Situational Awareness

Download the Practice Guide

The NCCoE has released the draft version of NIST Cybersecurity Practice Guide SP 1800-7, Situational Awareness. Use the buttons below to view this publication in its entirety or scroll down for links to a specific section.

Download PDF »Open Web Version »


To improve the security of information and operational technology, including industrial control systems, energy companies need mechanisms to capture, transmit, analyze and store real-time or near-real-time data from these networks and systems. With such mechanisms in place, energy providers can more readily detect and remediate anomalous conditions, investigate the chain of events that led to the anomalies, and share findings with other energy companies. Obtaining real-time and near-real-time data from networks also has the benefit of helping to demonstrate compliance with information security standards.

See the two-page fact sheet or the Situational Awarness Project Description (PDF) for additional information.

To get the latest information on our work in the energy sector, sign up for our energy email topic. NCCoE energy sector team meeting presentations and notes can be found in the NCCoE library

If you are an energy sector stakeholder or a technology vendor, and you would like to collaborate with the NCCoE on energy sector projects, please email us at

Collaborating Vendors

Dragos logo
Hewlett Packard Enterprise logo
ICS2 logo
OSISoft logo
Radiflow logo
RS2 Technologies logo
RSA logo
Schneider Electric logo
Siemens logo
TDI Technologies logo
Waratek logo
Waterfall Security logo

The technology vendors who participated in this project submitted their capabilities in response to a call in the Federal Register. Companies with relevant products were invited to sign a Cooperative Research and Development Agreement with NIST, allowing them to participate in a consortium to build this example solution.


Disclaimer: Certain commercial entities, equipment, products, or materials may be identified in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST or NCCoE, nor is it intended to imply that the entities, equipment, products, or materials are necessarily the best available for the purpose.