The draft of NIST’s revision for their Guide to OT Security, now open for comments, includes an appendix on OT security organizations, research and activities, including a section for “INL Cyber-Informed Engineering (CIE) and Consequence-Driven Cyber-Informed Engineering (CCE)”

The Department of Energy and Idaho National Laboratory have developed a framework to guide the application of cybersecurity principles across the engineering design life cycle. The CIE framework and body of knowledge drives the inclusion of cybersecurity as a foundational element of risk management for engineering functions aided by digital technology.

CCE is a rigorous process for applying CIE’s core principles to a specific organization, facility, or mission by identifying their most critical functions, and the methods, and means an adversary would likely use to manipulate or compromise those critical functions, then determine the most effective means of removing or mitigating those risks. CIE emphasizes “engineering out” potential risk in key areas, as well as ensuring resiliency and response maturity within the design of the engineered system.

The following CIE framework shows some of the key focus areas and how they relate to the CCE methodology. CCE walks an organization through core components of CIE in CCE’s four-phase process to evaluate and remove or mitigate weaknesses in their critical functions.