DOE & INL Launch Cyber-Informed Engineering Program
DOE and INL Launch Cyber-Informed Engineering Initiative for Energy Sector
Related Entities
Organizations
Products & Tech
Full Report
Executive Summary
The U.S. Department of Energy's (DOE) Office of Cybersecurity, Energy Security, and Emergency Response (CESER) and Idaho National Laboratory (INL) have launched a new educational initiative called "Cyber-Informed Engineering (CIE) Back-to-School Weekly." This program is designed to fundamentally shift the energy sector's approach to cybersecurity by integrating security into the engineering and design lifecycle of critical infrastructure. The goal is to build systems that are inherently resilient to cyber threats, capable of preventing catastrophic failures even if digital defenses are breached.
Program Details
The initiative provides a structured learning path for energy professionals and engineers to adopt the 12 foundational principles of CIE. Delivered through a dedicated learning hub, the program will release new content weekly, with each module focusing on a specific principle, complete with a case study and practical application questions. The first module covers "Consequence-Focused Design," which prioritizes protecting against the most severe potential outcomes of an attack.
To further support adoption, CESER and INL have developed supplementary resources:
- A CIE Implementation Guide
- A web-based CIE Analysis Tool
- A forthcoming CIE Handbook to serve as a simplified entry point
This educational push is complemented by a $100 million funding opportunity via the Rural and Municipal Utility Cybersecurity (RMUC) program, aimed at bolstering the security posture of smaller electric utilities.
Affected Organizations
This initiative is primarily targeted at professionals and organizations within the U.S. energy sector, including:
- Engineers and system designers
- Critical infrastructure owners and operators
- Rural and municipal electric utilities
- Federal and state energy regulators
Core Principles of CIE
Cyber-Informed Engineering is built on the premise that cyberattacks on critical infrastructure are inevitable and that digital defenses alone are insufficient. CIE seeks to mitigate these risks by designing systems with engineered controls that can prevent destructive consequences. This involves thinking like an adversary to anticipate attack paths and building in physical or engineering-based safeguards. For example, designing a chemical process with a non-digital pressure release valve that prevents an explosion even if the control system is compromised.
Implementation Timeline
The "CIE Back-to-School Weekly" series began on October 14, 2026, and will continue with weekly content releases. A new CIE Handbook will be published at the conclusion of the series. The RMUC funding opportunity is also currently active, providing financial support for smaller utilities to adopt these and other cybersecurity measures.
Impact Assessment
The CIE initiative represents a significant strategic shift for the security of U.S. critical infrastructure. By moving security considerations "left" into the design phase, it aims to create a new generation of energy systems that are more resilient by nature. This reduces the reliance on bolt-on, reactive security measures and can lower the risk of catastrophic physical events resulting from cyberattacks. For smaller utilities, the associated funding provides a crucial opportunity to access technical assistance and technologies that might otherwise be out of reach.
Guidance for Adoption
Organizations in the energy sector are encouraged to:
- Engage with the Program: Participate in the weekly learning series and utilize the CIE Analysis Tool and other resources provided by DOE and INL.
- Cross-functional Collaboration: Foster collaboration between engineering teams, IT security, and operational technology (OT) security teams to integrate CIE principles into new projects.
- Apply for Funding: Eligible rural and municipal utilities should explore the $100 million RMUC funding opportunity to finance cybersecurity improvements.
- Adopt a Consequence-Driven Mindset: Prioritize security efforts based on mitigating the worst possible physical outcomes of a cyberattack, not just on preventing initial access.
Timeline of Events
MITRE ATT&CK Mitigations
A core principle of securing ICS environments, which aligns with CIE's goal of isolating critical components to limit the impact of a breach.
This is a key tenet of CIE, involving the use of non-digital, physical controls to prevent unsafe conditions, independent of the cyber domain.
CIE emphasizes designing systems where access is strictly controlled based on consequence, ensuring that even compromised accounts cannot trigger catastrophic failures.
D3FEND Defensive Countermeasures
Cyber-Informed Engineering is fundamentally about platform hardening at the system design level. Instead of just hardening a Windows server, CIE applies this concept to the entire physical process. For an electric utility, this means designing the grid with non-digital, physics-based fail-safes. For example, installing mechanical relays that physically prevent a generator from overloading, regardless of what malicious commands are sent from a compromised control system. Engineers should review their designs and ask: 'If the control software is completely compromised, what prevents a physical disaster?' The answer should be an engineered, non-digital control, not another piece of software. This approach hardens the entire operational platform against the most severe consequences of a cyberattack.
A key principle of CIE is strong network isolation, based on the Purdue Model for ICS. Critical control and safety systems (Levels 0 and 1) should be on a completely isolated network segment from the supervisory control (Level 2) and business networks (Levels 3 and 4). Data flow should be strictly controlled through a DMZ using unidirectional gateways where possible. This prevents an attacker who has compromised the corporate network from pivoting directly to the OT environment and manipulating physical processes. The CIE initiative encourages engineers to design these boundaries from the outset, rather than trying to segment a flat network after the fact, making security more robust and cost-effective.
Timeline of Events
The DOE and INL announce the launch of the 'CIE Back-to-School Weekly' series.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.