electronic Commerce Research	1	-	-	1	-
	Internet Research	1	-	-	1	-
	Technology in Society	8	-	-	-	8
	International Journal of Accounting Information Systems	9	1	3	5	-
	Reliability Engineering and System Safety	3	-	-	3	-
	Safety Science	2	-	1	1	-
	IEEE Transactions on Engineering Management	10	-	-	5	5
	Technovation	4	-	2	2	-
	Technological Forecasting and Social Change	6	-	3	3	-
	Industrial Management & Data Systems	2	-	-	-	2
	Journal of Innovation & Knowledge	2	-	1	1	-
	Computers in Human Behavior	2	-	-	-	2
risk management (N = 22)	Accident Analysis and Prevention	1	1	-	-	-
	Decision Analysis	2	-	1	1	-
	Decision Support Systems	2	-	-	2	-
	Finance Research Letters	2	-	-	2	-
	International Journal of Forecasting	1	-	-	1	-
	International Review of Financial Analysis	5	-	1	4	-
	Journal of Accounting and Public Policy	1	-	-	-	1
	Journal of Banking & Finance	1	-	-	1	-
	Journal of Corporate Finance	1	-	-	1	-
	Journal of Business Finance & Accounting	1	-	-	1	-
	Managerial Auditing Journal	3	-	-	3	-
	Pacific-Basin Finance Journal	1	-	-	1	-
	International Journal of Auditing	1	-	-	1	-
Others (N = 21)
Legal & Regulatory	American Business Law Journal	1	1	-	-	-
	International & Comparative Law Quarterly
Policy & International Affairs	International Affairs	6	-	-	-	6
	Journal of European Public Policy	3	-	-	-	3
	Public Administration Review	1	-	-	-	1
	Pacific Review	1	-	-	-	1
	Marine Policy	1	-	-	-	1
Business & Management	Business Strategy and the Environment	1	-	-	1	-
	Journal of Business Ethics	1	-	-	-	1
	Journal of Business and Psychology	3	-	-	-	3
	Small Business Economics	1	-	-	-	1
	Management Science	1	-	-	-	1
Knowledge Management	Knowledge Management Research & Practice	1	-	-	-	1
Total		175

Source: Authors’ own elaboration.

). We found that the top 5 include: Computers and Security (n = 15), IEEE Transactions on Engineering Management (n = 11), International Journal of Accounting Information Systems (n = 9), MIS Quarterly Executive (n = 9), Technology in Society (n = 8).

Interestingly, based on the results, Computers and Security is the most prominent journal, which reflects the established field’s strong foundational roots in cybersecurity and information assurance, whereas IEEE Transactions on Engineering Management and MIS Quarterly Executive bridge the gap between technical systems design and managerial decision-making. Further, the presence of management-oriented outlets such as Technovation, Technology in Society, and the International Journal of Information Management demonstrates a gradual shift beyond the purely technical discussions toward strategic, organizational, and policy-oriented debates

Furthermore, we classified journals based on core research areas/fields. As C-SCRM is an interdisciplinary field that draws from information systems, supply chain management, and risk management. We found that most of the articles focused on Information systems (n = 115), risk management (n = 22), and supply chain management (n = 17), respectively. This shows that the field might skew more towards the technical perspective.

4.3. Domain Mapping and Conceptual Integration

The analysis reveals that the concept C-SCRM combines three terms, including cyber, supply chain, and risk management. Hence, it represents an interdisciplinary field that integrates technical and non-technical perspectives that address cyber threats along the entire supply chain networks.

Table 3. C-SCRM Classification by Functional Domain.

Domain	N	%	Primary Focus Areas	Representative Journals
Cyber/Information Security- information systems	115	65.71%	Technical vulnerabilities, security frameworks, threat management, information protection	Computers and Security, MIS Quarterly, Information Systems Research
Supply Chain Management	17	9.71%	Network relationships, operational continuity, multi-tier supply chain management, supply chain security, robustness, and resilience	Supply Chain Management: An International Journal, Production and Operations Management
Risk Management	22	12.57%	Risk assessment methodologies, financial impacts, governance frameworks, strategic risk management	International Review of Financial Analysis, Decision Support Systems
Others	21	12.00%	Integrated approaches, policy implications, organizational perspectives	Technology in Society, International Affairs
Total	175	100%	-	-

Source: Authors’ own elaboration.

shows the conceptual domain contributions across the developmental phases to understand and reveal important insights into the field’s intellectual development. According to Table 3, the most dominant field is the cyber/information security field (n = 115, 64.6%), followed by the risk management field (n = 22, 12.57%), other fields (n = 21, 12%), and supply chain management (n = 17, 9.71%), respectively. The findings imply that scholars mainly focused on the technical perspective of investing in systems infrastructure rather than the managerial perspective of dealing with cyber risks, e.g., [43,44]. Later, scholars found that dealing with cyber risks can be recognized as a continuous risk management process to ensure organizational sustainability and resilience, especially during times of uncertainty or crises, such as the COVID-19 pandemic, e.g., [45,46]. It was found that cyber supply chain risks cannot be addressed within one-sole field. Instead, it requires joint efforts across disciplines like management, information systems, engineering, and cybersecurity, e.g., [47,48]. In contrast, the supply chain management demonstrates the least contribution to C-SCRM research compared with other fields. SCM literature primarily sheds light on key roles of visibility, integration, coordination, and interdependence to manage and mitigate cyber risks across the entire supply chain network. SCM literature has particularly emphasized how to protect interconnected supply chain actors and ensure operational continuity under cyber threats, e.g., [3,15,19,23].

4.4. Most Influential Publications

Table 4. The five top-cited articles in C-SCRM Literature.

R	Authors (Year)	Title of Article	Focus Area	TC	AC	Journal	ABDC
1	[49]	Cyber Security Awareness, Knowledge, and Behavior: A Comparative Study	Internal behavioral area	528	176.0	Journal of Computer Information Systems	A
2	[50]	Investigating the impact of cybersecurity policy awareness on employees’ cybersecurity behavior	Internal behavioral area	479	79.8	International Journal of Information Management	A*
3	[24]	Managing cyber risk in supply chains: a review and research agenda	Supply chain perspective	229	45.8	Supply Chain Management: An International Journal	A
4	[10]	Cyber supply chain risk management: Revolutionizing the strategic control of critical IT systems	Strategic integrated management framework	225	20.5	Technovation	A
5	[51]	The rise of crypto ransomware in a changing cybercrime landscape: Taxonomizing countermeasures	Technical ransomware countermeasures	189	47.3	Computers & Security	A

Note: TC = total citations; AC = Weighted Average no of citations = Total citations ÷ Current year (2025) minus year of publishing based on Google Scholar’s citations (January 2025). Source: Authors’ own elaboration.

provides the list of the most influential articles based on citation impact. The most cited papers were found to be [49,50], who suggested the behavioral perspective to deal with cyber risks and found that employee awareness training was associated with positive cybersecurity outcomes by influencing employee behavior. Another top contribution was made by [10] who introduced a two-dimensional strategic control framework for cyber defense in depth and in breadth to manage cyber risks across extended enterprise networks. Similarly, ref. [51] advocated the importance of different strategies combining technical and non-technical to address cybersecurity risks. Furthermore, ref. [52] applied simulation-based modeling to examine decision-making biases in developing cybersecurity capabilities.

