The Cyber Testing for Resilient Industrial Control Systems (CyTRICS) program, sponsored by the U.S. Department of Energy (DOE) Office of Cybersecurity, Energy Security, and Emergency Response (CESER), works with energy sector manufacturers, asset owners, utilities, and other industry partners to identify and reduce cyber supply chain risks in critical operational technology (OT). Leveraging expertise from six DOE national laboratories, CyTRICS evaluates technologies, advances cyber supply chain risk management, and responsibly discloses vulnerabilities to help strengthen the security and resilience of the systems that generate, transmit, distribute, and deliver the nation’s energy.
CyTRICS is part of the broader DOE Energy Cyber Sense Program.
Modern energy systems rely on complex global supply chains that often lack visibility into the hardware, software, firmware, and third-party components that make up critical operational technology. As these technologies become more interconnected, understanding cyber supply chain risk is essential to protecting the reliability and resilience of the nation’s energy infrastructure.
Through greater visibility into cyber supply chain risk, manufacturers, asset owners, and utilities are better equipped to improve product security, prioritize mitigations, and make informed technology deployment decisions.
Identify, Prioritize, and Assess Critical Components
Identify critical technologies, understand their component composition, and evaluate cyber supply chain risks to the energy sector.
Advance Cyber Supply Chain Risk Management
Develop methods, tools, and data — including Bill of Materials (BOM) analysis — to improve how government and industry understand and manage cyber supply chain risk.
Partner with Energy Sector Stakeholders
Collaborate with CyTRICS participants to better understand operational challenges and provide actionable insights that support informed, risk-based decisions.
Responsibly Disclose Threats and Vulnerabilities
Coordinate with stakeholders to support timely, effective, and responsible vulnerability disclosure, mitigation, and product improvement.
By engaging in public-private partnerships, CyTRICS supports:
