Search NASA⌕ Search

SEARCH · Search NASA

Results for “Capability Maturity Model”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records
All sourcesNASA NTRSDOE OSTI
DOE OSTI2023

User Guide to the Facility Cybersecurity Capability Maturity Model (F-C2M2) Assessment

The Facility Cybersecurity Capability Maturity Model (F-C2M2) assessment was designed to help facilities address their unique cybersecurity challenges. Building upon the foundational principles of the U.S. Department of Energy (DOE) Cybersecurity Capability Maturity Model (C2M2), the F-C2M2 was explicitly tailored for federal facilities to help evaluate, benchmark, and enhance the cybersecurity capabilities of both their information technology (IT) and operational technology (OT) environments. This user guide was developed to facilitate a thorough understanding of the tool. Whether users are familiar with the original C2M2 or are new to the maturity model concept, this guide was designed to offer clarity, direction, and support.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2020

Secure Design and Development Cyber Security Capability Maturity Model” (SD2-CM2)

The "Secure Design and Development Cyber Security Capability Maturity Model" (SD2-CM2) allows electrical system managers to assess the maturity of their cybersecurity systems, including designs reflecting internet of things devices (IOT). The content provides best practices in the field and users can assess the level of their designs. Modules are "Content" and "Infrastructure"

Gourisetti, Sri Nikhil Gupta↗
DOE OSTI2023

Predictive Capability Maturity Model Demonstration for Cylindrical Cavity Coupling Using Gemma in the Next Generation Workflow

The predictive capability maturity model (PCMM) uses the expert elicitation process to generate credibility evidence for a particular analysis. To ensure Gemma has the capability to efficiently produce this credibility evidence, next generation workflows (NGW) are created for the solution verification, calibration/validation, and input uncertainty quantification portions of the PCMM assessment. These workflows are then used on the Higgins cylinder problem, which is representative of applications involving external-to-internal electromagnetic field coupling through a slot. The uncertainties calculated using these workflows are then used to calculate the validation comparison error and the validation uncertainty for the model following the American Society of Mechanical Engineers (ASME) verification and validation (V&V) 20 standard. These workflows will enable analysts to iterate each element of PCMM more efficiently than if completed without using a NGW workflow. An example of this iterative process is shown in Section 7.2.

42 ENGINEERING↗
DOE OSTI2026

Preparing For Advanced Air Mobility: A System-Level Framework For Infrastructure, Investment, and Deployment

Advanced air mobility (AAM) is moving from demonstration toward early deployment, supported by a growing national strategy that outlines how these systems may evolve across airspace, infrastructure, and operations. As this transition takes shape, a more practical question comes into focus: what does it mean to be ready? This paper introduces a Capability Maturity Model (CMM) as a structured way to think about that challenge. Rather than treating readiness as a fixed condition, it frames it as a progression - one that develops across multiple, interdependent domains over time.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2020

APPLICATION OF MATURITY MODELS FOR EVALUATING CYBERSECURITY PROGRAMS AT NUCLEAR AND RADIOLOGICAL FACILITIES

Maturity models can be used to provide government agencies, industry associations, and organizations operating nuclear facilities with the ability to quickly evaluate the maturity of their cybersecurity programs and identify areas to prioritize for improvement. The Cybersecurity Capability Maturity Model (C2M2) was developed by the U.S. Department of Energy to allow organizations in the energy sector to evaluate the programmatic capabilities of their cybersecurity programs in a consistent manner, communicate programmatic maturity information, prioritize cybersecurity investments in targeted areas of concern, and track how the maturity of their cybersecurity program evolves over time. The C2M2 is designed for use by any critical infrastructure organization regardless of ownership, structure, or size. The C2M2 can be easily fine-tuned to access the maturity of nuclear cybersecurity programs and their application at individual facilities. Built on a foundation of existing cybersecurity standards, frameworks, programs, and initiatives, the model features 10 security domains. Performance in each security domain is characterized using a structured set of cybersecurity practices that represent activities an organization can perform to improve cybersecurity in their domain. Each practice can be quickly evaluated as being either fully, largely, partially, or not implemented. Once practices are evaluated for each security domain, the model defines four maturity indicator levels that apply independently to each domain in the model. To earn a maturity level in a given domain, an organization must adequately perform all the practices for that maturity level and its predecessor level(s). A small assessment team can conduct a C2M2 assessment in a single day. A screening version of the C2M2 allows an initial look at the maturity of nuclear cybersecurity programs that could be completed in under an hour.

