The increasing prevalence and severity of wildfires, severe storms, and cyberattacks is driving the introduction of numerous microgrids to improve resilience locally. While distributed energy resources (DERs), such as small-scale wind and solar photovoltaics with storage, will be major components in future microgrids, today, the majority of microgrids are backed up with fossil-fuel-based generators. Small modular reactors (SMRs) can form synergistic mix with DERs due to their ability to provide baseload and flexible power. The heat produced by SMRs can also fulfill the heating needs of microgrid consumers. This paper discusses an operational scheme based on distributed control of flexible power assets to strengthen the operational resilience of SMR-DER integrated-energy microgrids. A framework is developed to assess the operational resilience of SMR-DER microgrids in terms of system adaptive real-power capacity quantified as a response area metric (RAM). Month-long simulation results are shown with a microgrid developed in a modified Institute of Electrical and Electronics Engineers (IEEE)-30 bus system. The RAM values calculated along the operational simulation reflect the system resilience in real time and can be used to supervise the microgrid operation and reactor’s autonomous control.

Large, modern industrial facilities often incorporate thousands of digital assets in their operational technology. Regulated facilities, such as nuclear power plants (NPPs), maintain robust cybersecurity and configuration management programs that often use bills of materials (BOMs) for these assets, including make, model, and version of hardware, firmware, and software. However, these BOMs typically capture only first- or second-tier information provided by the original equipment manufacturer (OEM). Unfortunately, as indicated by the increasing number and sophistication of software supply chain attacks, this level of detail is insufficient for identifying all the potential vulnerabilities and risks in software applications. Software BOMs (SBOMs) provide detailed enumeration of components and dependencies within the product or devices, including firmware. SBOMs can be combined with vulnerability data sources and vendor vulnerability attestations to improve vulnerability management and enable rapid identification of affected components when new software vulnerabilities are discovered. Ideally, SBOMs are created by the OEM prior to installation. However, since this practice is not yet commonplace and since NPPs are typically slow to adopt new technology, most NPPs do not incorporate SBOMs into their asset or configuration management programs. Fortunately, SBOMs can be generated by NPPs on existing digital assets to provide further insight into risk management decisions. This report provides an overview of the current SBOM ecosystem and recommends guidance on how to get started in a “crawl, walk, run” manner to develop and implement a sustainable SBOM program for digital assets in an NPP.

Artificial intelligence (AI) applications driven by machine learning (ML) are transformational technologies within the international nuclear security regime. Advancements realized by AI—faster and improved data insights, more efficient and automated processes, reductions in human error—enable nuclear security applications such as behavior analysis for insider threat mitigation, source tracking of stolen nuclear material, and facial recognition software for physical protection. In addition to the advantages, however, there are also inherent vulnerabilities and threats associated with its use and risk mitigations must be built into any AI/ML-enabled systems. This work provides a background on AI and ML and different data types used in the field, including open-source intelligence information (OSINT) that is discoverable by AI tools and application data that are used by AI tools for decision-making and automation. Current and potential AI applications and vulnerabilities related to their use within the nuclear security regime are also discussed.