prioritizing mission/safety impact with CCE and CIE

[zmanion]

In discussions about automating SSVC assessments, safety|mission|human impact typically comes up one of the more difficult, costly, human-driven decision points. Potential methodologies to pre-assess such impacts:

Consequence-driven Cyber-informed Engineering (CCE)
https://inl.gov/cce/

CCE seems to be a way to accomplish CIE, CCE seems to start/focus on identifying mission critical systems (and functions, MEFs) and impacts.

Cyber-informed engineering (CIE) o
https://www.energy.gov/sites/default/files/2022-06/FINAL%20DOE%20National%20CIE%20Strategy%20-%20June%202022_0.pdf

[ahouseholder]

Converting to discussion until a specific task is identified.