Cyber security, Nuclear security, maturity model↗
DOE OSTI2021

Code and Solution Verification Assessment of the CTF Thermal Hydraulic Subchannel Code

CTF is a thermal-hydraulics subchannel code jointly developed by Oak Ridge National Laboratory and North Carolina State University. Over the past seven years, the Consortium for Advanced Simulation of Light Water Reactors (CASL) has made a significant investment in developing CTF so it can be used to model light water reactors, including nominal operating conditions, departure from nucleate boiling analysis, and transients ranging from loss of flow to reactivity insertion accidents. In addition to implementing new modeling capabilities and developing the user input and output interface, extensive work has been performed to improve the code’s quality assurance program, resulting in a development process that conforms with NQA-1 requirements. The CASL program follows the Predictive Capability Maturity Model (PCMM) approach for assessing code quality, which emphasizes performing code verification(ensuring the code converges to the correct answer) and solution verification (ensuring the code converges for the intended application). Code and solution verification are used to identify uncertainty errors introduced by numerical approximations in the code and are important for demonstrating that the model is coded without error, which is an important aspect of the Best Estimate plus Uncertainty method. This paper presents a comprehensive overview of the code and solution verification testing that has been performed on CTF. A top-down approach is taken in which the intended CTF applications are presented, followed by the code features required for their modeling. These features are then linked to the applicable code and solution verification tests that demonstrate proper functioning. Past testing efforts are summarized, and new tests are added to help close gaps in the presented test matrix. Rather than performing “one-off” exercises, these tests are added to the automated CTF regression test suite to ensure continual code quality.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
DOE OSTI2020

Cybersecurity Vulnerability Mitigation Framework through Empirical Paradigm: Enhanced Prioritized Gap Analysis

Existing cybersecurity vulnerability assessment tools were designed based on the policies and standards defined by organizations such as the U.S. Department of Energy and the National Institute of Standards and Technology (NIST). Frameworks such as the cybersecurity capability maturity model (C2M2) and the NIST Cybersecurity Framework (CSF) are often used by the critical infrastructure owners and operators to determine the cybersecurity maturity of their facility. Although these frameworks are exceptional at performing qualitative cybersecurity analysis and identifying vulnerabilities, they do not provide a means to perform prioritized mitigation of those vulnerabilities in order to achieve a desired cybersecurity maturity. To address that challenge, we developed a framework and software application called the cybersecurity vulnerability mitigation framework through empirical paradigm (CyFEr). This paper presents the detailed architecture of CyFEr’s enhanced prioritized gap analysis (EPGA) methodology and its application to CSF. The efficacy of the presented framework is demonstrated by comparing against existing similar models and testing against the cyber injects from a real-world cyber-attack that targeted industrial control systems (ICS) in critical infrastructures.

Gourisetti, Sri Nikhil G.↗
DOE OSTI2021

Credibility Framework (CF) v.1.0

Credibility Framework provides tools such as PIRT (Phenomena Identification and Ranking Table) and PCMM (Predictive Capability Maturity Model) configurable by non-programmers through simple Excel spreadsheets for tailoring the credibility process to meet the needs of the analysis provider organizations, customers and regulatory agencies. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525. SAND2020-10230 M

