Toward a Resilient Cybersecure Hydropower Fleet: Cybersecurity Landscape and Roadmap

The U.S. Department of Energy’s (DOE’s) Water Power Technologies Office (WPTO), through their Hydropower1 Program, invests in solutions that improve the contributions of hydropower and pumped storage to the electrical grid. Hydropower owners and operators, and their vendors and partners, rely on WPTO to provide them with early-stage research and innovative technologies, validate new technical solutions, coordinate technology testing, and share information that supports the Office’s objectives. Cybersecurity is recognized as an integral part of these efforts to advance the ability of hydropower to deliver flexibility and value to the electric grid. WPTO tasked Pacific Northwest National Laboratory (PNNL) with summarizing the current cybersecurity landscape of the U.S. hydropower fleet in order to identify where research and development (R&D) could address cybersecurity gaps that negatively affect the fleet’s obligations to irrigation, the environment, recreation, flood control, and power generation as well as hydropower operators’ reputation and financial stability.
This cybersecurity landscape and roadmap supports WPTO in addressing gaps in hydropower cybersecurity by identifying a set of needed capabilities and potential R&D opportunities in a loose implementation timeline from which WPTO can select those most aligned with their objectives. To define these opportunities PNNL scrutinized trending cybersecurity threats and attempted to project future cyber threats, reviewed current and evolving mitigation technologies, attempted to discern mitigation technologies commonly used by hydropower facilities, and identified gaps in cybersecurity tools and technologies caused by either lack of existing tools and technologies or barriers to their adoption. With this knowledge in hand, a roadmap of options was built to fill the identified gaps with investment choices having highest likelihood of adoption and impact. The roadmap choices are binned into near-, mid-, and long-term investment time frames. The result is a set of capabilities anxious for WPTO assistance.