Purpose This paper aims to explore the cybersecurity challenges the electric power industry faces due to its increased reliance on digital supply chains (DSCs), focusing on the procurement phase. Design/methodology/approach This study uses qualitative methods, with 17 semi-structured interviews conducted among industry participants to delve deep into the challenges and potential solutions. The Gioia methodology was applied to analyse the interview data. The ecosystem and procurement theory is used to understand the interconnectedness and vulnerabilities within the electric power industry’s DSC. Findings Three aggregated dimensions were identified: cybersecurity, risk management and supplier tensions. Key findings suggest the importance of precise cybersecurity requirements, continuous monitoring, engagement with all supply chain actors and adaptability to emerging threats. Practical implications This paper presents a framework to systematically address and mitigate cybersecurity risks in the DSC. Combining theoretical foundations with reasonable measures can significantly enhance cybersecurity resilience. By implementing these guidelines, organisations can foster collaboration across the supply chain, maintain regulatory compliance and continually adapt to the evolving threat landscape. Originality/value The paper is based on unique interview data from actors in the electric power industry. It presents a new framework for managing cybersecurity in DSCs, underpinned by the theoretical lenses of ecosystems and procurement.

The main purpose of this paper is to identify the current state of the art on digital supply chain cybersecurity risks in critical infrastructure and how the term resilience is used in this context. To achieve this objective, the authors applied a systematic literature review method that summarises and analyses the studies relevant for the research topic. In total 33 papers were identified. The results show that limited research is done on supply chain risks in critical infrastructure. Relevant frameworks and methods for resilience of supply chains have also been identified. These frameworks and methods could be very beneficial for a more holistic management of cybersecurity risks in the increasingly complex supply chains within critical infrastructure.