Clay, RobertL.↗
DOE OSTI2020

Facility Cybersecurity Framework Best Practices

Federal facilities are increasingly adopting automation and connecting to the Internet creating an energy-internet-of-things environment that converges operational technology (OT) and information technology (IT). Today's buildings increasingly weave together networked sensors and cyber and physical systems that enable data to be collected, aggregated, exchanged, stored and monetized in new ways. Building technological advances have created new energy technology, services, markets and value creation opportunities (e.g. transactive energy, two-way grid communications, machine learning, and increased use of renewable and distributed energy resources). But as larger data sets are being exchanged at faster speeds between an increasing number of OT systems, it becomes more difficult to protect the security of the data lifecycle and the physical equipment it interacts with. These challenges are especially difficult to overcome because the economic and environmental gain (interoperability, big data, social networks and ubiquitous information sharing) are driving these prominent trends in the digital age. Often cybersecurity is an afterthought. The U.S. Department of Energy’s (DOE) Federal Energy Management Program (FEMP) funded the Pacific Northwest National Laboratory (PNNL) to develop various cybersecurity tools, trainings, and reports to aid federal facility managers – and other building owners and operators – in better applying frameworks and lessons learned from the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), risk management framework (RMF), DOE’s cybersecurity capability maturity model (C2M2), and a wide variety of industry best practices and guidance documents (i.e., NIST 800 series, Department of Defense United Facilities Criteria). This set of tools, collectively known as the FEMP Facility-Related Control System Cyber Toolkit (FRCS Cyber Toolkit)2, is focused on cybersecurity concerns from facility-related control systems and other operational technology (OT), such as industrial control systems (ICS). The FRCS Cyber Toolkit can be applied across six of the sixteen critical infrastructure sectors designated by the Department of Homeland Security, including government facilities, healthcare and public health, commercial facilities (e.g., public assembly, offices, lodging), financial services (e.g., banking and insurance), emergency services (e.g., fire and police stations), and information technology. With increasingly converged IT and OT systems, it is crucial to address OT cybersecurity considerations and assess how the seam of these two systems could impact the overall cybersecurity posture of a facility. The objective of this report is to provide an overview of the best possible method to use FRCS Cyber Toolkit (section 2.0) and distilled cybersecurity best practices for the federal facilities to address growing non-linear cyber threats (section 3.0). Recommendations in this document are aggregated from several NIST and other documents (see Appendix A for additional details).

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

DER Cybersecurity R&D

The National Renewable Energy Laboratory (NREL) conducted more than 30 assessments for utilities across the United States with a cybersecurity assessment tool based on the U.S. Department of Energy (DOE) Cybersecurity Capability Maturity Model (C2M2) and the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and focused on business process. With funding from the DOE Office of Renewable Energy and Energy Efficiency Federal Energy Management Program, NREL modified the current cyber governance assessment tool to include an assessment process specifically for distributed energy resources (DERs). The Distributed Energy Resources Cybersecurity Framework (DER-CF) was developed to help federal agencies mitigate gaps in their cybersecurity posture for distributed energy systems.

cybersecurity valuation↗
DOE OSTI2020

Electricity Subsector Transmission Resilience Maturity Model (TRMM) User Guide

The electric transmission sector is facing a range of threats to its functionality that are either new, more severe than experienced in earlier years, or more well understood. Such threats include more frequent and more severe extreme weather events, wildfires, droughts, and human-caused physical and cyberattacks. They also include geological, electromagnetic, and biological events. The novelty or increasing severity of these threats creates a significant need for transmission owners to implement programs to prevent, prepare for, respond to, and recover from such incidents. The national and economic security of the United States depends on the reliable functioning of the Nation’s critical infrastructure in the face of such threats, and the transmission networks are essential components of that infrastructure. The Electricity Subsector Transmission Resilience Maturity Model (TRMM) is a tool that a transmission organization can use to objectively evaluate and benchmark its currently established transmission resilience strategies, programs, policies, and investments, in order to target and prioritize enhancements where needed. The TRMM was developed to address the unique characteristics of the transmission system. The model can enable users to: • evaluate and benchmark their organization’s resilience capabilities, effectively and consistently • prioritize actions and investments to improve the resilience of their systems • share transmission-related knowledge, best practices, and relevant references within their organization and with business partners as a means to improve resilience capabilities • contribute to increasing the overall resilience of the Nation’s transmission systems. The TRMM provides descriptive rather than prescriptive industry-focused guidance. The model content is presented at a high level of abstraction so that it can be interpreted by transmission organizations of various types, structures, and sizes. The model is designed to an be easy-to-use, self-assessment tool.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2025

Non-destructive structural characterization of graphite components using mechanical resonance and deep learning