The results indicate that highly cited works increasingly adopt a human-centric approach in mitigating cyber risks. These results indicate that technical measures are no longer sufficient; this supports an important integrated management thematic shift and highlights the increasing recognition of managerial and organizational measures in C-SCRM.

4.5. Most Influential Countries

There are 20 countries where 175 articles have been published. As shown in

Table 5. The five most frequently cited countries in C-SCRM research.

R	Country	N	%	Research Characteristics	Representative References
1	United States	74	42.3%	Policy-driven leadership, extensive funding	[10,21,26,28,29,30,37,42,47,50,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88]
2	United Kingdom	18	10.3%	Strong academic-industry collaboration	[18,23,24,43,44,48,51,89,90,91,92,93,94,95,96,97,98,99]
3	China	9	5.1%	Rapid growth, technical focus	[22,100,101,102,103,104,105,106,107]
4	India	6	3.4%	Emerging expertise, behavioral studies	[46,108,109,110,111,112]
5	Canada	4	2.3%	Risk management specialization	[113,114,115,116]
5	Italy	4	2.3%	Cross-disciplinary approaches	[19,117,118,119]
5	Netherlands	4	2.3%	Policy and governance focus	[120,121,122,123]

Source: Authors’ own elaboration. Note. Countries ranked by publication count among top-cited papers.

, the top five cited countries based on number of articles include the United States (n = 74), United Kingdom (n = 18), China (n = 9), India (n = 6), Canada (n = 4), Italy (n = 4), and the Netherlands (n = 4). As expected, the United States holds a dominant position in C-SCRM research, accounting for 42.3% of the total highly cited publications. This domination can be attributed to the fact of sustained policy-driven initiatives and governmental investment that have fostered extensive academic industry collaboration, particularly through frameworks such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework and the Department of Defense’s (DoD) Cybersecurity Maturity Model Certification (CMMC).

5. Conceptualization Patterns

This section addresses RQ2: How has C-SCRM conceptualization evolved in terms of key intellectual and disciplinary perspectives? This includes examining definitional trends, core attributes, conceptual adequacy, and thematic structures.

5.1. Definitional Analysis of C-SCRM Concept

Over the past years, C-SCRM has evolved into a developing field of research. The early definition of C-SCRM was proposed by [10], who conceptualized it as organizational strategies and initiatives aimed at identifying, assessing, and mitigating cyber and information risks across end-to-end supply chain operations. This definition mainly reflects that C-SCRM is no longer purely a technical measure but has also become a strategic function. Building on this foundation, ref. [37] refined the concept as a strategic process that overlaps with the term cybersecurity risk management, with its response strategies, policies, and procedures grounded in the NIST Cybersecurity Framework.

Table 6. Representative C-SCRM Definitions and Citation Impact.

Authors	Term Used	Definition	Journal	TC	Classification
[10]	Cyber supply chain risk management (C-SCRM)	Organizational strategies and programmatic activities across the entire IT system life cycle.	Technovation	239	Widely Cited
[37]	Cyber supply chain risk management (C-SCRM)	Systematic process to manage exposures to cybersecurity risks and develop appropriate response strategies, policies, and procedures.	Technovation	50	Moderately Cited
[19]	Cyber supply chain risk management (C-SCRM)	A process of extending control over cyber risks across the entire supply chain to foster continuous adaptive capacity and enhance overall resilience	Supply Chain Management: An International Journal	128	Widely Cited
[20]	Cyber supply chain risk management (C-SCRM)	A strategic approach to identify, evaluate, and mitigate potential cyber and information risks across the entire supply chain network.	Industrial Management & Data Systems	20	Moderately Cited
Others
[25]	cybersecurity within digital supply chains	Systematically mitigate cybersecurity risks in the digital supply chain	Information & Computer Security	7	Emerging
[7]	Managing cyber risks in digital supply chains	understanding and addressing supply chain cyber threats and risks by developing supply chain dynamic capabilities of how supply chains proactively sense, seize, and transform their operations to build resilience.	Supply Chain Management: An International Journal	13	Emerging
[15]	Supply Chain Cyber Risk Management (SC-CRM)	Strategies used to establish outward-oriented capabilities in an attempt to deal with supply chain cyber risks.	International Journal of Physical Distribution & Logistics Management,	11	Emerging
[26]	Cybersecurity across the supply chain	A holistic approach that integrates measures related to technology, process, and people to protect the entire network from damage, attack, or unauthorized access.	International Journal of Production Research	146	Widely cited
[3]	Cybersecurity supply chain risk management (C-SCRM)	The development of internal and external practices in managing cybersecurity risks throughout supply chains.	Supply Chain Management: An International Journal.	0	Emerging

Note: Classification based on citation thresholds: Widely cited (≥50 citations), Moderately cited (15–49 citations), Emerging (<15 citations). Source: Authors’ own elaboration.

reports a list of representative definitions in C-SCRM research to distinguish foundational contributions from more recent or less diffused conceptualizations. Based on the results, we found two dominant synthesized definitions of C-SCRM. The first definition mainly reflects a systematic process of managing exposure to cybersecurity risks. This aligns with the NIST Cybersecurity five sequential functions, including identify, protect, detect, respond, and recover, which act as a continuous lifecycle for mitigating cyber threats [15,37]. The second mainly focused on a set of practices that firms implement to manage current and potential cybersecurity risks along the supply chain network [3,10,17,20]. This practice-oriented view highlighted the role of supply chain management in terms of systems integration and visibility as key antecedents of cyber-resilient supply chains.

