U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Asset Management for the Energy Sector

Energy companies face many challenges in cybersecurity asset management, from aggregating disparate data sets to setting up real-time visibility into operational technology (OT) assets in a fluid environment. Without an effective asset management solution, organizations may unnecessarily expose themselves to cybersecurity risks.

An example cybersecurity solution helping utilities and the oil and gas industry better manage their OT assets

Keeping track of OT resources is often a manual, error-prone process. To remain fully operational, energy sector organizations should be able to effectively identify, control, and monitor all their OT assets. Through this project, the NCCoE supplies guidance on how to enhance OT asset management practices by using capabilities that may already exist in an energy organization’s operating environment, as well as implementing new capabilities. The guide describes methods for managing, monitoring, and baselining assets, along with alerting capabilities to help identify threats to these OT assets.
Status: Finalized Guidance

Upon review, we recognize that this NIST/NCCoE publication contains potentially biased terminology. As new publications are developed, they will follow NIST’s inclusive language guidance.

NIST SP 1800-23: Complete Guide (HTML)Web Version NIST SP 1800-23: Complete Guide (HTML)
NIST SP 1800-23: Complete Guide (PDF)Web Version NIST SP 1800-23: Complete Guide (PDF)
NIST SP 1800-23A: Executive SummaryDocument Version NIST SP 1800-23A: Executive Summary
NIST SP 1800-23B: Approach, Architecture, and Security CharacteristicsDocument Version NIST SP 1800-23B: Approach, Architecture, and Security Characteristics
NIST SP 1800-23C: How-To GuidesDocument Version NIST SP 1800-23C: How-To Guides
View the 2-page fact sheet

Project Abstract

Energy companies own, run, and support critical OT assets that have unique requirements for availability and reliability. These assets must be monitored and managed to reduce the risk of cyber attacks on ICS-networked environments. Key factors in strengthening OT asset management capabilities include knowing which tools can collect asset information and what type of communications infrastructure is needed to send this information. 

The capabilities demonstrated in this NCCoE cybersecurity practice guide were selected to address several key tenets of asset management: establish a baseline of known assets; establish a dynamic asset management platform that can alert operators to changes in the baseline; capture as many attributes about the assets as possible via the automated capabilities implemented.  

In addition to these key tenets, this practice guide offers methods of asset management that address particular challenges in an OT environment, including the need to: account for geographically dispersed and remote assets; have a consolidated view of the sum total of OT assets; be able to readily identify an asset’s disposition, or level of criticality, in the overall operational environment. 

Read the Project Description

Key factors in strengthening OT asset management capabilities include knowing which tools can collect asset information and what type of communications infrastructure is needed to send this information.

Collaborating Vendors

Organizations participating in this project submitted their capabilities in response to an open call in the Federal Register for all sources of relevant security capabilities from academia and industry (vendors and integrators). The following respondents with relevant capabilities or product components (identified as “Technology Partners/Collaborators” herein) signed a Cooperative Research and Development Agreement to collaborate with NIST in a consortium to build this example solution.

Join the Community of Interest

Employee speaking on video call with colleagues on online briefing with laptop at home

A Community of Interest (COI) is a group of professionals and advisors who share business insights, technical expertise, challenges, and perspectives to guide NCCoE projects. COIs often include experts, innovators, and everyday users of cybersecurity and privacy technologies. Share your expertise and consider becoming a member of this project's COI. 

Tell us about yourself