As compared to conventional nuclear reactors, microreactors have the potential to significantly reduce construction timelines and capital costs, decreasing the barriers for advanced nuclear reactor technologies. However, the lower power output of these microreactors (typically < 20 MWe) creates challenging economics if operation and maintenance costs cannot be sufficiently reduced. The compact size of these designs presents an opportunity for comprehensive in-situ structural health monitoring to provide real-time feedback in order to reduce operational costs associated with maintenance and downtime. Many microreactor concepts use graphite for both in-core neutron moderation and as a structural material, which has typically required some form of periodic and laborious inspection. This report provides a description and assessment of recent work with graphite to couple acoustic-based experimental measurements and characterization with machine learning models to mature structural health monitoring capabilities and generate benefits for the nuclear microreactor industry. With resilient embedded sensors in development in other programs funded by the US Department of Energy’s Office of Nuclear Energy and elsewhere, the work described herein builds upon previously funded efforts to mature non-destructive testing technology that relates measured vibrational signatures to structural changes, using a combination of new experimental measurements and machine learning processing. Building on past successful demonstrations of predictive workflows to identify structural changes in a hexagonal stainless steel test article with excellent acoustic propagation, we first performed baseline characterization on graphite samples with canonical geometries to ensure compatibility and confidence in the applied techniques for a material with distinctly different mechanical properties. In contrast to efforts in previous years, we worked exclusively with unidirectional vibration data that is more comparable to those expected from the existing embedded sensor technologies which are suitable for deployment in a reactor setting. Established acoustic and modern machine-learning-based characterization approaches were applied to the resulting datasets from these simple geometries. Both approaches were found to be highly capable of detecting even small geometric irregularities amongst nominally identical samples. As such, we then moved to testing these approaches for detection of artificial local stress perturbations introduced into a more complex geometry: a hexagonal block with drilled holes. A main outcome of this work is that a generalizable ML workflow can be used to detect and predict the characteristics of small artificial anomalies in a graphite component with a relevant geometry. While this work was performed using surficial vibration data, we expect the approach to be flexible and viable for other monitoring scenarios, such as those with different arrangements or types of sensor arrays. As compared to previously funded efforts, an existing ML workflow based on neural networks was enhanced through the addition of recently developed Fourier neural operators. As applied to previously collected and new vibration datasets, prediction accuracies of anomaly characterizations were greatly improved with minimal added computational cost. As trained on small durations of vibration data (tens of seconds) collected over a realistic number of locations, the model was able to reliably determine the presence of a subtle stress anomaly and begin to provide location estimates. Such an approach is likely to be viable for more relevant reactor damage scenarios for graphite components, such as progressive crack growth or creep.

36 MATERIALS SCIENCE↗
DOE OSTI2022

Release of Contaminants from Burning Liquids and Solids

This report details model development, theory, and a literature review focusing on the emission of contaminants on solid substrates in fires. This is the final report from a 2-year Nuclear Safety Research and Development (NSRD) project. The work represents progress towards a goal of having modeling and simulation capabilities that are sufficiently mature and accurate that they can be utilized in place of physical tests for determining safe handling practices. At present, the guidelines for safety are largely empirically based, derived from a survey of existing datasets. This particular report details the development, verification and calibration of a number of code improvements that have been implemented in the SIERRA suite of codes, and the application of those codes to three different experimental scenarios that have been subject of prior tests. The first scenario involves a contaminated PMMA slab, which is exposed to heat. The modeling involved a novel method for simulating the viscous diffusion of the particles in the slab. The second scenario involved a small pool fire of contaminated combustible liquid mimicking historical tests and finds that the release of contaminants has a high functionality with the height of the liquid in the container. The third scenario involves the burning of a contaminated tray of shredded cellulose. A novel release mechanism was formulated based on predicted progress of the decomposition of the cellulose, and while the model was found to result in release that can be tuned to match the experiments, some modifications to the model are desirable to achieve quantitative accuracy.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2025

Zero Trust Strategies for Chemical, Biological, Radiological, and Nuclear Detection Systems: D.1 Cyber Scenarios

