Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Cybersecurity Requirements”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records
All sourcesNASA NTRSDOE OSTI
NASA NTRSDate not supplied

Gateway Implementation of Cybersecurity Requirements

Cybersecurity threats are a constant present-day reality for any type of business -- Space exploration is not excluded from these threats either. The Gateway Program is one of NASA’s latest initiatives that extend space exploration beyond low earth orbit. Gateway allows for NASA to prove technologies and mature systems necessary to live and work on another celestial body before embarking on multi-year missions to Mars. The Gateway is a small, human-tended space station in orbit around the Moon. With the increased autonomy, distance and criticality of systems, cybersecurity is a critical discipline that touches and integrates with most if not all subsystems of the Gateway. Building a gateway to the lunar orbit is no simple task. In this presentation, we outline an approach that the Gateway team adopted in creating a cyber safe and robust vehicle to support operations and assure protection of the critical functions. Gateway Program is required to implement National Institute of Standards and Technology (NIST) guidelines to adhere to the Federal Information Security Modernization Act (FISMA). NIST provides a framework for managing and controlling cybersecurity risks by defining cybersecurity controls and methodologies for implementation. The NIST framework is based upon the system, data within the system, integrations with external systems, and risk assessments to determine impacts for each of those systems. The goals and objectives are to identify appropriate security controls that fulfil and map to the NIST 800-53 framework. The implementation process involves developing an organizational understanding to manage cybersecurity risk to systems, people, assets, data, and capabilities. NIST Security controls are interpreted and defined within the Gateway vehicle requirements subsystems specifications. This paper details the approach, implementation, and challenges faced during the development and design phases to address cyber threats during the Gateway vehicle operations.

Cybersecurity↗
DOE OSTI2022

Digital Twin and Cybersecurity Requirements for Beartooth

This report summarizes the requirements for the Cybersecurity and the Digital Twin for Beartooth. The Beartooth digital twin will ultimately allow for both comprehensive offline data analysis and transformational autonomy. This document places limits on the IPL-funded work scope to end at a predictive digital twin stage but allow for future expansion to support full autonomy. It is expected that this work will support both currently funded LDRD and future direct-funded digital twin research.

42 ENGINEERING↗
DOE OSTI2018

Universal Utility Data Exchange (UUDEX) Functional Design Requirements: Cybersecurity of Energy Delivery Systems Research and Development

This document provides a set of high-level functional design requirements for Universal Utility Data Exchange (UUDEX). These requirements include a set of use cases, data exchanges supported by UUDEX, both for grid operations and for cyber security data, functional requirements for data exchange, data models used by UUDEX, data exchange architectures, and security considerations. These functional design requirements are intended to be used in more detailed design documents.

97 MATHEMATICS AND COMPUTING↗
NASA NTRSDate not supplied

Gateway Implementation of Cybersecurity Requirements

Cyber threats are a constant present-day reality for any type of business -- Space exploration is not excluded from these threats either. The Gateway Program is one of NASA’s latest initiatives that extend space exploration beyond low earth orbit. Gateway allows for NASA to prove technologies and mature systems necessary to live and work on another celestial body before embarking on multi-year missions to Mars. The Gateway is a small, human-tended space station in orbit around the Moon. With the increased autonomy, distance and criticality of systems, cybersecurity is one of the critical subsystems that touches and integrates with most if not all subsystems of the Gateway. Building a gateway to the lunar orbit is no simple task. In this presentation, we outline an approach that the Gateway team adopted in creating a cyber safe and robust vehicle to support operations and assure protection of the critical functions. Gateway Program is required to implement National Institute of Standards and Technology (NIST) guidelines to adhere to the Federal Information Security Modernization Act (FISMA). NIST provides a framework for managing and controlling cybersecurity risks by defining cybersecurity controls and methodologies for implementation. The NIST framework is based upon the system, data within the system, integrations with external systems, and risk assessments to determine impacts for each of those systems. The goals and objectives are to identify appropriate security controls that fulfill and map to the NIST 800-53 framework. The implementation process involves developing an organizational understanding to manage cybersecurity risk to systems, people, assets, data, and capabilities. NIST Security controls are interpreted and defined within the Gateway vehicle requirements subsystems specifications. This paper details the approach, implementation, and challenges faced during the development and design phases to address cyber threats during the Gateway vehicle operations.

