Search NASA⌕ Search

SEARCH · Search NASA

Results for “risk management”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 37 records · Page 2

Unlocking the benefits of transparent and reusable science for climate-risk management

People around the world seek climate-risk information to guide their decisions. For instance, projections about future flood risk inform where households choose to live, how lenders manage credit risks, and which communities receive federal funding. Yet data limitations and fundamental validation challenges raise important concerns about the reliability of such projections. The principles of transparency and reusability help address these concerns by enabling scrutiny of assumptions and methods, development of foundational data and tools, and consistent application of evaluation standards. While there is ongoing debate about how much transparency commercial climate-risk services should provide, many expect non-commercial actors to lead the way on operationalizing transparency and reusability to fulfill their knowledge-building role in the climate-risk ecosystem. However, despite prominent success stories, we find a substantial gap between principles and practice: only four percent of the most-cited peer-reviewed climate-risk studies in recent years fully share their data and code despite this being a widely accepted minimum standard for transparency. We highlight low-cost measures that non-commercial researchers can take now to improve transparency and reusability. We also emphasize that transformative progress requires substantial investment, cross-sector collaboration, and careful consideration of tradeoffs, data rights, and multiple perspectives on equity. We hope this perspective accelerates both immediate actions and longer-term conversations to improve the ability of science to effectively support timely, evidence-based, and sound climate-risk management.

Open Science↗

Distributed Energy Resources Cybersecurity Framework & Risk Manager

Distributed Energy Resource Cybersecurity Framework (DER-CF) provides a holistic assessment for evaluating the cybersecurity posture of DER systems - filling an important gap that expands upon existing cybersecurity frameworks for more modern energy systems. The DER-CF is available as a written framework and an interactive Web tool. Distributed Energy Resource Risk Manager (DER-RM) process adheres closely to NIST's seven risk management steps: prepare, categorize, select, implement, assess, monitor, and authorize. This added feature is independent of the DER-CF's existing self-assessment and allows managers to focus on the RMF process.

cybersecurity↗

Efficient Extraction Of Building Elevation Attributes For Flood Risk Management Using Airborne LiDAR Data

In this paper, we address the need for extracting two key building elevation attributes—Lowest Adjacent Grade (LAG) and Highest Adjacent Grade (HAG)—which are crucial for effective flood risk management. Conventional methods, involving onsite surveying or the use of optical imagery-derived building footprints combined with Digital Elevation Models (DEMs), often face misalignment and time discrepancy issues due to varied remote sensing sources. We introduce a new, scalable method that exclusively relies on airborne LiDAR data to overcome these challenges. Our approach employs an object-based ground filtering technique, and the results were evaluated using two different DEMs and building footprint sets. The findings demonstrate that our single-source method, utilizing only airborne LiDAR data, significantly improves the accuracy of LAG and HAG calculations compared to traditional methods that use hand-digitized building footprints. The proposed approach offers a solution for comprehensive flood risk management endeavors.

Song, Hunsoo↗

Risk Management for Distributed Energy Resources

The National Institute of Standards and Technology will be hosting on Tuesday, February 2 and Wednesday, February 3, 2021, the second workshop in a new series focusing on the Open Security Controls Assessment Language. NREL extended the scope of the DERCF to include the NIST Risk Management Framework (RMF), addressing the challenges faced by federal energy managers when complying with the NIST RMF for DER systems. The NIST RMF is a cyclical process designed to incorporate principles of security and risk management into an organization’s system policies and procedures. The DER-RM will be downloadable application that runs locally and documents all the major requirements for achieving Authority to Operate the DER.

cybersecurity↗

Distributed Energy Resources Cybersecurity Framework: Applying the NIST Risk Management Process

In an effort to strengthen the cybersecurity posture for federal agencies and reduce the time and complexities of following the Risk Management Framework (RMF) six-step process, the National Renewable Energy Laboratory has dedicated research into expanding the existing Distributed Energy Resources Cybersecurity Framework to provide functionality that aids in the RMF steps. Users will have the opportunity to learn, document, and review the framework, saving time and resources. Existing functionality within the web application will continue to be available with added features for usability.