The evolving landscape of cybersecurity necessitates a paradigm shift to a Zero Trust (ZT) model, which assumes breaches and continuously verifies trust. This approach reshapes how trust boundaries are established, focusing on identities, devices, networks, applications, and data, rather than solely relying on perimeter defenses such as firewalls. Central to this transformation is the National Institute of Standards and Technology's (NIST) Special Publication 800-207, outlining the Zero Trust Architecture (ZTA), along with Executive Order 14028, which mandates federal agencies to adopt ZT principles. Complementary to these efforts, the Cybersecurity and Infrastructure Security Agency (CISA) developed the Zero Trust Maturity Model (ZTMM), providing a framework with five pillars and three cross-cutting capabilities to guide agencies toward enhanced cybersecurity maturity. In support of these initiatives, the DHS Countering Weapons of Mass Destruction Office (CWMD) is applying ZT principles to secure Chemical, Biological, Radiological, and Nuclear (CBRN) detection systems. Recognizing the diverse deployment models and network connectivity of these systems—from stationary, non-networked units to mobile, cloud-connected devices—the Pacific Northwest National Laboratory (PNNL) is developing cybersecurity scenarios specifically for CBRN environments. These scenarios examine various configurations and technological capabilities, offering insights into the application of ZTMM pillars in enhancing the security postures of CBRN devices. The cybersecurity scenarios presented by PNNL are hypothetical, crafted to explore theoretical situations and stimulate discussion on the potential use or compromise of CBRN detection systems in varied contexts. These narratives are illustrative and do not reference any real events or actual networks. Instead, they employ generalized reference models to highlight concepts and potential issues within CBRN security, focusing on how Zero Trust strategies can be adapted to address these challenges effectively.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Smart manufacturing maturity models and their applicability: a review

The purpose of this paper is to review existing smart manufacturing (SM) maturity models' dimensions and maturity levels to assess their applicability and drawbacks. There are many maturity models available but many of them have not been validated or do not provide a useful guide or tool for applications. This gap creates the need for a review of the existing maturity model's applicability. Nineteen peer-reviewed maturity models related to “Digital Transformation,” “Industry 4.0” or “Smart Manufacturing” were selected based on a systematic literature review and five consulting firm models were selected based on the author's industry knowledge. The chosen models were analyzed to determine 10 categories of dimensions. Then they are assessed on a 1–5 scale for how applicable they are in the 10 categories of dimensions. The five “consulting firm” models have a first-mover advantage, are more widely used in industry and are more applicable, but some require payment, and they lack published details and validation. The 19 “peer reviewed” models are not as widely used, lack awareness in the industry and are not as easy to apply because of no web tool for self-assessment, but they are improving. The categories defined to characterize the models and facilitate comparisons for users include “Information Technology (IT) and Cyber-Physical System (CPS) and Data,” “Strategy and Organization,” “Supply Chain and Logistics,” “Products and Services,” “Culture and Employees,” “Technology and Capabilities,” “Customer and Market,” “Cybersecurity and Risk,” “Leadership and Management” and “Governance and Compliance.” The analyzed maturity models were particularly weak in the areas of cybersecurity, leadership and governance. Researchers and practitioners can use this review with consideration of their specific needs to determine if a maturity model is applicable or if a new model needs to be developed. The review can also aid in the development of maturity models through the discussion of each of the dimension categories. Finally, compared to existing reviews of SM maturity models, this research determines comprehensive dimension categories and focuses on applicability and drawbacks.

42 ENGINEERING↗
DOE OSTI2020

Survey and Assessment of Computational Capabilities for Advanced (Non-LWR) Reactor Mechanistic Source Term Analysis.

A vital part of the licensing process for advanced (non-LWR) nuclear reactor developers in the United States is the assessment of the reactor’s source term, i.e., the potential release of radionuclides from the reactor system to the environment during normal operations and accident sequences. In comparison to source term assessments which follow a bounding approach with conservative assumptions, a mechanistic approach to modeling radionuclide transport, which realistically accounts for transport and retention phenomena, is expected to be used for advanced reactor systems. As the designs of advanced reactors increase in maturity and progress towards licensing, there is a need to advance modeling and simulation capabilities in analyzing the mechanistic source term (MST) of a prospective reactor concept. In the present work, a survey is provided of existing computational capabilities for the modeling of advanced reactors MSTs. The following reactors are considered: high temperature gas reactors (HTGR); molten salt reactors (MSR) which include salt-fueled reactors and fluoride salt-cooled high temperature reactors (FHR); and sodium- and lead-cooled fast reactors (SFR, LFR). A review of relevant codes which may be useful in providing information to MST analyses is also completed, including codes that have been used for source term analyses of LWRs, as well as those being developed for other aspects of advanced reactor system modeling such as reactor physics, thermal hydraulics, and chemistry. A discussion of MST modeling capabilities for each reactor type is provided with additional focus on important phenomena and functional requirements. Additionally, a comprehensive survey is provided of tools for consequence modeling such as atmospheric transport and dispersion (ATD).

22 GENERAL STUDIES OF NUCLEAR REACTORS↗