What is Situational Awareness?
Situational awareness is the up-to-date understanding of what is happening in an OT environment, what it means for production, safety and security, and how the situation will develop if nobody intervenes. It is the foundation on which operators, engineers and security analysts decide and act, which makes it a precondition for cyber resilience, incident response and the safe management of industrial processes. The concept comes from aviation psychology and is used in industry in two ways: in the control room, where it concerns the process, and in cybersecurity, where it concerns threats and the security posture.
In the OT context, situational awareness means knowing what is running, where it is running, who has access and what the consequences could be for production, safety and Compliance.
🧠 What are the three levels of the Endsley model?
The most widely used definition comes from the American researcher Mica Endsley, who defined the concept in 1988 and developed it in 1995 in the paper Toward a theory of situation awareness in dynamic systems in the journal Human Factors. She uses the term situation awareness and distinguishes three levels that build on each other:
| Level | Question | Example in OT |
|---|---|---|
| 1. Perception | What is happening now? | An alarm on a PLC, an unknown device on the network, a suspicious login on an engineering workstation |
| 2. Comprehension | What does it mean? | The PLC is running a modified program, so process control may have been tampered with |
| 3. Projection | What happens if nobody intervenes? | A tank overfills, the line stops or the attack spreads to other zones |
Endsley draws an important distinction: situational awareness is not the same as deciding or acting. It is the state of knowledge on which a good decision rests. An operator can make the right decision from a wrong picture, and the other way round. In her model, attention and working memory are the limiting factors, while experience and good mental models help to overcome those limits.
Aviation research by Jones and Endsley in 1996 found that about 76% of situation awareness errors occurred at level 1: information was not perceived, not monitored or misread. About 20% occurred at level 2 and only a few per cent at level 3. The lesson for OT is clear: most problems start with information that is missing or hard to find.
🔄 How do process awareness and cyber awareness differ?
Two forms of situational awareness overlap in industry. They share the same model but look at different signals.
| Aspect | Process situational awareness | Cyber situational awareness |
|---|---|---|
| Who | Control room operator | Security analyst, OT SOC, OT security engineer |
| Sources | HMI, SCADA, DCS, alarms, Historian | Network Monitoring, Logging, SIEM, IDS, Threat Intelligence |
| Key question | Is the process stable and safe? | Is there unauthorised activity or a vulnerability? |
| Standards | ISA-18.2, ISA-101, EEMUA 191 | IEC 62443-3-3, NIST SP 800-82, SANS ICS Five Critical Controls |
| Typical failure | A critical alarm is lost in an alarm flood | An attacker stays undetected for months |
In its glossary CNSSI 4009, which the NIST glossary also adopts, the US Committee on National Security Systems defines cyber situational awareness as the perception of an enterprise’s security posture and its threat environment, the comprehension of both together as risk, and the projection of their status into the near future. That is the Endsley model applied to security.
In OT the two forms meet. A cyberattack on a controller often first becomes visible as a process deviation, and a process upset may point to a cyber incident. That is why many organisations aim for one shared picture for operators and security teams.
🎯 Why is situational awareness important in OT?
| Risk without awareness | Example |
|---|---|
| Unknown devices | A Rogue Device runs unnoticed in the production network |
| Invisible vulnerabilities | Unpatched PLCs without an Asset Inventory or risk insight |
| Slow detection of attacks | A Man-In-The-Middle or Replay Attack goes undetected for a long time |
| Misinterpretation of alarms | The operator misses a critical alarm among hundreds of consequential alarms |
| Lack of action orientation | Incidents are addressed late or wrongly |
Three well-known incidents show what goes wrong:
- Three Mile Island (28 March 1979) - a relief valve on the nuclear reactor stuck open, but the indicator light in the control room only showed that the close command had been sent. Operators believed the valve was shut and made decisions based on a wrong picture: a classic level 1 error.
- Buncefield (11 December 2005) - a level gauge on a storage tank stuck and the independent high-level switch did not work. Nobody saw the tank filling up; more than 250,000 litres of petrol overflowed, formed a large vapour cloud and that cloud exploded.
- Ukraine (23 December 2015) - the Sandworm group got in through BlackEnergy at three distribution companies and operated the HMIs remotely. Operators watched their mouse cursor move without touching it. About 225,000 customers lost power for several hours.
🔧 Which components are essential?
| Component | Description |
|---|---|
| Asset Inventory | Insight into which devices, versions and firmware are present |
| Network Monitoring | Real-time visibility of traffic, topology and changes, preferably through passive monitoring |
| Logging & SIEM | Collect and correlate events across systems |
| Anomaly Detection | Alerts on behaviour that deviates from a recorded baseline |
| Threat Intelligence | External context on vulnerabilities, adversaries and techniques from MITRE ATT&CK for ICS |
| Alarm Management | Meaningful alarms, so the operator is not overwhelmed |
| Security Awareness | Operators, engineers and administrators recognise suspicious signals |
| Incident Response | A prepared plan for analysis, containment and recovery |
Passive monitoring is the norm in OT, because active scanning can disrupt fragile legacy controllers. A sensor on a SPAN port of an industrial switch listens to the traffic, recognises industrial protocols and builds an asset list and a communication baseline without touching the process.
📏 Which standards and benchmarks apply?