Svetlana Hanson↗
DOE OSTI2017

A new international standard on cybersecurity for nuclear power plants: IEC 62645 - cybersecurity requirements - 161

This paper provides an overview of the IEC 62645, an actual standard by the International Electrotechnical Commission (IEC) focused on the issue of requirements for computer security programmes and system development processes to prevent and/or minimize the impact of cyber attacks against computer-based I and C systems. Developed since 2009 and published end of 2014, the standard is intended to be used for changing or establishing new security programmes for I and C systems of operating and new Nuclear Power Plants (NPP). This paper also presents the key issues being considered in the new revision to IEC 62645, currently in process. (authors)

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2024

Cybersecurity Certification Requirements for Distributed Energy Resources: A Survey of SunSpec Alliance Standards

This survey paper explores the cybersecurity certification requirements defined by the SunSpec Alliance for Distributed Energy Resource (DER) devices, focusing on aspects such as software updates, device communications, authentication mechanisms, device security, logging, and test procedures. The SunSpec cybersecurity standards mandate support for remote and automated software updates, secure communication protocols, stringent authentication practices, and robust logging mechanisms to ensure operational integrity. Furthermore, the paper discusses the implementation of the SAE J3072 standard using the IEEE 2030.5 protocol, emphasizing the secure interactions between electric vehicle supply equipment (EVSE) and plug-in electric vehicles (PEVs) for functionalities like vehicle-to-grid (V2G) capabilities. This research also examines the SunSpec Modbus standard, which enhances the interoperability among DER system components, facilitating compliance with grid interconnection standards. This paper also analyzes the existing SunSpec Device Information Models, which standardize data exchange formats for DER systems across communication interfaces. Finally, this paper concludes with a detailed discussion of the energy storage cybersecurity specification and the blockchain cybersecurity requirements as proposed by SunSpec Alliance.

Tsikteris, Sean (ORCID:0009000524202250)↗
DOE OSTI2023

Cybersecurity Platform and Certification Framework Development for Extreme Fast Charging (XFC)-Integrated Charging Ecosystem (Final Project Report)

This report summarizes a pioneering effort in Electric Vehicle charging infrastructure ecosystem cybersecurity requirements, assessment methodologies, functional verification, as well as embodiment of the key technologies in the form of hardware and software tools being made available to the public. EPRI led a team of experts, as well as a stakeholder coalition encompassing all key actors in the EV charging infrastructure ecosystem that includes eXtreme Fast Charging (XFC) equipment (defined as 200kW or above). EV charging infrastructure in the United States is a patchwork of networks that have continued to grow organically and have been designed to serve the charging needs of the EV owners, who are their customers. In doing so, each network provider, as well as their connected entities such as the cloud Electric Vehicle Service Providers or EVSPs, utility back office, utility AMI networks, payment networks, as well as Original Equipment Manufacturer (EV manufacturer) telematics networks, have designed systems that may work well individually, but no single entity is responsible for the entire ecosystem to be secure in terms of data exchange. Furthermore, there is no uniformity in how each actor has implemented the cybersecurity requirements since no system-wide cybersecurity requirements existed prior to this project. The final project report describes the technical approach guided by the EV charging infrastructure cybersecurity working group, convened specifically for this project. The technical approach included definition of requirements at the ecosystem level, treated as a ‘system of systems’, and then passed down to individual systems (EVSE, EV, cloud EVSP, utility, and the payment networks), followed by developing the cybersecurity risk and vulnerability assessment methods, that were later applied to real-world cyber-physical systems at EPRI, ANL, and NREL laboratories, to validate both the process and the results. Finally, in a spotlight over the most vulnerable equipment, which is the EV charge station (AC or DC), the team developed a multi-layer cybersecurity implementation in the embedded domain embodied by the open-source Secure Network Interface Card (SNIC) demonstrating the various ways in which the infrastructure can be secured protecting against the identified attack surfaces. Finally, the entire process of EV infrastructure cybersecurity assessment was encapsulated in the Electric Vehicle Charging Cybersecurity Management (EVC2M) online GUI-based tool, that is expected to be released to the public. The report presents the objectives, the technical approach, the key results, and recommendations for future work.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2022