14 SOLAR ENERGY↗

Cybersecurity Supply Chain Risk Management: Forge Institute Presentation

In this talk, INL will discuss how to develop a cyber supply chain risk management program, to include assessment of vendor risk and applying appropriate mitigations. INL will discuss key risk factors and the challenges of securing supply chain in complex and dynamic vendor environments. Finally, INL will share example language that can be adopted in RFPs and procurement contracts to promote supply chain security.

battery energy storage system↗

Integrating Qualitative and Quantitative Aspects of Risk Management

This topical report summarizes the integration of qualitative and quantitative aspects of the risk management workflow for the Southwest Regional Partnership on Carbon Sequestration (SWP) Phase III Demonstration Project, located near the community of Farnsworth in northernmost Texas. Detail on some aspects of this subject has been previously provided in internal project reports on qualitative risk assessment processes, in a published paper summarizing quantitative risk modeling, and in many other published papers on specific risk modeling efforts. These prior documents are cited but the details are not repeated here. The report documents work undertaken for Task 7.4.1 of U.S. Department of Energy award number DE- FC26-05NT42591.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗

Creating a Resilience Risk Management Plan

This fact sheet provides actionable planning steps for developing a resilience roadmap in your organization. These steps can serve as an outline to help portfolio managers and other stakeholders manage the financial performance of a commercial building portfolio.

Resilience, Resiliency, Commercial building, comme↗

Systematic Enterprise Risk Management by Integrating the RISMC Toolkit and Cost-Benefit Analysis (Final Report)

The goal of this research is to theorize and quantify the relationships between safety and the financial performance of nuclear power plants (NPPs). The Socio-Technical Risk Analysis (SoTeRiA) theoretical framework, which connects the social aspects (e.g., safety culture) and structural features (e.g., safety practices) of an organization with organizational safety and financial risks, is used to theorize the direct and indirect relationships between safety and the financial performance of NPPs. An Integrated Enterprise Risk Management (I-ERM) methodological framework is developed to operationalize SoTeRiA to quantify NPP safety and financial performance in a unified platform where their underlying physical degradation mechanisms, coupled with maintenance performance (considering human and organizational factors), are explicitly incorporated to depict the interconnections and dependencies between safety and financial performance. In this study, NPP safety refers to both occupational safety and system safety (estimated from Probabilistic Risk Assessment, PRA), and financial performance refers to the monetary values associated with NPP operation and maintenance (O&M) strategies. This report covers a case study demonstrating the feasibility of the I-ERM methodological framework. More detailed development of one of the I-ERM modules, i.e., Probabilistic Physics-of-Failure (PPoF) analysis, and its connection with other I-ERM modules is demonstrated in a second case study. The outcome of this research will help NPP decision-makers create cost-saving maintenance strategies while maintaining safety by providing cost- and risk-informed recommendations regarding maintenance work processes and operational strategies.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗

Solar PV, Wind Generation, and Load Forecasting Dataset for ERCOT 2018: Performance-Based Energy Resource Feedback, Optimization, and Risk Management (P.E.R.F.O.R.M.)

This report describes the Advanced Research Projects Agency-Energy Performance-Based Energy Resource Feedback, Optimization, and Risk Management (PERFORM) Electric Reliability Council of Texas (ERCOT) dataset consisting of load, solar, and wind deterministic and probabilistic forecasts at three timescales. This dataset consists of 1 year of time-coincident load, wind, and solar actuals and probabilistic forecasts for a region similar to ERCOT. All the data are stored in Hierarchical Data Format 5 (HDF5) files and have been uploaded to an Amazon Web Services repository. The ERCOT data set has 2 years (2017, 2018) of actuals and 1 year (2018) of probabilistic forecasts. These data are provided at various spatial (i.e., site-level, zone-level, and system-level) and temporal scales (i.e., day-ahead, intraday, and intra-hour). Specifically, data are provided for 125 existing wind sites, 22 existing solar sites, 139 proposed wind sites, and 204 proposed solar sites.

