Cyber-Informed Engineering Implementation Guide

Program Document · Tue Sep 05 00:00:00 EDT 2023

OSTI ID:1995796

Wright, Virginia L  ^[1]; Meng, Jakob P ^[1]; Anderson, Robert S ^[1]; Gellner, Jeffrey R ^[1]; Barnes, Lance B ^[1]; Chanoski, Samuel Douglas ^[1]; Edsall, Robert M  ^[1]; Holtz, Mary Rose  ^[1]; Jones, Jeremy Michael  ^[1]; Le Blanc, Katya L  ^[1]; Mahanes, Joseph C ^[1]; McJunkin, Timothy R  ^[1]; Robinson, Jessica ^[1]; Rucinski, Daniel John ^[1]; Shannon, Gregory Edward ^[1]; Welch, Justin J  ^[1]; Ayala, Marco ^[2]; Atkins, Victor ^[2]; Baker, KatherineAnne ^[3]; Castillo, Krystel ^[4] ; Cox, Joel ^[5]; Gale, Tim ^[2]; Graham, Rich ^[2]; Groves, Daniel ^[6]; Johnson, Stephanie ^[7]; Kishter, Lindsay ^[3]; Macwan, Richard ^[8]; Loo, Sin Ming ^[9]; McFly, Shane ^[8]; Martin, Maurice ^[8]; Morris, Matt ^[2]; Ohrt, Andrew ^[6]; Sachs, Marc ^[10]; Venkataramanan, Venkatesh ^[8]; Waligoske, Emily ^[8]; Williams, Gareth ^[8]

---

1. Idaho National Laboratory
2. 1898 & Co
3. Nexight
4. University of Texas, San Antonio
5. West Yost Associates
6. West Yost
7. Department of Energy
8. National Renewable Energy Laboratory
9. Boise State University
10. Auburn University

This Implementation Guide describes the principles of Cyber-Informed Engineering (CIE) and outlines questions that engineering teams should consider during each phase of a system’s lifecycle to effectively employ these principles. It describes what it means to engineer systems in a cyber-informed way, rather than offering a comprehensive, step-by-step process or procedure for CIE implementation. This guide complements—but does not replace—the application of cybersecurity standards or practices currently in place within an organization. Engineers and technicians that design critical energy infrastructure installations can use this Implementation Guide to integrate the 12 principles of CIE into each phase of the engineering lifecycle, from concept to retirement. The guide is aimed at system or design engineers, rather than software engineers or operational cybersecurity practitioners. The engineers who design, build, operate, and maintain the physical infrastructure are best positioned to leverage a system’s engineering design to diminish the severity of cyber attacks or digital technology failures. CIE expands cybersecurity decisions into the engineering space, not by asking engineers to become cyber experts, but by calling on engineers to apply engineering tools and make engineering decisions that improve cybersecurity outcomes. CIE examines the engineering consequences that a sophisticated cyber attacker could achieve and drives engineering changes that may provide deterministic mitigations to limit or eliminate those consequences.

• Research Organization: Idaho National Laboratory (INL), Idaho Falls, ID (United States)
• Sponsoring Organization: 58
• DOE Contract Number: DE-AC07-05ID14517
• OSTI ID: 1995796
• Report Number(s): INL/RPT-23-74072-Rev000
• Country of Publication: United States
• Language: English

Related Subjects

42 - ENGINEERING
97 - MATHEMATICS AND COMPUTING
CCE
Consequence-driven Cyber-Informed Engineering
Cyber-Informed Engineering
CIE
Cyber Resilience
Cybersecurity Resilience
Energy Transition
Integrating Cybersecurity
cyber risk
Cyber Supply Chain Risk
Cyber-Resilience
Cyber
security by design
secure by design