According to the citation-based analysis, there are three influential definitions proposed by [10,19,26], each exceeding 50 citations. These definitions conceptualize C-SCRM either as a strategic resource or an adaptive capability. In this regard, recent studies introduce emerging terms such as dynamic capabilities and digital supply ecosystems [15,25]. While these definitions remain in the early stage of scholarly diffusion, they confirm the paradigmatic shift toward more integrated and capability-oriented perspectives on C-SCRM.

5.2. Core Attributes of C-SCRM Definitions

Based on the existing definitions, the concept of C-SCRM is a multidimensional concept with several core attributes (see

Table 7. Core Attributes of C-SCRM definitions.

Aspect	Attribute	Explanation	Examples from References
Nature	Strategic approach/Programmatic activities Process	A strategic approach that aligns with broader enterprise goals.	[10,15,17]
Scope	End-to-End Supply Chain	Extends beyond internal IT systems to include the full range of supply chain partners (Tier 1, Tier 2, etc.), vendors, and service providers.	[3,20,23]
	Cyber risk management process	Identify, assess risks, and develop mitigation strategies.	[20,37]
Means	Resources/Capabilities	Adapt, respond, and recover from cyber disruptions across the supply chain.	[15,23]
Expected outcomes	Visibility, internal security, external security, resilience, robustness, financial performance	Aligns firm’s internal cybersecurity policies and external supplier or partner practices to create secure and resilient supply chain.	[3,17]

Source: Authors’ analysis based on previous definitions.

). First, all major definitions confirm that C-SCRM drew from the integration of cyber and supply chain risk management to address how cyber threats propagate through supplier networks, digital dependencies, and third-party relationships [19,23,24,26]. Second, nearly all the definitions revolved around the end-to-end supply chain scope that extends beyond internal IT systems to include external dependencies of suppliers, vendors, logistics partners, cloud service providers, third parties, and customers, which reflects a network perspective, e.g., [3,23]. Third, several definitions conceptualize C-SCRM as an enabler of resilience or a defensive risk practice. On one hand, some conceptualize C-SCRM as a dynamic capability to anticipate, withstand, recover, and adapt to cyber incidents [7]. On the other hand, others reflect the systematic risk management principles, such as identifying vulnerabilities, assessing cyber exposures, and implementing mitigation or control measures [10,15,20].

5.3. Critical Evaluation of C-SCRM Concept

This section addresses RQ3: How has the conceptual adequacy of C-SCRM been assessed, and to what extent is the concept theoretically coherent? As noted by [124], strong strategic concepts should balance academic rigor and practical relevance. We assessed the conceptual goodness of C-SCRM based on [36] eight established core criteria, including familiarity, resonance, parsimony, coherence, differentiation, field utility, theoretical utility, and depth.

5.3.1. Differentiation

Differentiation refers to the extent to which a concept can be clearly distinct from other overlapping concepts [36]. Our review reveals that several terms have been used interchangeably across the reviewed articles, including ICT Supply Chain Risk Management, Supply Chain Cybersecurity, and Cyber Supply Chain Risk Management [21]. This overlap arises because of the defining attributes of the multidisciplinary roots of the concept and the blurring of conceptual boundaries. Furthermore, ref. [19] differentiated the concept of C-SCRM based on a holistic approach that integrates processes, people, and technology, and social relational factors with supply chain partners. Dealings with cyber risks have historically evolved as distinct disciplines such as cybersecurity, risk management, and supply chain management, their integration into different concepts such as supply chain risk management [26,125], cyber risk management [27], or C-SCRM [10,37] remains conceptually fluid and sometimes elusive. As a result, the absence of a unified definition may result in inconsistencies in the interpretation and comparability of findings, as if the risk of comparing apples to oranges. We can suggest that C-SCRM evolved through the fusion of supply chain management (SCM), risk management (RM), and cyber/information security (INFOSEC) to supply chain risk management (SCRM) and cyber risk management (CRM), as illustrated in Figure 5. Based on the above findings, we assessed its differentiation as low due to the definitional ambiguity and concept stretching debate. This can imply the need for sharper conceptual boundaries that specify how both traditional approaches of SCRM mainly focus on physical flows and operational risks, and CRM that mainly focus on internal IT systems vulnerabilities.

5.3.2. Resonance

Resonance indicates the idea of the concept connects with intended audiences in a meaningful way [36]. As previously highlighted, the term C-SCRM combines three widely used terms: cyber, supply chain, and risk management. Each component draws upon a distinct disciplinary foundation: “cyber” originates from information technology and security; “supply chain” from supply chain management; and “risk management” derives from business governance and compliance. When integrating these elements together to form C-SCRM, it has intuitively become relevant to diverse stakeholders, including but not limited to infosec, IT, procurement, and enterprise risk managers. In addition, the concept has become meaningful as it aligns with cyber supply chain incidents that occurred, such as SolarWinds, CrowdStrike disruption, and other attacks. Based on these findings, we assessed the resonance of the concept as high.

5.3.3. Field Utility and Practical Relevance

Field utility assesses the usefulness of the concept across the fields [36]. In this regard, some studies have operationalized C-SCRM practices and measured scales that align with risk management field and adapted practices from the National Institute of Standards and Technology (NIST), the Cybersecurity and Infrastructure Security Agency (CISA), and the International Organization for Standardization (ISO) across various industrial contexts [15,37]. Other empirical studies started to adapt the practices from the perspective of supply chain management [3,20].

However, to date, scholars have operationalized, measured and compared C-SCRM in diverse ways. Based on the above findings, we assessed the field utility as high, because they are used in multiple domains with different scales and contexts (for more details, see

Table 8. Critical Evaluation of C-SCRM.

