PNNL

Abstract

Technology innovation, market demand, and the potential impacts of a changing climate are driving the marine renewable energy (MRE) industry to develop market-ready systems to provide low-carbon electricity for emerging, off-grid markets. The advanced operational and information technology devices used in MRE systems create a pathway for a cyber threat actor to gain unauthorized access to data or disrupt operation. To improve the resiliency of MRE systems as a predictable, affordable, and reliable source of energy from oceans and rivers, guidance was developed for end user’s organization that describes an MRE framework for identifying and managing cybersecurity risk from the effects of a cyberattack. The development of the cybersecurity guidance is based on standards described in the Risk Management Framework and Cybersecurity Framework developed by the National Institute of Science and Technology (NIST). This paper is the first of a two-part series. which describes an approach to determine the cybersecurity risk for MRE systems based on assessing potential cyber threats, identifying vulnerabilities (people, processes, and technology), and evaluating the consequences a cyberattack would have on operation of the MRE system and impact on end users’ mission and business objectives. MRE developers and stakeholders can use this approach to assess their current cybersecurity risk posture in order to incorporate appropriate cybersecurity controls to reduce the effects of a cyberattack on MRE systems.