Search NASA⌕ Search

SEARCH · Search NASA

Results for “Supply Chain Risk Management”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 37 records · Page 2
All sourcesNASA NTRSDOE OSTI
DOE OSTI2024

SCA Tools - SCRM Value Add or Lossy Noise Machines

Software supply chain risk management (SCRM) depends upon accurate information regarding the software components that comprise any given software system. The collection of components included in a software package can be organized within a software bill of materials, or SBOM. SBOMs are ideally generated when the software components are put together, such as at compile time, but for many reasons that has not and is not always possible. For example, legacy or proprietary software packages often do not have SBOMs available to downstream consumers of that software. It’s not just end users that are affected, manufacturers themselves also must deal with this problem. To answer these questions, the market has seen the rise of several commercial software composition analysis (SCA) tools. These tools aim to peer into completed software systems, automatically identifying hidden software dependencies and looking up known vulnerabilities associated with those dependencies to enable end-users to enhance their cyber supply chain risk management processes. These tools are potentially a huge boon to end users of legacy and proprietary software – and a potential bane, depending on how accurate they are. This research asks that question – how accurate are currently available binary SCA tools – and provides answers to several other questions: What does it mean to be “accurate”? What limitations do the tools have in identifying common edge cases that take place in modern software development? Can they help you avoid a devastating supply chain attack, or is it all just noise? After researching SCA tools on the market, we identified three vendors that fit our use case and would provide analysis on compiled binaries. Using these tools, we submitted firmware for critical infrastructure devices for analysis and SBOM generation. The SBOM outputs were then cross referenced with SBOMs generated through manual analysis for comparison. In addition to the firmware samples, we also submitted edge case samples based off a popular open-source library that were specifically crafted to evaluate each tools’ ability to accurately identify components. These samples were customized to be consistent with modifications we have seen in modern software development as well as a couple that are representative of supply chain attacks.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

Modeling Cyber Supply Chain Incidents with Multilayered Graph Motifs

As noted within the literature, supply chain includes people and organizations---manufacturers, integrators, and third-party vendors---that are involved in one or more stages of a product lifecycle. Since supply chains, by definition, include organizations and people, supply chain risk management activities must consider dependencies between an organization's business processes and third-party resources. Just as adversarial tactics can be implemented via techniques implemented via networked computer systems, so can such tactics be expressed via legal business relationships. A cyber incident may have an exponential impact downstream, for example, by leveraging a product's distribution channel (e.g. malicious updates in SolarWinds, buggy updates in CrowdStrike). Similarly, legitimate and legal business relationships also affect the attack surface exposure of systems, enabling long-term persistence and/or unknown impacts to product quality that are hard to detect. This paper catalogs several recent digital supply chain incidents and applies a multilayered network formalism to develop structural indicators (graph motifs) that reflect potentially-adversarial behavior. Finally, we compare and contrast the characteristics of adversarial tactics (e.g. Loss of Availability, Data Collection) that leverage cyber-physical dependencies to those that leverage legal organizational relationships.

97 - MATHEMATICS AND COMPUTING↗
DOE OSTI2024

Securing Digital Energy Infrastructure: BESS Procurement Guidance & Sample Contract Terms

Presentation for Procurement webinar providing technical guidance for entities, procuring Battery Energy Storage Systems (BESS), Inverter Based Resources (IBR), Distributed Energy Resource Management Systems (DERMS) and other energy digital systems and services on how to incorporate cybersecurity requirements into the procurement process to enhance both supply chain security as well as entity-specific supply chain risk management (SCRM) programs.

99 GENERAL AND MISCELLANEOUS↗
NASA NTRS2020

NASA Fastener Procurement, Receiving Inspection, and Storage Practices for NASA Mission Hardware

This document establishes minimum requirements for supply chain risk management, procurement, receiving inspection, testing, traceability management, and storage practices for fasteners used in NASA mission hardware. This document does not contain fastener requirements pertaining to design or design analysis; design and design analysis requirements are contained in NASA-STD-5020, Requirements for Threaded Fastening Systems in Spaceflight Hardware.