Dimension	Brief Explanation	Assessment	Assessment Rationale
Familiarity	The concept should be familiar to the target audience in terms of terms and ideas.	Medium	C-SCRM has become a well-known concept to scholars and practitioners in cybersecurity and IT fields, but it is still unfamiliar among audiences in management fields, particularly supply chain management.
Differentiation	The concept should have clear conceptual boundaries that distinguish it from similar concepts.	Low	C-SCRM blurs considerably with general supply chain risk management and cybersecurity risk management.
Field Utility	The concept should provide practical relevance for research, measurement, policy, and managerial application.	Strong	C-SCRM is relevant, applicable, and valuable within the broader fields of supply chain, risk, and cybersecurity management. It helps scholars and practitioners identify, analyze, and mitigate cyber risks across the entire supply chain. It also helps them generate explanations, insights, and/or hypotheses related to governance, visibility, systems integration, operation management, resilience, robustness, and digital integration
Resonance	The concept should align with important issues, debates, or concerns, ensuring both scholarly and practical relevance.	Strong	C-SCRM aligns with different cyber supply chain incidents that occurred, such as SolarWinds, CrowdStrike disruption, and other attacks, which highlighted the severity of cyber supply chain risks.
Parsimony	The concept should remain concise and avoid unnecessary complexity or redundancy.	Low	C-SCRM includes organizational processes, governance, operations, and inter-organizational relationships across multiple tiers.
Coherence	The internal elements of the concept should logically fit together without contradictions	Low	The dimensions of C-SCRM remain fragmented, including technical, operational, and strategic.
Theoretical Utility	The concept should refine theory building, generate hypotheses, or explain relationships.	Strong	C-SCRM integrates practices from supply chain, risk, and cybersecurity management. C-SCRM links well to existing management theories such as contingency theory, stakeholder theory, resource-based theory, and dynamic capability theory. Finally, it was empirically associated with security, resilience, trust, visibility, and power dynamics in supply chains in the existing studies
Depth	The concept should support multi-level and in-depth investigation of its attributes	Medium	C-SCRM builds upon or extends other fields, such as supply chain management or risk management. It is often seen as cyber risk management or supply chain risk management

Source: Authors’ analysis based on ref. [36]’s conceptual evaluation framework.

and

Table 9. Comparative Conceptualizations of C-SCRM Across Academic Disciplines.

Criteria	Supply Chain Management	Cybersecurity/Information Systems	Risk Management
Focus	Strategic end-to-end control of the entire supply chain	Protection of systems, data, and digital infrastructure against internal and external cyber threats	Identification, assessment, mitigation, and monitoring of enterprise-level risks.
Risk approach	A strategic network-based risk management capability	A technical and operational approach	A governance-oriented, cross-organization functional approach
Unit of Analysis	The extended supply chain systems	The internal IT systems	The enterprise systems
Key Concepts Used	Security, resilience, agility, adaptability, visibility, third-party management	Threats, vulnerabilities, exploits, access control, threat intelligence	Risk identification, risk appetite, controls, residual risk, compliance
Operationalization of C-SCRM	Supplier assessments, third-party cyber scorecards, supply chain resilience indices	firewalls, penetration testing, endpoint protection, threat monitoring	Risk matrices, KRIs (key risk indicators), control frameworks (e.g., COSO, ISO, enterprise risk dashboards
Orientation	Strategic & relational:	Technical and defensive:	compliance-driven
Outcome Measures	build trust and joint resilience Supply chain security, resilience, robustness	Attack mitigation, system uptime, threat reduction	Risk exposure reduction, compliance, residual risk improvement, audit readiness

Source: Authors’ own elaboration.

).

5.3.4. Theoretical Utility and Depth

Theoretical utility reflects the concept’s ability to generate, test, or develop theories [36]. In this review, several theoretical perspectives have been employed, including maturity models, institutional theory, and dynamic capabilities theory (DCT) in C-SCRM research. For instance, DCT has been particularly used to sense vulnerabilities, seize mitigation opportunities, and reconfigure processes [3,15,47]. Therefore, these studies support that C-SCRM acts as resources to build information-security resilience capabilities [47], improve operational/financial outcomes [3], and create internal–external cybersecurity integration and build resilience and robustness to cyber risks [15]. Based on the above findings, we assessed the theoretical utility of C-SCRM as moderate to high.

5.3.5. Parsimony and Conceptual Complexity

Parsimony means its defining attributes or dimensions are simple, precise, clearly articulated, and non-redundant while retaining explanatory depth [36]. C-SCRM adopts a holistic and interdisciplinary concept that integrates people, processes, technology, and inter-organizational relationships across extended supply networks.

Nevertheless, scholars have not yet reached a global unified conceptualization. For example, ref. [37] aligned their scale with the five functional phases of the NIST Cybersecurity Framework. Building on this, ref. [20] developed and validated a three-dimensional scale, including governance, systems integration, and operations. Similarly, ref. [15] introduced the term Supply Chain Cyber Risk Management Strategies (SC-CRM) and adapted the NIST framework to reflect external supply chain risk management strategies. In contrast, ref. [15] employed two core dimensions, including internal organizational practices, strategy, objectives, policies, and integration with enterprise risk management, and external supply chain practices, including supplier prioritization, cybersecurity requirements, and joint incident response planning.

This diversity reveals persistent disagreement regarding its core dimensions (see Appendix A 

Table A2. Descriptive overview of C-SCRM instruments.

Author(s)/ Year	No. of Dimensions	Dimensions	Setting	Instrument Type	Framework Basis	Respondents (n)	Main Findings
[10]	3	Governance, Systems Integration, and Operations	Conceptual	Conceptual—proposed multidimensional model	NIST CSF (implicit)	NA	Proposed multidimensional framework, but not operationalized into validated survey items.
[37]	1	NIST Risk Management Functions (Identify–Protect–Detect–Respond–Recover)	Conceptual	Conceptual—theoretical mapping	NIST CSF; ERM	NA	Validated measurement scale that emphasizes cyber risk lifecycle.
[20]	3	Governance, Systems Integration, and Operations	Malaysia—Manufacturing sector	Empirical—5-point Likert	NIST, ISO 27001, ISO 28000	Managers (130)	Provide balanced validated organizational and operational practice-level scale.
[17]	3	Governance, Systems Integration, and Operations	Malaysia—Manufacturing sector	Empirical—5-point Likert	NIST CSF, COBIT 5, ISO 27001	Managers (105)	Validated multidimensional behavioral scale across managerial and operational levels.
[14]	4	Cyber Risk Governance, Cybersecurity Training, Cyber Risk Control, and Cyber Risk Insurance	Italy—multi-sectoral organizations	Empirical—5-point Likert	NIST-aligned principles	Managers (304)	Focused on technical and control-oriented practices.
[15]	1	Strategic Cyber Risk Management (Identify–Protect–Detect–Respond–Recover)	United States—Manufacturing sector	Empirical—5-point Likert	NIST CSF alignment	Managers (388)	Mainly focused on lifecycle-based cyber risks.
[3]	2	Internal (intra-organizational) and External (inter-organizational) SCRM practices	Denmark—SMEs	Empirical—5-point Likert	NIST CSF 2.0	Managers (248)	Combine organizational and inter-organizational practices.

Note: NA = Not applicable. Source: Authors’ synthesis based on extant C-SCRM literature.