Design of a Novel Information System for Semi-Automated Management of Cybersecurity in Industrial Control Systems

There is an urgent need in many critical infrastructure sectors, including the energy sector, for attaining detailed insights into cybersecurity features and compliance with cybersecurity requirements related to their Operational Technology (OT) deployments. Frequent feature changes of OT devices interfere with this need, posing a great risk to customers. One effective way to address this challenge is via a semi-automated cyber-physical security assurance approach, which enables verification and validation of the OT device cybersecurity claims against actual capabilities, both pre- and post-deployment. To realize this approach, this paper presents new methodology and algorithms to automatically identify cybersecurity-related claims expressed in natural language form in ICS device documents. Here, we developed an identification process that employs natural language processing (NLP) techniques with the goal of semi-automated vetting of detected claims against their device implementation. We also present our novel NLP components for verifying feature claims against relevant cybersecurity requirements. The verification pipeline includes components such as automated vendor identification, device document curation, feature claim identification utilizing sentiment analysis for conflict resolution, and reporting of features that are claimed to be supported or indicated as unsupported. Our novel matching engine represents the first automated information system available in the cybersecurity domain that directly aids the generation of ICS compliance reports.

96 KNOWLEDGE MANAGEMENT AND PRESERVATION↗
DOE OSTI2017

IEC 62859: A new international standard on the coordination between safety and cybersecurity for nuclear I and C systems - 160

Cybersecurity requirements and controls for digital I and C systems are increasingly added to well-established safety-oriented provisions. Interactions and potential side-effects are possible and must be mastered, taking into account the nuclear I and C system specificities as well as their normative and regulatory contexts. The new international standard IEC 62859 'Nuclear power plants - Instrumentation and control systems - Requirements for coordinating safety and cyber security' aims to optimize the integration of cybersecurity provisions in nuclear I and C architecture and systems, to prevent conflicts between safety and cybersecurity provisions, and to aid the identification and the leveraging of the potential synergies between safety and cybersecurity. The paper presents the structure and the key aspects of this standard. IEC 62859 is structured along three main sections: one dealing with the overall I and C architecture, a second one focusing on the system level, a third one dealing with organizational and procedural issues. The paper also discusses related work in the nuclear industry, and in other sectors. (authors)

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2021

Smart Semi-Supervised Accumulation of Large Repositories for Industrial Control Systems Device Information

Industrial Control Systems device manufacturers frequently add new features to improve their product performance. Oftentimes, these changes are mainly vendor-driven initiatives, and customers may not be aware of the full impact of these new capabilities on their cybersecurity posture. In the energy sector, this can lead to considerable dissonance between vendor-provided cybersecurity claims and a customer’s responsibility for Operation Technology cybersecurity compliance. Thus, the resulting dynamic verification burden is shifted towards the customer and may pose a significant cybersecurity risk to the energy sector landscape. We found that there is very limited research into cybersecurity auditing for Operational Technology. However, a solution is needed for vetting the vendor-supplied feature claims and their adherence to cybersecurity requirements and standards. We are presently engaged in an effort to develop such a system. This paper demonstrates one vital aspect of this effort in proposing an end-to-end framework to accumulate a large repository of ICS device information for this vetting system, curate the dataset, and conduct extensive processing. This framework is designed to use web scraping, data analytics and Natural Language Processing (NLP) techniques to identify vendor websites, automate the collection of website-accessible documents and automatically derive metadata from them for identification of product documents relevant to the repository. We have found that this automated approach to vendor identification, document extraction into a product repository, and NLP pre-processing is unique and has not been previously presented in the literature. The preliminary work shows that this is feasible and can produce reliable results with minimum supervision. Future work will be built upon this foundation in order to achieve semi-supervised vetting of device technical information – a vital capability for ensuring that vendor-claimed device cybersecurity capabilities match industry requirements.