Safety and Mission Assurance↗
DOE OSTI2025

Advanced Transmission Technologies –GETs and HPCs Session 3: HPCs and Building Actions Plans to Digital Assurance Risks

The third session of the Idaho National Laboratory’s (INL) Technical Assistance for Digital Assurance (TADA) program, held on November 11, 2025, centered on High Performance Conductors (HPCs) and the formulation of action plans to address digital assurance risks associated with Grid-Enhancing Technologies (GETs). This session convened experts from utilities, vendors, and government agencies to examine the technical, operational, and cybersecurity aspects of HPC deployment. Discussions highlighted the benefits of HPCs, such as their ability to rapidly increase transmission capacity using existing corridors, improve grid resilience, reduce system losses, and align with FERC Orders 2023 and 1920. Participants evaluated supply chain and digital assurance risks, including reliance on imported materials, limited domestic manufacturing capacity, workforce shortages, and traceability issues. The session also emphasized the importance of digital trust, integration-layer cybersecurity, and unified risk frameworks, introducing tools like intrusion detection systems, encryption, zero trust networking, and firmware integrity. Recaps of earlier workshops on Dynamic Line Ratings (DLRs), Advanced Power Flow Control (APFC), and Transmission Topology Optimization (TTO) underscored institutional barriers and integration challenges. Action plans were proposed to mitigate issues such as inconsistent cybersecurity practices, SBOM usage, supply chain visibility, operator trust, and misaligned incentives. Additionally, INL presented its supply chain risk management tools and Cyber-Informed Engineering (CIE) principles to support secure procurement and system design. The session concluded with a commitment to share key takeaways, incorporate cohort feedback into future policy development, and continue collaborative engagement through upcoming pilot activities. Session 3 of 3.

24 - POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2022

Characterizing manufacturing sector disruptions with targeted mitigation strategies

It has become clear in recent decades that manufacturing supply chains are increasingly vulnerable to disruptions of varying geographical scales and intensities. These disruptions—whether intentional, accidental, or resulting from natural disasters—cause failures and capacity reductions to manufacturing infrastructure, with lasting effects that can cascade throughout the manufacturing network. An overall lack of understanding of solutions to mitigate disturbances has rendered the challenge of reducing manufacturing supply chain vulnerability even more difficult. Additionally, the variability of disruptions and their impacts complicates policy maker and stakeholder efforts to plan for specific disruptive scenarios. It is necessary to comprehend different kinds of disturbances and group them based on stakeholder-provided metrics to support planning processes and modeling efforts that promote adaptable, resilient manufacturing supply chains. This paper reviews existing methods for risk management in manufacturing supply chains and the economic and environmental impacts of disruptions. In addition, we develop a framework using agglomerative hierarchical clustering to classify disruptions using U.S. manufacturing network data between 2000 and 2021 and characteristic metrics defined in the literature. Our review identifies five groups of disruptions and discusses both general mitigation methods and strategies targeting each identified group. Further, we highlight gaps in the literature related to estimating and including environmental costs in disaster preparedness and mitigation planning. We also discuss the lack of easily available metrics to quantify environmental impacts of disruptions and how such metrics could be included into our methodology.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2025

Advanced Transmission Technologies – GETs and HPCs Session 2: Advanced Power Flow Control and Transmission Topology Optimization

The INL TADA GETs Cohort Session 2, held on November 7, 2025, conducted in collaboration with ScottMadden, focused on two core Advanced Transmission Technologies (ATTs): Advanced Power Flow Control (APFC) and Transmission Topology Optimization (TTO). These technologies are pivotal in enhancing grid flexibility, reliability, and cybersecurity resilience. APFC, particularly through modular FACTS devices like Modular Static Synchronous Series Compensators (M-SSSCs), enables dynamic voltage injection to reroute power flows. The session highlighted the deployment benefits of APFC, such as rapid installation, minimal civil works, and re-deployability. Regulatory drivers like FERC Order 2023 mandate the inclusion of Grid-Enhancing Technologies (GETs) in interconnection studies. Case studies from Central Hudson, CAISO, and National Grid (UK) demonstrated APFC’s effectiveness in congestion relief and cost savings. The session also addressed cybersecurity concerns, including firmware vulnerabilities, SCADA integration risks, and supply chain dependencies. Participants engaged in interactive exercises to rank cybersecurity and supply chain risks, emphasizing the need for robust digital assurance strategies. TTO involves software-based reconfiguration of transmission networks to optimize power flow without new infrastructure. The session showcased its operational value, with examples from SPP, PJM, and MISO showing significant congestion cost reductions. Cybersecurity vulnerabilities were discussed, particularly in API security and software supply chains, referencing incidents like SolarWinds and attacks on Danish utilities. Digital assurance exercises explored worst-case scenarios, attack paths, and mitigation responsibilities between vendors and utilities. Reliability challenges such as algorithm stability, vendor dependency, and operator trust were also examined. Cross-cutting themes emphasized the importance of digital assurance tools, including Software Bills of Materials (SBOMs) and hardware-in-loop testing. Human performance, training, and operational confidence were identified as critical enablers of technology adoption. The session concluded with a preview of Session 3, which will focus on High Performance Conductors (HPCs) and risk-based cybersecurity tools. Session 2 of 3.