). Some studies emphasize the NIST’s six cybersecurity phases, including govern, identify, protect, detect, respond, and recover [37]. Other studies adapted the scale from the NIST framework to only focus on the external relational perspective of managing cybersecurity risks and developed the scale of supply chain cybersecurity risk management strategies [15]. This inconsistency indicates that researchers are conceptualizing different aspects of the same concept. Furthermore, each dimension requires multiple indicators to create a measurement scale with extensive items. For instance, the multidimensional nature of the construct was divided into internal and external practices [3], governance, system integration, and operations [5,10,20,126] and five core NIST functions [10,15]. Given its extensive scope, we assessed the parsimony of C-SCRM as low.

5.3.6. Coherence and Theoretical Integration

Coherence refers to the different features or attributes that make up the concept logically fit together [36]. It is evident that there is persistent terminological overlap among different terms in the existing literature, such as cybersecurity across the supply chain [26], cybersecurity supply chain risk management [3], supply chain cyber risk management [15], managing cyber risks in supply chains [19,23], and cybersecurity risk management in supply chains [27], cyber risk management in supply chains [22]. However, to date, there is a lack of consensus on conceptual scope and disciplinary ownership. Accordingly, we assessed the coherence of C-SCRM as low.

6. Thematic Evolution and Knowledge Domains

This section presents a systematic co-occurrence analysis to identify the thematic clusters that have evolved over time in C-SCRM research. We analyzed keywords and phrases extracted using VOS viewer software [40]. After applying a minimum occurrence threshold of 10 appearances, we found 1340 qualified terms. and 408,734 linkages with a total link strength of 165,626. In this regard, Figure 6 and Figure 7 were generated using VOSviewer (https://www.vosviewer.com/) to visualize keyword co-occurrence networks and their temporal evolution.

An additional analysis was conducted using Biblioshiny (Bibliometrix package in R) to ensure the robustness and validity of the VOSviewer-based visualizations. Using multiple tools could be considered as recommended practice to enhance the reliability and validity of the findings [13]. Accordingly, Figure 8 and Figure 9 were produced using Biblioshiny to validate the conceptual structure and thematic stability of the identified clusters.

Based on the above analyses and visualization,

Table 10. Thematic Clusters in C-SCRM Research.

Cluster	Items (n)	%	Research Stream Focus		Theoretical Foundation	Temporal Evolution	Key Characteristics
Red Cluster	523	38.9%	Strategic-Organizational	Social	Resource-Based View, Institutional Theory	Exponential growth (2020+)	Strategic governance, human factors, organizational behavior
Green Cluster	490	36.6%	Operational- Analytical	Internal Technical	Operations Management, Capability Theory	Consistent growth	Detection systems, threat analysis, performance metrics
Blue Cluster	313	23.4%	Technical-Infrastructure		Systems Theory, Socio-Technical Systems	Foundational (2014–2019)	Infrastructure, system integration, data management
Yellow Cluster	13	1.0%	Emerging Technologies and Innovation	Environmental	Dynamic capability, Technology Acceptance	Recent emergence (2022+)	AI, dynamic systems, rapid development
Purple Cluster	1	0.1%	Cross-Domain Integration			Nascent	Interdisciplinary approaches
Total	1340	100%	-			-	-

Source: Authors’ own elaboration.

summarizes five distinct clusters, where each one is characterized by its research focus, theoretical orientations, and evolutionary characteristics.

6.1. Red Cluster: Strategic-Organizational Perspective (38.9%)

The red cluster was the dominant cluster, which had grown rapidly since 2020. This reflects the paradigm shift in addressing cyber risks from purely technical measures to an integrated management that focuses on people, processes, and technologies. Representative terms within this cluster include governance, cybersecurity awareness, employee behavior, cybersecurity investment, supply chain resilience, organizational culture, cybersecurity policy, frameworks, and decision-making processes.

Two theories are drawn from this cluster: the Resource-Based View (RBV) and the Institutional Theory, emphasizing how organizations develop and deploy practices as strategic resources while responding to institutional pressures for cyber supply chain security and resilience. Dealing with cyber risks has widely been recognized as a key strategic priority for organizations across all industries [5,8,26,127,128,129,130,131,132,133,134,135,136].

This cluster highlights some strategies adopted by senior management that generally align with the organization’s broader business strategies. One prominent research stream mainly focused on strategic cyber defense in breadth and in depth [5,17,20,126,137]. Governance requires the execution of information security policies and security procedures [14,31] and embedding cybersecurity into core business strategy and coordinating governance mechanisms that align with different stakeholders [5,17,20,126]. Another prominent research stream primarily focused on cyber risk management controls in supply chains as antecedents for achieving security and resilience [14,15,31,138]. A third research stream investigated the role of human factors in managing cyber risks. For instance, several studies highlight the critical role of senior management commitment, participation, and ethical leadership as vital antecedents for cultivating a strong information security culture and ensuring compliance [31,39,139,140]. Human capital further influences cybersecurity outcomes: CIO experience and tenure have been shown to affect cybersecurity performance [74,141]. More broadly, employee awareness, training, and behavior are essential in mitigating risks, particularly since human error accounts for over 90% of cyberattacks [142,143,144,145,146,147,148,149,150]. In addition, trust issues between supply chain partners can help to manage cyber risks in supply chains, as organizations may be reluctant to share sensitive information or become dependent on partners’ systems [151]. Building the necessary trust relationships requires time and sustained effort from all parties involved [152]. Despite this, many organizations continue to prioritize technical controls while underestimating the crucial role of psychological factors [153,154,155,156].

6.2. Green Cluster: Operational-Analytical Perspective (36.6%)

This cluster is grounded in the technical perspective of addressing cyber risks that might emerge from any nodes in the fragmented and globally dispersed supply chains [24,151]. Previous studies employed quantitative and simulation models to support decision-making under higher uncertainty [157,158,159,160,161,162,163], whereas others developed advanced algorithms for real-time recovery, predictive analysis, and adaptive defense [54,164,165,166,167,168,169,170,171,172,173]. Representative terms include threat detection, performance metrics, incident response, IoT security, threat intelligence, and system monitoring.

6.3. Blue Cluster: Technical/System Integration (23.4%)

This cluster mainly captures the idea of integration, which refers to the technical and organizational process of making different systems, data, applications, and processes work together seamlessly across inter and intra firms to enable seamless information flow and improve the decision making process, which could lead to increased C-SC security and resilience [5,10,20,126]. In the context of C-SCRM, systems integration has become one of the key components of managing cyber supply chain risks to ensure the secure and efficient flow of information across an organization’s various functions and with other stakeholders [5,10,20,126,174]. While ref. [10] framework for C-SCRM focused primarily on supplier control and threat modeling to achieve C-SC resilience, it did not explicitly mention customer integration in the systems integration. Gani and colleagues adopted a broader relational view of integration with partners and suppliers, as well as internal integration [5,20,126].

