How do Danish water utilities organize and execute cybersecurity incident response, and what patterns of practice and challenges emerge?

This thesis investigates the area of cybersecurity incident response (IR) within Danish water utilities. As cyberattacks increasingly threaten critical infrastructure, understanding practical IR approaches is crucial. This study addresses the research question How do Danish water utilities organize and execute cybersecurity incident response, and what patterns of practice and challenges emerge? To answer this, a comparative multi-case study design was employed, involving scenario-based workshops with nine Danish water utilities collectively supplying 9% of the Danish population. Data was collected on key IR themes, includingcritical system identification, escalation, first actions, communication, roles and responsibilities, and reporting mechanisms. A cross-case analysis was then conducted to identify patterns and challenges in their organizational and operational practices. These findings were compared to existing literature as we confirm, challenge and nuance previous understand-ing regarding IR in utilities within the water sector. The findings suggest that while initial isolation efforts are widespread and effective, challenges can arise as the incident is handed from operations to IT. During an incident Danish utilities has a preference for help from existing relationships over national assistance. Organizationally, utilities prioritize reputational considerations over direct economic consequences, which in return influence their approach for communicating to mediaand consumers during an incident. Communicative efforts are varied as some havean open approach with others being more closed. Finally, leadership of the IR team is usually delegated to IT, operations, or CEO roles. The Inclusion of specializedfunctions like economic, communicative and compliance personnel have an impact IR capabilities, suggesting that IR teams should be strategically designed to align with organizational objectives. Moving forward, this study highlights several avenues for future research, including a deeper exploration of specific IR roles and communication approaches, further evaluation of workshop-based research methodologies, and broader studies at varying scales to understand knowledge flow and cross-national comparisons