Cyber-Informed Engineering Principles

CIE Principle 1: Consequence-focused design

What is Consequence-focused design?

All CIE Principles

How do I understand what critical functions my system must ensure and the undesired consequences it must prevent? 

The consequence-focused design principle focuses analysis of cyber risk where a system function’s failure or manipulation through digital technology could lead to unacceptable or catastrophic outcomes. Rather than focusing on the potential attack paths and vulnerabilities for a system, this principle focuses on the process elements or critical functions that could catastrophically affect system safety, reliability or performance if subjected to manipulation by adversaries. Once identified, these functions and the undesired consequences become the highest priority for CIE analysis.

Learn About Consequence-Focused Design

How can I apply this principle?

To apply consequence-focused design, engineering teams should consider the following questions:

1

What critical organizational functions does this system support?

2

What high-consequence events associated with this system would be unacceptable due to their impact on mission delivery, safety, security, the environment, equipment and property, financial performance, or corporate reputation?

3

How are critical functions and high-consequence events documented, monitored for change and periodically reassessed?

4

What are the critical processes, operations and/or administrative actions that must function reliably to prevent unacceptable high-consequence events in this system? 

5

Which stakeholders (e.g., operations staff, engineering staff, executive leadership, external parties) would be affected by high-consequence events associated with this system and how are they involved in mitigation decisions?

CIE Principle in Action

Natural Gas Compressor Station

At a natural gas compressor station, overpressure and loss of containment are identified as unacceptable consequences due to the risk of explosion, injury, or service disruption. Applying consequence-focused design, engineers identify pressure control and emergency shutdown as critical functions that must be preserved under all conditions, including a digital risk consideration.[1] This leads to design decisions that ensure these functions remain effective even if digital components are degraded or compromised. This approach ensures system architecture, safeguards and operational decisions focus first on preventing catastrophic release, even in the presence of digital disruption.

[1] Cyber-Informed Engineering Power Generation Guide. https://www.osti.gov/servlets/purl/3021517

Previous
All principles
Next