Federal Energy Management Program’s Distributed Energy Resource Cybersecurity Framework
Supports Power Sector Resilience in the Caribbean and Beyond
Island communities face unique energy security challenges due to their remote geographic
locations and high energy costs. These challenges, coupled with extreme weather hazards,
physical threats, and cyberattacks, pose risks to island communities’ access to resilient,
reliable, and affordable energy.
Over the past three years, the U.S. Agency for International Development (USAID) and the National Renewable Energy
Laboratory (NREL) collaborated with decision makers, governments, and utilities across island communities
in Latin America and the Caribbean to support power sector resilience.
USAID and NREL worked closely with the Caribbean Electric Utility Services Corporation (CARILEC) and its community group, CARILEC Resilient Energy Community, to promote cybersecurity best practices in topics ranging from governance, or cybersecurity
strategy, to incident response. In addition, NREL’s cybersecurity researchers worked
closely with utilities to improve their overall security posture through one-on-one
trainings and technical assistance.
The collaboration with CARILEC is a multiyear joint effort that has included several
implementation partners and encompassed a webinar series, technical support, and access
to NREL’s Distributed Energy Resource Cybersecurity Framework (DER-CF), a tool funded by the U.S. Department of Energy’s Federal Energy Management Program. Originally designed for federal building owners, the DER-CF enables site owners
in the federal sector and beyond to benchmark and evaluate their cybersecurity controls
to improve governance, technical management, and physical security at various types
of facilities.
In a recent webinar, NREL researchers and members from CARILEC, USAID, Trinidad and Tobago Electricity Commission, and Guyana Power and Light reflected on their long-standing collaboration and the lessons learned in energy
development. They overviewed the DER-CF tool and discussed the tool’s assessment process
and other resources for cybersecurity assessments. Working together with NREL and
USAID, the utilities identified priority cybersecurity domains and began creating
roadmaps to improve their security posture against digital threats.
Utilities across Latin America and the Caribbean have faced several pressing cybersecurity
challenges that the DER-CF and other cybersecurity assessment tools can help overcome.
Those utilities in the early stages of adopting new cybersecurity solutions for energy
generation found the access to standard frameworks and expert feedback invaluable
for identifying areas for improvement.
“The DER-CF was very valuable because it gave us a point to get started on improving
our cybersecurity with a known standard and known framework with advice behind it,”
said Vijay Datadin, divisional director of informational technology for Guyana Power
and Light. “This was very valuable to me personally and my team—to get good direction.”
Additionally, utilities that have already completed security assessments were able
to use the tool to review all major cybersecurity disciplines and analyze governance
structure as it pertains to both Informational and Operational Technology frameworks.
Using DER-CF assessment results, IT teams were able to identify weaknesses and bolster
existing physical and digital cybersecurity infrastructures.
“When you’re trying to secure both an IT system and operational technology at the
same time, it’s really easy to get overwhelmed, lose focus, forget where you’re going,
go off the rails, and get sidetracked, but when you’re using something that is helping
you constantly find a true north, that’s really valuable,” said Roger Browne, senior
IT security administrator at the Trinidad and Tobago Electricity Commission. “When
I was doing the assessment, regardless of the challenge or the type of questions,
we always had access to a whole bunch of experts.”
In addition to the DER-CF, the partnership between USAID and NREL provided utilities
across Latin America and the Caribbean with access to a host of global technical platforms
and offered long-term support on common and critical challenges encountered when scaling
up advanced energy systems. The platforms include the following:
- Resilient Energy Platform: Developed through the USAID-NREL partnership, The Resilient Energy Platform provides
resources, training materials, data, tools, and direct assistance in planning resilient,
sustainable, and secure energy systems. - REexplorer: This suite of geospatial and analytical tools helps developers and policymakers
make meaningful decisions for accelerating renewable energy planning and development. - Greening the Grid: The Greening the Grid platform offers toolkits of information, technical assistance,
and guidance to countries looking to significantly scale up the quantity of variable
renewable energy on their grid. - International Jobs and Economic Development Impacts model: This tool analyzes economic impacts and estimates key factors of renewable energy
development to align with economic development goals.
Continuing Cybersecurity Support
NREL’s cybersecurity researchers continue to collaborate with a variety of partners
to provide technical support on the DER-CF and other platforms. Although the USAID-NREL
partnership’s cybersecurity activities in Latin America and the Caribbean are concluding,
CARILEC Resilient Energy Community is launching a cybersecurity working group for
utilities and other power sector stakeholders to share advice and best practices.
NREL will support this working group to help regional utilities bolster their resilience
and keep island-based energy grids secure as they transition to a more sustainable
energy future.
Learn more about NREL’s cybersecurity and resilience assessments around the world.
Interested in partnering with NREL for cybersecurity technical assistance? Contact
Tami Reynolds.