CIE Principle 4: Design simplification
What is design simplification?
How do I determine which features of my system are not absolutely necessary to achieve the critical functions?
The design simplification principle reduces unnecessary complexity in system architecture, components and digital functionality that does not directly support critical functions. We should carefully assess features connected to critical functions or that could lead to previously identified high-consequence events. Excess features, interfaces, and dependencies can expand attack pathways, obscure system behavior, and introduce failure modes that are difficult to predict or control.
This principle calls for deliberate evaluation of each system function and interface to determine whether its operational value justifies the risk it introduces. Those that offer limited benefit but increased exposure, such as unused services, remote or external connections, excessive configurability, or opaque automation logic, should be removed, constrained, or monitored. The goal is a system that is transparent, predictable, and easier to secure, operate, and verify under adverse conditions.
Learn About Design Simplification
How can I apply this principle?
When applying design simplification, ask yourself these key questions to identify which features are essential and which can be simplified or removed:
How is each system feature and design element traceable to specific project requirements or critical operations and processes?
Where are opportunities to simplify or eliminate device/system elements or features that are not necessary to meet the minimum required functional capabilities and defined system requirements?
Where system features or design elements cannot be eliminated, how can we replace them with nondigital alternatives, constrain their functionality or monitor their use and outputs?
How would a given design simplification introduce tradeoffs (e.g., loss of redundant control, reduced reliability, reduced operator visibility) that conflict with other stakeholder requirements or downstream dependencies?
Securing Solar Power Controls by Eliminating Remote Access
A solar power system uses a cellular modem to enable remote firmware updates and performance tuning by the vendor. While convenient, this connectivity creates a direct external pathway into equipment that controls real and reactive power output (i.e., a critical function). Applying the design simplification principle, engineers determine both an out-of-band communication mode and continuous remote access are not required for stable power conversion. They work with the vendor to disable the cellular modem and require firmware updates through an organizationally controlled, local maintenance interface. The system continues to perform its critical function while eliminating an unnecessary external access vector that could enable unsafe operating commands.