*3.2. Identification of Sources and Search Term*

The search strategy for identifying publications was primarily through online databases: Springer Link, IEEE Xplore, ACM, Science Direct and ASCE library. These are the most common libraries for publishing conference proceedings and journal publications within the field of cyber-security in cyber–physical systems. Google Scholar returned articles that were covered in these databases; however, we also used it to identify relevant publications that appeared in other databases or venues. The search strings used for the databases were "water and cyber-security" or "cyber-security". Table 2 shows the search string for each database. When a basic search on databases returned many papers, advanced searching was used to filter irrelevant papers. For example, searching Google Scholar using combinatorial search keywords such as "water" AND "cyber-security" resulted in a high number of papers (over 17,900) that were not relevant to this systematic review. Instead, the search was limited to terms appearing in the title: "water" and "cyber" to identify studies that primarily focused on cyber-security of water systems. A list of security keywords was also used in conjunction, to search the databases for relevant publications. These qualifiers included: water, integrity, confidentiality, availability, integrity, authentication, authorisation, access control, threat, vulnerabilities, attacks, and detection. However, these failed to capture any new publications. Searching was limited to publications that had been published from 2000 to 2020.


**Table 2.** Search string used for each data source.

Figure 4 shows the number of publications retrieved from online databases. Duplicates were removed from this pool of publications and the remaining publications were included for further review.

To complement online database searching, a manual review of reference lists of eligible papers and any notable journals (e.g., Water and Environment Journal), conferences (e.g., World Environmental and Water Resources Congress) and workshops (e.g., International Workshop on Cyber–Physical Systems for Smart Water Networks) was carried out to identify any relevant publications that might have been missed in the database search.

**Figure 4.** Publication selection process.