Ameri, Kimia↗
DOE OSTI2026

Cybersecurity Risk Profiles for Distributed Energy Resource Management Systems

Managing the digitalization of increasingly diversity energy resources is a complex challenge for energy systems planners and managers. As the penetration of solar photovoltaics (PV) and other distributed renewable energy resources (DERs) expands, distributed energy resource management systems (DERMS) will play an increasingly important role in managing, monitoring, and controlling DERs as electric systems before more distributed, interconnected, and networked. However, the cybersecurity implications of DERMS deployments are not well understood today. A lack of understanding around the cybersecurity implications of DERMS deployments and variability in the security posture of DERMS vendors, owners, and operators could introduce new security risks to evolving electric power systems. This paper describes cybersecurity attack scenarios on DERMS, identifies related cybersecurity standards and guidelines, reviews the security features of state-of-the-art DERMS solutions, and offers cybersecurity guidance for DERMS vendors, owners, and operators to protect DERMS' unique capabilities. Standardizing cybersecurity requirements for DERMS could help improve the security of DERMS integrations and improve innovations that are more secure by design. The cybersecurity guidance found in this paper is intended to offer a unified approach and lay the foundation for future standardization of DERMS cybersecurity to reduce risk to the solar industry and other renewable energy stakeholders when integrating these technologies with electric power systems.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2024

Advanced Reactor Safeguards & Security 2024 Program Roadmap

The Advanced Reactor Safeguards and Security (ARSS) program was established to provide research support addressing near term challenges that advanced nuclear reactor vendors face in meeting domestic Material Control and Accounting (MC&A), Physical Protection System (PPS), and Cybersecurity requirements for U.S. construction. The technical work in the program is meant to (1) support nuclear reactor vendors with advanced MC&A, PPS, and Cybersecurity designs for next generation reactors, (2) provide technical bases for the regulator, and (3) promote the integration of Safeguards and Security by Design early in the design process. Existing domestic regulations for safeguards and security, as outlined in the Code of Federal Regulations, were written for large light water reactors, and rule-making efforts are underway to develop regulations more suited to different reactor designs. The ARSS program seeks to remove roadblocks in the deployment of new and advanced reactors by solving regulatory challenges, reducing safeguards and security costs, and utilizing the latest technologies and approaches for robust plant monitoring and protection. This roadmap discusses the goals of the ARSS program, current research, and program plan for the next five years.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2019

Recommendations for Trust and Encryption in DER Interoperability Standards

Recently developed Distributed Energy Resource (DER) interoperability standards include communication and cyber security requirements. In 2018, the US national interconnection standard, IEEE 1547, was revised to require DER to include a Sun Spec Modbus, IEEE 2030.5 (Smart Energy Profile, SEP 2.0), or IEEE 1815 (DNP3) communication interface but does not include any normative overarching cybersecurity requirements. IEEE 2030.5 and associated implementation requirements for California, known as the California Smart Inverter Profile (CSIP), prescribe the greatest security features - including encryption, authentication, and key management requirements. Sun Spec Modbus and IEEE 1815 security requirements are not as comprehensive, leading to implementation questions throughout the industry. Further, while the security features in IEEE 2030.5 are commonly used in computing platforms, there are still questions of how well the technologies will scale in highly-distributed, computationally-limited inverter environments. In this paper, (a) the elements of IEEE 2030.5 encryption, authentication, and key management guidelines are analyzed, (b) potential scalability gaps are identified, and (c) alternative technologies are explored for possible inclusion in DER interoperability or cyber security standards.