14 SOLAR ENERGY↗

Integrated Issues and Risk Management: A Theoretical Framework Overview

The contractor requirements document for DOE O 226.1B, Implementation of Department of Energy Oversight Policy, requires DOE/NNSA contractors to establish an assurance system that includes, among other things, “Rigorous, risk-informed, and credible self-assessment and feedback and improvement activities. Assessment programs must be risk-informed, formally described and documented, and appropriately cover potentially high consequence activities” and “Contains an issues management process that is capable of categorizing the significance of findings based on risk and priority and other appropriate factors….” However, the term “risk-informed” is not defined in this or any other DOE order, and no formal guidance on how to integrate the two concepts currently exists. The Risk Management Guide for Defense Programs released by NA-18, Office of Systems Engineering and Integration (SE&I), states it is “a framework and general guidance to program office personnel on the effective management of program risks and issues”, however it then defines issues as “events with 100% likelihood of affecting program objectives” and states “unless specified otherwise, the term “risk” will also serve to represent issues for the remainder of this plan,” severally limiting its ability to provide adequate guidance on this topic. Outside of DOE scope, the U.S. Nuclear Regulatory Commission (U.S. NRC) imposes similar requirements. ASME NQA-1-2015 Requirement 16 states “Conditions adverse to quality shall be identified promptly and corrected as soon as practicable. In the case of a significant condition adverse to quality, the cause of the condition shall be determined, and corrective action taken to preclude recurrence. The identification, cause, and corrective action for significant conditions adverse to quality shall be documented and reported to appropriate levels of management. Completion of corrective actions shall be verified”. The purpose of this document is to provide a best-in-class framework for an integrated risk and issues management process. This process would provide a robust feedback loop between risk management and issues management to: Enhance risk identification and characterization, use risk handling principles to improve corrective action planning, and ensure regulatory compliance.

96 KNOWLEDGE MANAGEMENT AND PRESERVATION↗

Data Center Cybersecurity, Supply Chain Risk Management, and Emerging Regulation Cohort Summary: Takeaways and Action Plans

This report summarizes the outcomes of the Data Center Cohort under the Department of Energy’s Technical Assistance for Digital Assurance (TADA) initiative, aimed at enhancing grid resilience through cybersecurity, supply chain risk management (SCRM), and Cyber-Informed Engineering (CIE). The cohort engaged 17 organizations across utilities, data center operators, vendors, and technology providers in three sessions combining presentations, discussions, and exercises. Key topics included AI-driven load behavior, cybersecurity vulnerabilities in UPS/BESS and cooling systems, governance gaps at utility–data center boundaries, and supply chain integrity. Five cross-cutting themes emerged: interconnection architecture vulnerabilities, fragmented governance, AI-driven stability risks, lack of regulatory frameworks, and long-term supply chain concerns. Actionable recommendations were developed, including implementing DMZ segmentation, formalizing vendor access agreements, designing AI workload limits, and advancing standards through NERC and state-level programs. These strategies aim to strengthen resilience, clarify responsibilities, and ensure secure integration of data centers into the grid.

24 - POWER TRANSMISSION AND DISTRIBUTION↗

The enduring role of contracts for difference in risk management and market creation for renewables

Governments procure renewables through a variety of mechanisms. Contracts for difference (CfDs) have been used for more than 50% of the global offshore wind supply. The payments awarded through CfDs are sometimes labelled subsidies, suggesting that they support uneconomic activity. Here, in this study, we argue that the primary role of CfDs is rather risk management by creating a market for electricity supply at stable long-term prices. Similar to its use in other sectors of the economy, this contract type transforms a variable to a fixed price to reallocate volatility risks. Such long-term contracts are often necessary for renewables financing due to limited hedging options in existing markets. Our perspective could imply a shift in perception towards CfDs as a fundamental and lasting market feature. We hope to stimulate a timely discussion about the impact of greater CfD diffusion on electricity market mechanisms, risk allocation and the potential for combining fragmented streams of energy finance, market and policy research.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗

