NIST SPECIAL PUBLICATION 1800 -7 Situational Awareness For Electric Utilities Includes E xecutive Summary (A ); Approach, Architecture, and S ecurity C haracteristics (B), and How -To Guides (C) Jim M cCarthy Otis Alexander Sallie E dwards Don Faatz Chris P eloquin Susan Symington Andre Thi bault John Wiltberger Karen Viani This publication is av ailable free of charge from: http://doi.org/10.6028/NIST.SP.1800-7 The first dr aft of t his publication is av ailable free of ch arge from: https://nccoe.nist.gov/sites/default/files/library/sp1800/es -sa-nist-sp1800-7- draft.pdf NIST SPECIAL PUBLICATION 1800 -7 Situational Awareness for Electric Utilities Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B), and How -To Guides (C) Jim McCa rthy National Cybersecurity Center of Excellence National Institute of Standards and Technology Otis Alexander Sallie Edwards Don Faatz Chris Peloquin Andre Thibault John Wiltberger The MITRE Corporation McLean, VA August 2019 U.S. Department of Commerce Wilbur Ross , Secretary National Institute of Standards and Technology Walter Copan, NIST Director and Undersecretary of Commerce for Standards and Technology NIST SPECIAL PUBLICATION 1800 -7A Situational Awareness For Electric Utilities Volume A : Executive Summary Jim McCarthy National Cybersecurity Center of Excellence National Institute of Standards and Technology Otis Alexander Sallie Edwards Don Faatz Chris Peloquin Susan Symington Andre Thibault John Wiltberger Karen Viani The MITRE Corporation McLean, VA August 2019 This publication is available free of charge from: http://doi.org/10.6028/NIST.SP1800- 7 The first draft of this publication is available free of charge from: https://nccoe.nist.gov/sites/default/files/library/sp1800/es -sa-nist-sp1800- 7-draft.pdf NIST SP 1800-7A : Situational Awareness for Electric Utilities 1 Executive Summary Situational awareness , in the context of this guide, is the understanding of one’s environment and the ability to predict how it might change due to various factors. As part of their current cybersecurity efforts, some electric utilities monitor physical, operational, and information technology (IT) separately. According to energy sector stakeholders, many utilities are currently assessing a more comprehensive approach to situational awareness, which, through increased real-time or near real-time cybersecurity monitoring , can enhance the resilience of their operations. The National Cybersecurity Center of Excellence (NCCoE) at the National Institute of Standards and Technology (NIST) built a laboratory environment to expl ore an example solution that can be used by energy sector companies to alert their staff to potential or actual c yber attacks directed at the grid . The security characteristics in our situational awareness platform are informed by guidance and best practic es from standards organizations, including the NIST Cybersecurity Framework and North American Electric Reliability Corporation’s (NERC) Critical Infrastructure Protection (CIP) V ersion 5 standards. This NIST Cybersecurity Practice Guide demonstrates how o rganizations can use commercially available products that can be integrated with an organization’s existing infrastructure. The combination of these products provides a converged view of all sensor data within the utility’s network systems, including IT, operational, cyber, and physical access control systems, which often exists in separate “silos .” The example solution is packaged as a “ how to ” guide that demonstrates implementation of standards - based cybersecurity technologies in the real world and based on risk management. The guide may help inform electric utilities in their efforts to gain situational awareness ef