24 - POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2025

Advanced Transmission Technologies – GETs and HPCs Session 1: ATT Foundations and Dynamic Line Ratings (DLRs)

The INL TADA GETs Cohort Session 1, held on November 4, 2025, convened experts to address the integration of advanced transmission technologies, including Grid-Enhancing Technologies (GETs) and High Performance Conductors (HPCs), with a focus on digital assurance challenges. The session highlighted the growing importance of cybersecurity, supply chain transparency, reliability, and business risk management in deploying GETs, especially Dynamic Line Ratings (DLRs). Participants examined how expanded attack surfaces, limited vendor pools, and new regulatory requirements—such as FERC Orders 881, 2023, and 1920—are influencing utilities and technology providers. The workshop underscored the need for cyber-informed engineering, secure-by-design principles, and practical risk management strategies, while fostering collaboration and knowledge sharing among industry peers. Technical discussions covered the evolution from static to dynamic line ratings, complexities of cloud-based architectures, and NERC CIP compliance challenges. The session concluded with a collaborative risk exercise and a preview of future workshops on advanced power flow control and transmission topology optimization, reinforcing the cohort’s commitment to advancing digital assurance in the energy sector.

24 - POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2021

Vind: A Blockchain-Enabled Supply Chain Provenance Framework for Energy Delivery Systems

Enterprise-level energy delivery systems (EDSs) depend on different software or hardware vendors to achieve operational efficiency. Critical components of these systems are typically manufactured and integrated by overseas suppliers, which expands the attack surface to adversaries with additional opportunities to infiltrate into EDSs. Due to this reason, the risk management of the EDS supply chain is crucial to ensure that we are knowledgeable about the vulnerabilities in software and hardware components that comprise any critical part, quantifiable risk metrics to assess the severity and exploitability of the attack, and provide remediation solutions that can influence a prioritized mitigation plan. There is a need to realize cyber supply chain risk management for industrial control systems’ hardware, software, and computing and networking services associated with bulk electric system (BES) operations. This article proposes a blockchain-based cyber supply chain provenance platform (“Vind”) for EDSs to realize data provenance in a cyber supply chain ecosystem.

Bandara, Eranga↗
NASA NTRSDate not supplied

Climate Information and Lessons Learned from the NASA Earth eXchange (NEX), Short-term Prediction Research and Transition Center (NASA SPoRT), and the NASA Regional Climate Model Evaluation System (RCMES)