A Cyber-Resilience Risk Management Architecture for Distributed Wind

Distributed wind is an electric energy resource segment with strong potential to be deployed in many applications, but special consideration of resilience and cybersecurity is needed to address the unique conditions associated with distributed wind. Distributed wind is a strong candidate to help meet renewable energy and carbon-free energy goals. However, care must be taken as more systems are installed to ensure that the systems are reliable, resilient, and secure. The physical and communications requirements for distributed wind mean that there are unique cybersecurity considerations, but there is little to no existing guidance on best practices for cybersecurity risk management for distributed wind systems specifically. This research develops an architecture for the consideration of cyber risks associated with distributed wind systems. The architecture takes into account the configurations, challenges, and standards for distributed wind to create a risk-focused perspective that considers of threats, vulnerabilities, and consequences, with special emphasis on what sets distributed wind systems apart from other distributed energy resources (DER). We discuss common distributed wind architectures and how they are interconnected to larger power systems. Because cybersecurity cannot exist independently, the cyber-resilience architecture must consider the system holistically. Finally, we discuss the implementation of a risk assessment process that uses the cyber-resilience framework to address challenges specific to distributed wind.

17 WIND ENERGY↗

Guide to the Distributed Energy Resource Risk Management Framework

The emergence of distributed energy resources (DERs) has transformed the electric power sector and will likely have even more profound impacts on the future evolution of the United States energy sector as it modernizes and becomes more reliant upon complex informatics programming and systems to ensure that our power grid remains safe from malicious interference. To mitigate risks associated with the increased and diversified use of DERs, the Distributed Energy Resource Cybersecurity Framework (DER-CF) was developed in 2019. The National Renewable Energy Laboratory extended the scope of the DER-CF to include the RMF. To address the challenges faced by federal energy managers and energy system stakeholders in applying the RMF to DER systems, the Distributed Energy Resource Risk Manager (DER-RM) is a six-step process to proactively manage cybersecurity risk in a methodical manner. The DER-RM is independent of the DER-CF's existing assessment, allowing users to focus specifically on the RMF steps. The tools are targeted to different processes - DER-CF enables organizations to perform self-assessments to improve their cybersecurity posture, while DER-RM assists organizations in achieving compliance with specific requirements. This document provides an overview of the DER-RM. The RMF process outlined in this report serves as a guide to diagnose information and operational system threats, gather required materials to comply with industry standards, and document plans for achieving Authority to Operate. Using the DER-RM, federal agencies and other organizations can easily and intuitively follow the RMF process, manage the risks to their grid-edge infrastructure through the integration of their on-site DERs, and comply with appropriate requirements.

24 POWER TRANSMISSION AND DISTRIBUTION↗

Cybersecurity Resiliency of Marine Renewable Energy Systems Part 2: Cybersecurity Best Practices and Risk Management

Marine renewable energy (MRE) is an emerging source of power for marine applications, marine devices, and coastal communities. This energy source relies on industrial control systems and IT to support operations and maintenance activities, which create a pathway for an adversary to gain unauthorized access to systems and data and disrupt operations. Incorporating cybersecurity risk prevention measures and mitigation capabilities from inception, development, operation, to decommissioning of the MRE system and components is paramount to the protection of energy generation and the security of network architecture and infrastructure. To improve the resilience of MRE systems as a predictable, affordable, and reliable source of energy, cybersecurity guidance was developed to enable operators to assess cybersecurity risks and implement security measures commensurate with the risk. This publication is the second of a two-part series, with Part 1 addressing a framework to determine cybersecurity risk by assessing the vulnerability of an MRE system to potential cyber threats and the consequences a cyberattack would have on the end user. This Part 2 publication describes an approach to select appropriate cybersecurity best practices commensurate with the MRE system's cybersecurity risk. The guidance includes 86 cybersecurity best practices, which are associated with 36 cybersecurity domains and grouped into nine categories. The best practices follow the core functions of the National Institute of Science and Technology Cybersecurity Framework (e.g., identify, detect, protect, respond, and and recover) and insights from both maritime and energy industry guidance documents to identify security measures effective in protecting information and operational technology assets prevalent in MRE systems.

97 MATHEMATICS AND COMPUTING↗