Exercises and Training

CESER is the Department of Energy’s lead for energy sector exercises. 

Exercises

Exercises are critical to planning a coordinated response to emergencies. The Office of Cybersecurity, Energy Security, and Emergency Response (CESER) prepares the Department of Energy (DOE), energy sector, and whole community partners for all-hazards through a series of meticulously planned, threat informed, objectives-based exercises to validate shared capabilities, measure sector resiliency, identify gaps through evaluation, and generate actionable outputs for executive decision making and plan improvement.

As the Sector Risk Management Agency (SRMA) for Energy as outlined in National Security Memorandum 22: Critical Infrastructure Security and Resilience, and the designated Lead Federal Agency for Emergency Support Function #12 (Energy) in Presidential Policy Directive 8 for coordinating the facilitation and reestablishment of damaged energy systems and components in incidents, CESER has an obligation to, in partnership with the energy sector, strengthen the nation’s security and resilience posture of its critical energy infrastructure.

After each exercise, CESER undergoes improvement planning based on exercise feedback and results. Once validated, the improved actions are integrated into CESER’s emergency response plans and procedures as well as into future exercises for evaluation of progress. Exercise results are shared with participants through After-Action Reports, providing participants in CESER-sponsored exercises agreed-upon ways in which they can augment their own preparedness plans. These recommendations often include ways in which participants can better utilize mutual assistance networks and government resources should an incident affect their energy infrastructure. Annually, CESER will review improvement items from the exercises and seek updates from external partners on subsequent actions and supporting where possible.

Each year, CESER hosts the Clear Path and the Liberty Eclipse exercise series, as well as numerous topic-specific exercises critical to the emerging risks threatening the energy sector. Additionally, CESER sponsors, supports and participates in industry-led exercises, as well as exercises hosted by associations representing industry and state emergency response organizations. Key reoccurring trainings and exercises include:

Image

Clear Path

Clear Path is CESER’s annual cornerstone all-hazards energy security and resilience exercise series.  

The Clear Path series is the principal forum for enhancing the energy sector’s ability to work together in response to catastrophic incidents. The series examines the energy sector’s response and restoration roles, responsibilities, and plans and procedures following a major incident, stressing interdependencies between multiple critical infrastructure sectors. Each year, Clear Path presents response officials from a diverse array of challenging exercise scenarios, allowing them to build upon and validate improvements made in response to lessons learned from previous exercises and real-world incidents. CESER strives to ensure that each new edition of Clear Path presents an increasingly realistic and challenging experience for all participants.  

The continued success of Clear Path is predicated on the resolute support and involvement from federal, state, and local municipality government partners, cross-sector entities, and private sector organizations. Since 2013, CESER has engaged over 1,600 energy sector and cross-infrastructure sector partners.

Other activities in the Clear Path Exercise Series include: 

Information Sharing Environment Analysis Workshop

Originally created to support regional and local counterterrorism missions, the Information Sharing Environment Analysis (ISEA) is a workshop that identifies the organizations, personnel, activities, programs, networks, and data that comprise and support a robust intelligence and information sharing capability across key partners and stakeholders. Leveraging this process development technique, organizations can develop intelligence and information sharing flow charts for cyber incident response operations.  

Following the ISEA workshop, an ISEA Report, and a Flow Chart are developed.  

• ISEA Report: Details the information collected during the workshop, highlights key points or features of the information sharing environment, and identifies strengths in existing processes as well as recommendations for improvements.
• ISEA Flow Chart: A visual representation of the information sharing environment, its participants, inputs and outputs, and the flow of information or intelligence through formal and/or informal communication networks or systems.  

Social Media Drill

The objective of the drill is to develop and distribute accurate and timely public information messaging through simulated social media platforms in response to an incident. The drill leverages simulated social media platforms to allow participants to respond to social media inquiries in real time in a no-fault learning environment where systems and processes, not individuals, will be evaluated.

Depending on the severity, outcomes from the drill may feed into discussions at the tabletop exercises.

To learn more about past Clear Path exercises, check out the After-Action Reports in CESER’s Exercise Library. 

Image

Liberty Eclipse

Liberty Eclipse is the Department of Energy’s cybersecurity-focused exercise series.  

In Liberty Eclipse, CESER leverages a cyber-physical testbed environment program to advance cybersecurity resiliency and reduce risk from cybersecurity threats to critical energy infrastructure. Through development of hands-on, at-scale cyber-physical training, Liberty Eclipse offers an immersive, unique experience for operational technology, and cybersecurity experts to prepare to combat cyberattacks on actual power systems, with real electrons moving through components commonly found at electric substations.

The Liberty Eclipse Program has been tremendously successful in reducing risk to the energy sector through this type of exercise and the ability to engage in a live cyber-physical environment is a key attribute of achieving DOE CESER’s mission.  

Liberty Eclipse advances the federal government’s goal to strengthen overall cyber preparedness within and between the energy sector’s public and private partners. 

Training and Workforce Development

CyberStrike™ Training Program

Image

CyberStrike is CESER’s professional cybersecurity training for operational technology environments.  

Since its creation in 2016, CyberStrike has educated more than 1,500 individuals both domestically and internationally. The program offers continuing education credit for participants, modules with scenarios specific to both the electric and the oil and natural gas subsectors, and an instructor cadre comprised of the leading voices on operational technology cybersecurity for energy systems. CyberStrike workshops include:

• Lights Out (Electricity Sector)
• Shadow Valve (Oil and Natural Gas Sector)
• Nemesis (All Sectors)
• Stormcloud (Renewable Energy Sector)
• Forensic Analysis (Technical Analysts)

The hands-on training opportunities CyberStrike offers is helping the existing cybersecurity workforce to understand how adversaries conduct cyber campaigns against industrial control systems used in the energy sector and the skills needed to counteract these threats.

Interagency and International Exercises

To maintain the ability of the federal government to respond cohesively to national security threats, CESER also participates in exercises sponsored by DOE’s fellow federal agencies. Because of the enabling aspect of energy to other critical infrastructure sectors, CESER, on behalf of DOE as the Sector Risk Management Agency (SRMA) – formerly the sector-specific agency (SSA) – for the energy sector, regularly meets with other sector-specific agencies to examine the interdependencies among critical infrastructure sectors to plan for contingencies, should one or many of these sectors be adversely affected by an incident.  

CESER also collaborates on exercises with the nation’s G7 allies, sharing lessons learned through domestic preparedness exercises and real-world response experience to strengthen the readiness of our international partners. These exercises also help the United States and its allies to identify areas where international support can be beneficial in responding to an incident with effects that cascade across borders.

Additional Exercises and Trainings from CESER and our Partners

Image

Operational Technology (OT) Defender: The OT Defender Fellowship is a selective educational opportunity, led by CESER and the Idaho National Laboratory (INL), that gives its fellows an exclusive, insider view of how the government functions and works with industry partners.

Image

CyberForce^®: The CyberForce^® Program is a workforce development program that aims to inspire and develop the next generation of cyber defenders for the energy sector through hands-on competitions, webinars, learning resources, and career fairs, led by CESER and the Argonne National Laboratory (ANL).

Rural and Municipal Utility Cybersecurity (RMUC): Established by the historic Infrastructure Investment and Jobs Act (IIJA), also commonly known as the Bipartisan Infrastructure Law (BIL) and administered by CESER, the RMUC Program supports critical investments to harden utility systems, deliver crucial technical assistance, and provide cybersecurity training to the utility workforce.