According to [15], systems integration includes both internal and external integration, which was one of the outcomes of C-SCRM rather than a component itself, and was then used as a mediating mechanism to enhance resilience and robustness of the supply chain. Most of the literature was focused on technological infrastructure integration, such as linking hardware, software, and networks (e.g., ERP, IoT, cloud platforms) [127].

6.4. Yellow Cluster: Emerging Technologies & Innovation (1.0%)

This cluster highlights the role of digital transformation and growing interest in emerging technologies. However, this small cluster size reflects the nascent nature of these applications within the field. Representative terms include artificial intelligence, machine learning, innovation processes, rapid development, and emerging technology integration. Some raised concerns about the role of emerging technologies in addressing cybersecurity issues [84,91,107,175,176,177,178,179]. Others introduced the framework of digital supply chain management to address cyber threats [25]. However, to date, the role of emerging technologies adoption has not been well investigated.

6.5. Purple Cluster: Cross-Domain Integration (0.1%)

This cluster represents the emerging interdisciplinary approaches that combine multiple cluster perspectives [9,180,181,182,183,184,185]. This nascent cluster suggests early recognition of the need for integrated management approaches that extend individual domain boundaries [186]. Rather than dealing with each dimension separately, C-SCRM can be viewed from an integrated management approach that combines organizational, managerial, and technical aspects [142,186].

7. Discussion

C-SCRM has been an area of interest for academic researchers, practitioners, and policy makers. This section presents the main insights derived from the bibliometric and conceptual analyses. It begins by providing a summary of a substantial number of findings that emerged from bibliometric analysis

7.1. Summary of Key Findings

This review provides a comprehensive synthesis of the C-SCRM literature by integrating bibliometric analysis with qualitative conceptual evaluation. The findings reveal that the thematic evolution of C-SCRM has had a paradigm shift from technical-centric to an integrated management-centric and interdisciplinary perspective. The thematic map identified five dominant knowledge domains that highlight the growing importance of governance, systems integration, human factors, and strategic coordination across supply networks.

Furthermore, the conceptual evaluation further found that C-SCRM continues to suffer from semantic conceptual confusion. This finding is consistent with previous research, which highlighted that the concept of C-SCRM remains underdeveloped [3,8,14]. Scholars have been debating how the concept of C-SCRM was defined, operationalized, and measured [3,8,14]. Although strong arguments exist in favor of adopting NIST-based risk management frameworks, e.g., [3], this review identifies several unresolved questions regarding what makes a “good” concept of C-SCRM. According to this perspective, overlapping definitions, internal contradictions among a concept’s defining attributes, and imprecise operationalizations were among the most common sources of conceptual confusion in this review. The findings also indicate that the concept formation of C-SCRM could be viewed as a dynamic and evolving process. Hence, good conceptualization requires a balance between eight core criteria that support its conceptual development as a vital construct in both supply chain and cybersecurity research.

7.2. Theoretical Contributions

This review has made several contributions to C-SCRM literature. First, this review provides a systematic examination of the often-muddy conceptualization of C-SCRM. Rather than focusing on descriptive comparison of definitions in extant literature, this study rigorously evaluates the conceptual adequacy of C-SCRM using [36] criteria, including differentiation, coherence, parsimony, and theoretical utility. Hence, this clarification contributes to theory-building of C-SCRM since it strengthens construct validity, which is considered a prerequisite for cumulative research (clearer boundaries vs. cybersecurity risk management, traditional SCRM, CRM; clearer “what it is” and “what it is not”).

Second, this review proposes an integrated management lens for dealing with cyber risks (See Figure 10). Rather than dealing with cyber risks as a common interesting area across different isolated disciplines, it situates C-SCRM as an integrated management construct by addressing the conceptual diffusion and overlap with different disciplines.

Third, it provides a comprehensive definition of C-SCRM as an integrated cross-organization governance and operational capability through which a focal firm and its supply network partners identify, assess, mitigate, and adapt to cyber threats that propagate through digital interdependencies, information flows, and multi-tier supplier relationships. C-SCRM consists of a coordinated set of technical, managerial, and relational practices that could ensure the internal and external security of interconnected supply-chain assets and sustain supply network resilience and continuity. This definition captures its multidisciplinary nature and distinguishes it from traditional constructs by emphasizing its relational, network-based, and cross-organizational characteristics. Similarly, existing studies have measured the construct in a fragmented manner through three dimensions: governance, systems integration, or operations. The proposed definition provides a clear conceptual root for specifying C-SCRM as a multidimensional construct comprising governance, systems-integration, and operations.

Fourth, we present the proposed model that was built upon the proposed definition and thematic analysis (see Figure 11). This framework links antecedents, practices, and outcomes of C-SCRM and highlights the behavioral, psychological, and socio-technical mechanisms that shape their interrelationships. Some key antecedents identified from the occurrence analysis include digital transformation, organizational investments in cybersecurity, the evolving cyber risks, and pressures from key stakeholders. These antecedents set the foundational conditions that motivate focal firms to strengthen cybersecurity capabilities across their supply networks. The framework also identifies the mechanisms through which C-SCRM creates value. Governance, systems integration, and operations together act as resource-capability-building processes that translate antecedents into cyber preparedness across the supply network. These mechanisms are shaped by behavioral and psychological factors that explain how and why C-SCRM relationships operate across organizations. Furthermore, the sociotechnical moderators determine the strength and directions of C-SCRM effects. These factors capture the interplay between technological factors and organizational behavior within the broader network. The framework also integrates supplier and customer relationship management as contextual conditions that could strengthen or weaken C-SCRM effectiveness across the supply network. Moreover, the framework identifies some C-SCRM outcomes. At the individual level, C-SCRM practices could turn into enhanced awareness and secure behavior. At the organizational level, C-SCRM capabilities lead to improved security performance. At the network level, C-SCRM practices could improve internal and external security and strengthen ecosystem resilience and robustness against cyber threats. The framework also proposes feedback loops, where achieving these outcomes could reshape the antecedents (e.g., investment priorities), suggesting a potential element of reverse causality in the system, which means that C-SCRM is a dynamic and evolving process.

