With funding from the US Department of Energy (DoE), Idaho National Laboratory (INL) is assembling a body of knowledge – relevant parts of safety engineering, protection engineering, automation engineering, network engineering, and of course cybersecurity and the NIST CSF. My own experience is that CIE is very often, but not always, received very warmly. I was curious to get another couple of data points as to how other people perceived it, and the reactions they observe in their part of the OT security community. So, I asked…

Marc responded “Involving the engineering community reframes digital security as a risk area that can be mitigated with engineering principles and practices. Rather than addressing computer science issues within OT or IC systems, engineers can apply physical laws and mathematical principles to design infrastructure resilient to cyber attacks.”

Sarah responded “Cyber-Informed Engineering matters because it emphasizes the need of hearing the engineer’s perspective on cybersecurity. This is both the emphasis on consequence (real-world plant consequence, not some ephemeral CIA triad) and on engineered controls, including aspects that are not in the cyber realm and cyber usually takes for granted or regards as out-of-scope.”

Aaron responded “CIE’s most important contribution is how it fosters collaboration across different domains, creating a culture where stakeholders from engineering, IT, and cybersecurity work together. This collaborative approach elevates threat modeling to the next level because it engages key personnel (like control room leads) who understand real-world operational access points and vulnerabilities.”

These all make a lot of sense to me. CIE calls out powerful tools that engineering teams can use to address cyber risk – tools that are not even mentioned in the NIST CSF, ISO 27001, nor even in the industrial IEC 62443 standards. In my experience, the realization that these engineering risk mitigation tools exist, in addition to cybersecurity mitigations, for the first time brings engineering teams to the cyber risk management table as equals. This makes cooperation easier, puts more options on the table, and results in more effective risk management strategies. And CIE’s emphasis on tackling the highest credible consequences first is consistent with the engineering perspective as well – deal with the “big fish” first and you almost always find that your “big fish” mitigations have already addressed the high-frequency, lower consequence threats as well.