Climate resilience can emerge from a combination of (1) climate projections that enable future-oriented planning and (2) contemporary observations that can be used for adaptation in the face of realized climate. NASA is uniquely positioned to provide global climate projections and satellite-based observations to users who must take a global perspective on climate risk (e.g., supply chain managers). Here, we will share the capabilities and experiences of three NASA projects. The first project, the NASA Earth eXchange (NEX) provides two downscaled climate projections, NEX-GDDP-CMIP6, a global 25 km resolution product, and NEX-DCP30-CMIP6, an 800 m resolution product covering the coterminous U.S. specifically designed for U.S. National Climate Assessment (NCA). NEX also offers land surface products that mirror the twice-daily products provided by the Moderate Resolution Imaging Spectroradiometer (MODIS) but are derived from operational geostationary weather satellite data collected at 5-10 minutes intervals. The second project, the Short-term Prediction Research and Transition Center (SPoRT), was established in 2002 to transition unique NASA satellite products and capabilities to stakeholders to improve decision-making that benefits society. SPoRT provides products and capabilities derived from NASA observations and models to end users in government, academia, and the private sector. SPoRT translates NASA Earth science into actionable solutions reaching over 400 stakeholders across 80 organizations. Finally, the Regional Climate Model Evaluation System (RCMES) is designed to facilitate regional-scale evaluations of climate models by providing standardized access to a vast and comprehensive set of observations, such as satellite, in-situ, and reanalyses, and modeling resources such as CMIP & CORDEX. These three projects form part of the core capabilities at the NASA Centers deliver climate information under the new NASA Earth Science to Action (ES2A) strategy.

NEX↗
NASA NTRS2019

Utilizing Supply Chain Assessments to Achieve Excellence, Reduce Risks and Improve Processes

Utilizing Supply Chain Assessments to Achieve Excellence, Reduce Risks and Improve Processes Supply Chain Management: Why it is important Strategic Challenge: Supply Chain RisksHistory of supply chain assessments at GoddardExamining case studies on successes and lessons learnedEnabling teams to develop tools to manage GSFC supply chainGaining supplier insight through IT tools that combines supplier data and provides supplier alerts

Risk Management↗
DOE OSTI2026

System-Level Integration of Modular Language Models for Real-Time Risk Assessment in Third-Party Risk Management Systems

Large enterprises typically rely on dedicated teams to govern and implement security measures throughout their supply chains, ensuring compliance with enterprise security procedures. There is a significant reliance on Third-Party Risk Management (TPRM) platforms, which often require complete, highly structured information from potential vendors. The review and compliance assurance processes are time- and labor intensive, often requiring several rounds of review between the supply chain security risk management teams, business users, and potential vendors, leading to delays in the supply chain processing and consumer experience. Significant challenges in the risk management paradigm include handling unstructured data in various formats and providing real-time feedback to users to reduce the required review time. This paper presents a novel solution to these challenges. A modular multi-step system architecture is proposed using advances in language processing, specifically for unstructured responses and provides real-time feedback (i.e., 3 seconds) so that users can improve their responses before the TPSRM team review. This novel system architecture will increase information accuracy and significantly reduce time and labor during the review process.

99 - GENERAL AND MISCELLANEOUS↗
NASA NTRS2015

Modular Open System Architecture for Reducing Contamination Risk in the Space and Missile Defense Supply Chain

To combat contamination of physical assets and provide reliable data to decision makers in the space and missile defense community, a modular open system architecture for creation of contamination models and standards is proposed. Predictive tools for quantifying the effects of contamination can be calibrated from NASA data of long-term orbiting assets. This data can then be extrapolated to missile defense predictive models. By utilizing a modular open system architecture, sensitive data can be de-coupled and protected while benefitting from open source data of calibrated models. This system architecture will include modules that will allow the designer to trade the effects of baseline performance against the lifecycle degradation due to contamination while modeling the lifecycle costs of alternative designs. In this way, each member of the supply chain becomes an informed and active participant in managing contamination risk early in the system lifecycle.

Seasly, Elaine↗
DOE OSTI2023

The Benefits of a Software Bill of Materials Program at Nuclear Facilities

Software supply chain attacks are becoming increasingly more prevalent in both information communications technology and operational technology environments. Often, a supplier or other entity discloses vulnerability information about software components and subcomponents used in a digital asset, but an asset owner is unable to quickly ascertain if the vulnerable component is installed in their facility. The generation and use of a software bill of materials (SBOM) for installed digital assets can enable an asset owner to quickly identify if and where a component is used, allowing them to evaluate the risk and determine necessary risk treatments. The integration of an SBOM program into a nuclear facility not only improves vulnerability management and risk management processes, it also benefits asset and configuration management, cybersecurity, and supply chain programs. This paper reviews the U.S. Department of Energy Office of Nuclear Energy Cybersecurity Crosscutting Technology Development program’s work on integrating an SBOM program into a nuclear facility. It also provides a discussion on the benefits of such a program.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