This review also contributes to theoretical building and theory testing by providing the theoretical framework to understand C-SCRM from new integrative theoretical frameworks. For instance, the Dynamic Capability theory has primarily been used to explain how organizations sense, seize, and reconfigure resources to respond to turbulence. Recent research has begun to conceptualize security resilience and incident response agility as dynamic capabilities that organizations aim to achieve through continuous learning, information processing, and adaptive reconfiguration [47,187]. Hence, it extends the lens of managing cyber risks from a focal firm-centric to a network-level perspective [7,15]. It can be used to specify (i) how cyber threats propagate through inter-firm digital dependencies, and (ii) which organizational and relational mechanisms translate sensing/seizing/reconfiguring into supply network security and resilience. It conceptualizes C-SCRM as a distributed, cross-organizational capability enacted through governance, systems integration, and operations across multi-tier relationships. In doing so, it explores the mechanisms through which dynamic cyber-risk capabilities convert antecedent conditions (e.g., digital transformation, cyber incidents, investment) into preparedness, continuity, and resilience outcomes at the ecosystem level.

Also, institutional theory and stakeholder theories could be used to understand how institutional factors (e.g., global digital sovereignty requirements) and customer-driven normative pressures encourage the adoption of C-SCRM practices [92,123,188,189,190,191]. In fact, these two theories could be integrated to distinguish between (a) institutional and stakeholder pressures as antecedents, (b) governance and inter-organizational coordination as the mechanisms, and (c) contingent moderators (e.g., relationship management conditions and sociotechnical context) that influence effectiveness. This extends institutional theorizing beyond adoption toward the design, alignment, and performance of C-SCRM across partners.

Sociotechnical systems theory posits that effective management of cyber risks requires socio-technical coordination mechanisms that align people, processes, and technologies into a coherent management system [142,192]. Governance structures, systems integration, and operational controls must be incorporated into the C-SCRM system and can be complemented by behavioral and cultural mechanisms (e.g., digital skills, training, awareness, and compliance routines) to improve security, resilience, and robustness across the entire supply chain [99,116,147,193,194]. Thus, sociotechnical theory helps explain why purely technical measures may be insufficient unless they are supported by aligned organizational routines and human-centered practices [31,78].

7.3. Practical Contributions

This review provides several implications. First, it provides business and technology leaders, as well as professionals, with a strategic necessity to navigate the complexities of cyber threats from an integrated management perspective. Rather than treating cybersecurity threats as a purely technical or IT-driven function, the framework underscores the need for designing a C-SCRM system that involves managing processes, people, technologies, and cross-coordination and integration.

Second, the proposed framework provides actionable guidance to benchmark C-SCRM maturity across organizations along the interconnected supply chain. Senior executives and managers should, therefore, ensure cross-functional ownership of cyber risks, clear accountability structures, and alignment between cybersecurity and supply chain strategies.

Third, this review has important implications for policymakers and regulatory bodies as it encourages the integration of I.4 technologies adoption into C-SCRM principles to achieve cyber supply chain security and digital resilience. Policymakers, in their turn, can also encourage business investments in adopting advanced digital and I4.0 technologies, such as AI-enabled risk monitoring, threat intelligence sharing platforms, and automated supplier risk assessment tools. In addition, regulatory guidance and incentive mechanisms like public–private partnership programs can stimulate organizational investment in data-driven cybersecurity governance and cross-organizational risk transparency. Embedding such technologies within cybersecurity and supply chain governance frameworks can enhance visibility, accountability, and coordinated response across multi-tier supply networks, thereby reducing the systemic impacts of cyber risk and improving ecosystem-level resilience. In doing so, this review informs regulatory design and supports policy initiatives aimed at strengthening resilient and responsible digital innovation across critical supply chains.

8. Future Research Directions

This section addresses RQ4: How could we advance the conceptual clarity of C-SCRM? Drawing from the conceptual, methodological, and thematic gaps identified in this review, we propose five interrelated research agendas as follows:

8.1. Strengthening Conceptual Clarity and Boundary Conditions

Existing research on C-SCRM presents similar definitions between diverse terms. The concept remains fragmented with overlapping labels, inconsistent scopes, and weak differentiation from adjacent constructs. Modern researchers can investigate the topic of dealing with cyber risks from an integrated perspective rather than from a fragmented perspective (see Figure 10). Questions about C-SCRM and other related terms, such as SCRM, have directed efforts toward gaining a more subtle understanding of their nature. Researchers can conduct conceptual mapping and network analysis to understand in detail the meaning and measurement of the C-SCRM practices. Similarly, comparative meta-analysis studies can compare the relationship of C-SCRM and other overlapped terms, such as traditional supply chain risk management and cyber risk management, and their existing scales and the rationale behind them. Furthermore, future research can explore the moderating effect of nationality, taking into account contextual/cultural influences in order to disentangle similarities and differences between the constructs.

This leads us to some research questions: FRQ8.1.1: How are C-SCRM, traditional supply chain risk management, and cyber risk management similar? How are they different? FRQ8.1.2: How do definitional variations influence the interpretation of empirical findings? FRQ8.1.3: What boundaries most clearly distinguish C-SCRM from related constructs?

8.2. Advancing Measurement and Psychometric Rigor

Improving the psychometric validity of C-SCRM measurement subscales has become necessary for cumulative and comparable knowledge in the field. In this regard, future studies can develop and validate a multidimensional scale of C-SCRM aligned with the definition proposed in this review. This process may include specifying measurement items, testing dimensionality through exploratory factor analysis, confirmatory factor analysis, and validating constructs across industries, firm sizes, and national contexts. Furthermore, researchers could investigate the higher-order construct measurement of the C-SCRM system that comprises governance, systems integration, and operations, which were conceptualized and measured in prior studies as reflective lower-order components [20]. This process could involve specifying, using Tetrad Analysis to evaluate dimensionality, and testing whether a set of indicators reflects a latent construct or should instead be modeled as multiple distinct constructs [195]. Subsequently, researchers could estimate and validate the higher-order constructs of C-SCRM using rigorous statistical and psychometric procedures, including reliability assessment and confirmatory validity testing [196]. It is also important to examine statistical heterogeneity in the associations between C-SCRM and outcomes and, if these associations turn out to be heterogeneous, determine whether variables, such as organizational, sectoral, supply chain, or technological characteristics, explain this variation. This can lead to some future research questions FRQ8.2.1: How can C-SCRM be operationalized and validated as a multidimensional construct that either reflects or composes governance, systems integration, and operations? FRQ8.2.2: Does a higher-order C-SCRM construct better improve performance outcomes?