42 ENGINEERING↗
DOE OSTI2026

Cybersecurity Standards for Distributed Energy Resources: Gaps and Harmonization Strategy

This report examines cybersecurity standards for Distributed Energy Resources (DERs) in light of their rapid growth and increasing integration into energy systems. It identifies critical gaps in existing frameworks, including inadequate coverage of DER-specific challenges, complexities in implementing comprehensive standards, integration issues with legacy systems, adoption hurdles for newer standards, and a lack of harmonization across regulatory landscapes. The analysis highlights vulnerabilities such as data integrity risks, unauthorized device control, and denial-of-service attacks across various DER technologies like solar PV, wind turbines, energy storage systems, and hydrogen fuel cells. The report proposes a harmonization strategy to address these deficiencies by developing unified cybersecurity requirements, certification programs, and training resources while fostering collaboration among stakeholders such as government agencies, industry groups, DER operators, manufacturers, and research institutions. A phased roadmap is outlined to refine and implement these measures through pilot testing and widespread adoption. Ultimately, the report underscores the urgent need for coordinated efforts to enhance DER cybersecurity and ensure the reliable operation of future energy systems.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2026

Robotic automation of maintenance work in nuclear power plants a cross-sector survey and roadmap

Nuclear power plants face increasing cost pressures, workforce constraints (aging workforce and skilled labor shortages), and safety requirements that are accelerating interest in robotic systems for inspection and maintenance. We conducted semi-structured interviews with personnel from seven U.S. nuclear utilities and compared deployment models, operational use cases, and integration practices with those reported by participants in the oil, gas, and petrochemical sector. In nuclear plants, robotic use remains concentrated in inspection—particularly indoor unmanned aerial vehicles and submersible remotely operated vehicles—with limited application to physical maintenance tasks. Reported near-term value includes reduced radiological and industrial risk, reduced outage labor, and improved data for planning and condition assessment. Key barriers include integration and data-interoperability constraints, operator qualification requirements, cybersecurity review burden, and difficulty demonstrating reliability in plant-representative environments. Cross-sector benchmarking highlights organizational and deployment practices that may help nuclear plants scale from pilots to routine use. We propose a deployment-oriented roadmap emphasizing modular payload strategies, representative qualification pathways and testing environments, and improved data governance to support safe and economically justified expansion of robotics in operating nuclear power plants.

11 - NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗
DOE OSTI2019

Concepts for Autonomous Operation of Microreactors

Microreactor concepts have seen increasing interest in recent years given their potential use for meeting energy needs in remote and grid-isolated communities. Given the small power outputs of microreactors and the potential for remote siting, there is a need to reduce operational staffing levels to improve their economic viability. A key enabling technology for this purpose is autonomous control that enables autonomous operation of microreactors. While several options for autonomous control exist, the level of human operator involvement in operational decision making needs to be defined as part of the system design process. Once this separation of function is achieved, several options exist for autonomous control ranging from simple automation of some procedures to fully autonomous operational mode decision making and execution.A critical aspect of autonomous decision making is the ability to have as complete an awareness of the system state as possible. In addition to data on temperature, pressure, flow, and neutron flux, measurements of the condition of important components will be necessary. This type of information will allow the autonomous control system to adapt its decision making to any changing conditions within the reactor, thereby not compromising safety while continuing to operate for as long as possible. Several technical advances are needed before widespread use of autonomous control in microreactors. These include sensor and instrumentation technologies that are capable of long term, unattended operation in harsh environments, technologies for inferring the state of the microreactor system or subsystems in an automated fashion, algorithms for predictive decision making that account for the assessed condition of the microreactor subsystems as well as the potential impact on those components of any operational decision, and actuators and control system hardware that are also long-lived in a harsh environment. In addition, given the need to remotely monitor the operations, cybersecurity requirements will likely need to be imposed to ensure secure operations.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
NASA NTRS2009

TPSAS-NF1676L-10764-DND

An inter-agency NextGen air transportation system imposes stringent cybersecurity requirements. JPDO NCOD is working to coordinate the needs of the Agencies and industry partners in an effective information exchange.

Michael M Little↗