8.3. Strengthening Theoretical Foundations and Mechanisms

As mentioned above, several theories to explain how C-SCRM develops and why it can generate value are still under development. For instance, future research would benefit from integrative theoretical perspectives, such as dynamic capabilities theory (DCT) and the resource-based view (RBV), to gain a comprehensive understanding of C-SCRM, mediators, and outcomes. These frameworks would enable us to identify mechanisms through which C-SCRM could develop capabilities that impact outcomes. Another example, institutional theory and stakeholders’ theory could be used to explore the role of institutional pressures in the adoption and maturity of C-SCRM practices. Some research questions include FRQ8.3.1: Through what mechanisms do C-SCRM capabilities evolve into resilience and robustness? FRQ8.3.2: How do institutional pressures shape C-SCRM practices? FRQ8.3.3: Are there conditions that buffer or strengthen the associations of C-SCRM and different outcomes?

8.4. Broadening Methodological Approaches

The findings reveal that the scope of empirical studies on C-SCRM remains limited. Most of the empirical studies used survey methods for collecting the data. Future studies should adopt experimental methods, longitudinal designs, simulation modeling, agent-based models, and network analytics. For instance, the application of experimental studies to test some of the proposed relationships related to the adoption of emerging technologies in improving C-SCRM outcomes could deepen the causality, as in prior studies [16,197]. Modern researchers can conduct laboratory experiments to study how psychological factors such as perceived managerial trust shape employees’ security behavior. Future studies can adopt cross-level research designs that integrate individual, organizational, and network-level. Such designs may investigate individual security behaviors and inter-firm relationships that collectively interact shape overall supply network resilience. Furthermore, future studies could use longitudinal studies to measure CEOs’ reactions during and post cyber security incidents, and how the previous awareness, knowledge, and experience of past cyber incidents could influence future C-SCRM capabilities. FRQ: What causal effects do C-SCRM interventions have on employee and supplier behaviors? How do managerial cognition, trust, and experience influence cyber-risk decision-making?

8.5. Expanding Outcomes and Multi-Level Perspectives

The findings reveal that empirical studies focused on investigating C-SCRM outcomes are still limited. Hence, future work may focus on developing different performance outcomes at different levels, including but not limited to operational outcomes. Cross-level designs could also examine how individual behaviors aggregate into supply network capabilities. Some research questions still need to be addressed FRQ8.5.1: How do C-SCRM practices influence financial, operational, environmental, or relational outcomes? RQ8.5.2: How do security behaviors shape supply network resilience? RQ8.5.3: What role would I.4 technologies adoption play in increasing or decreasing the cyber supply chain external security, internal security, robustness, and resilience? RQ8.5.4: How would a secure and resilient cyber supply chain system model be designed based on different factors to mitigate the effects of cybersecurity risks? How can I.4 technology adoption be integrated to strengthen the security and resilience of the ecosystem?

9. Limitations

While this paper adopted an objective, systematic, and transparent systematic literature review (SLR) protocol, there are some limitations that need to be acknowledged.

First, this review relied on the Web of Science (WoS) Core Collection as the main database for conducting the literature process. While WoS was widely chosen in management reviews for its advantages of conducting SLRs due to its rigorous indexing standards and suitability of a manageable number of relevant articles, it might not provide the comprehensive coverage of all scholarly output. As a result, some relevant articles may have been unintentionally excluded, and thus, this study may be subject to potential database coverage bias.

Second, this review considered only peer-reviewed journal articles. Hence, this review did not include published gray literature, including but not limited to books, book chapters, conference proceedings, working papers, institutional reports, and dissertations.

Third, the review was restricted to English-language journal articles. This restriction enhances methodological consistency and quality control; however, it also introduces language bias. Given the international nature of research in this field, the exclusion of studies published in other languages may limit geographical and cultural diversity.

Finally, to ensure academic rigor and relevance, this review exclusively included articles published in journals ranked A* or A in the Australian Business Deans Council (ABDC) journal list. While this criterion strengthens quality assurance, it may also introduce publication bias by excluding relevant studies published in high-quality engineering, information systems, and cybersecurity outlets that fall outside the ABDC classification. This restriction may partially constrain the interdisciplinary scope of the review, particularly given the technical foundations of cyber supply chain risk management.

Therefore, future research could address the above-mentioned limitations by incorporating additional databases (e.g., Scopus, IEEE Xplore, etc.), reputable outlets from engineering and security disciplines, and extending the search to non-English and gray literature. Such efforts would enable a more comprehensive and interdisciplinary understanding of C-SCRM and further strengthen cumulative theory building in this field.

10. Concluding Remarks

This paper has provided an intellectual overview of existing literature and a comprehensive conceptual assessment of C-SCRM. It has addressed four research questions by systematically reviewing 175 articles published between 2014 and early 2025. In response to RQ1, C-SCRM has progressed over the last 11 years from a nascent concept into a rapidly expanding and increasingly impactful research domain. C-SCRM research remains strongly rooted in cybersecurity and information systems outlets, whereas its dispersion across multiple disciplines highlights its interdisciplinary nature. Notwithstanding, this shift shed light on the multidisciplinary nature of C-SCRM, drawing on diverse intellectual foundations, including cybersecurity, risk management, and supply chain management. Addressing RQ2, the definitional analysis indicates that C-SCRM has developed through multiple intellectual and disciplinary lenses. Yet, conceptual development remains fragmented, where different measures were used in extant literature. With respect to RQ3, using Gerring’s conceptual criteria, this review shows that the concept of C-SCRM demonstrates limited theoretical coherence, unclear boundaries, and inconsistent levels of analysis. Existing research often adopted diverse isolated theoretical frameworks (e.g., dynamic capabilities, institutional, stakeholder, and sociotechnical perspectives) without integrating them to capture the comprehensive C-SCRM system. The evidence suggests that C-SCRM remains an important but conceptually fluid construct whose theoretical coherence is still developing, requiring the integration of multiple theories.

Finally, in response to RQ4, this study suggests that there is a need to improve the conceptual clarity of C-SCRM to advance the research stream in three ways. It conceptualizes C-SCRM as a coordinated governance and control system across digitally interconnected supply chains. Second, it proposes that there is a need to clearly distinguish between different measures of C-SCRM practices, thereby helping to enhance the validity of results and ultimately contributing to the accumulation of knowledge in the area. In this regard, C-SCRM could be operationalized as a multidimensional construct comprising governance, systems integration, and operations, thereby providing a clearer basis for future measurement development and comparative empirical research. Third, the proposed dynamic integrative framework links antecedents, practices, mechanisms, moderators, and outcomes. These advancements provide a more coherent area for theory building and for developing valid and reliable measurement scales that offer insightful avenues for management scholarships that help bridge the theory–practice gap.