Situational awareness is not a standard in its own right, but it appears in almost every relevant framework:
- IEC 62443-3-3 - foundational requirement FR 6 Timely response to events includes SR 6.1 (audit log accessibility) and SR 6.2 (continuous monitoring).
- SANS ICS Five Critical Controls - the 2022 white paper by Robert M. Lee and Tim Conway names ICS network visibility and monitoring as the third of the five core controls.
- NIST SP 800-82 - revision 3 (September 2023) describes monitoring and detection as part of an OT security programme, in line with the Detect function of the NIST CSF.
- ISA-18.2 and EEMUA 191 - an average of one alarm per ten minutes per operator is considered very likely acceptable, and two per ten minutes the maximum manageable. More than ten alarms in ten minutes is an alarm flood, which should occur less than 1% of the time.
- ISA-101 - guidance on HMI design, including high-performance HMIs with neutral colours so that deviations stand out immediately.
In the Netherlands and the EU, situational awareness is also a legal matter. The Dutch Cybersecurity Act (Cyberbeveiligingswet), which implements NIS2, has applied since 15 August 2026. Its incident reporting obligation requires an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. Without good visibility of your OT environment you cannot meet those deadlines, because you first have to notice and assess a significant incident.
🛠️ How do you build situational awareness step by step?
- Map your assets - combine Asset Discovery with an up-to-date CMDB or Asset Inventory. You cannot protect what you do not know.
- Record what normal looks like - register which systems talk to each other, over which protocols and how often. This is the baseline for anomaly detection.
- Place sensors in the right places - at the boundaries between zones of the Purdue Model, at remote access points and near critical controllers.
- Centralise and enrich - bring network, host and process data together in a SIEM or OT SOC and enrich it with Threat Intelligence.
- Make the picture usable - role-based dashboards, prioritisation by process impact and clear escalation routes; otherwise you create a new alarm flood.
- Exercise and improve - test the picture with scenarios, Blue Team exercises and Threat Hunting, and use Root Cause Analysis after every incident to close blind spots.
| Situation | Without awareness | With awareness |
|---|---|---|
| Firmware update on a switch outside a change window | Unnoticed, possibly a backdoor | Deviation detected and checked against change management |
| New connection in the production VLAN | Not recognised | Anomaly Detection raises an alarm |
| Increased outbound data flow | Not noticed | SIEM flags possible exfiltration |
| Inactive engineer account becomes active | No alert | Usage alert, Access Control is reviewed |
| PLC switched to program mode | Nobody sees it | Alert to operator and security team at the same time |
✅ Best practices
- Keep the inventory current - an outdated CMDB or Asset Inventory gives a false sense of control.
- Eliminate blind spots - use Network Monitoring and Asset Discovery in older network segments too.
- Integrate process and cyber data - one shared picture stops operators and security teams working at cross purposes.
- Use OT-specific detection - generic IT tools often do not understand industrial protocols; an OT IDS does.
- Exercise together - practise scenarios with Incident Response and Blue Team exercises in which operators and IT security work side by side.
- Link to risk - translate every alert into its possible impact on safety, production and Security.
❓ Frequently asked questions
What is the difference between situational awareness and monitoring?
Monitoring is the collection of data such as network traffic, logs and alarms. Situational awareness goes further: it is the understanding of what that data means and an estimate of how the situation will develop. Monitoring is a means, situational awareness is the result.
Who needs situational awareness in an industrial organisation?
Control room operators need situational awareness of the process, and security analysts need it for threats and vulnerabilities. Maintenance engineers and management also need their own picture at their own level of detail. In OT it works best when all these roles share the same underlying picture.
Why is passive monitoring important for situational awareness in OT?
Passive monitoring listens to network traffic without sending packets to devices itself. This matters because older PLCs and RTUs can hang when they are actively scanned. Passive monitoring builds situational awareness without putting process availability at risk.
How does alarm management relate to situational awareness?
Too many alarms undermine situational awareness, because the operator no longer sees the important one. ISA-18.2 and EEMUA 191 consider an average of one alarm per ten minutes per operator acceptable and more than ten in ten minutes an alarm flood. Good alarm management is therefore a direct investment in situational awareness.
Does NIS2 require situational awareness?
NIS2 and the Dutch Cyberbeveiligingswet do not use the term literally, but the duty of care and the incident reporting obligation effectively require it. An organisation that has to report a significant incident within 24 hours must first be able to notice and assess it. Monitoring, logging and detection are therefore part of the appropriate measures these laws require.
How do you measure the quality of situational awareness?
In the control room, situational awareness is often measured with simulator exercises based on SAGAT (Situation Awareness Global Assessment Technique) by Endsley: the simulation is frozen at unexpected moments and operators answer questions about the process state. In security you use metrics such as time to detect, the percentage of assets under monitoring and the share of alerts that lead to action. Together they show where the blind spots are.
📌 In summary
Situational awareness in OT is more than collecting data: it is about perceiving, understanding and anticipating, so that operators and security teams make the right decision in time.
The three-level Endsley model applies both in the control room and in the security team. Most errors already occur at the perception stage, so an up-to-date asset inventory, passive network monitoring and sound alarm management are the foundations. Standards such as IEC 62443-3-3, the SANS ICS Five Critical Controls and ISA-18.2 provide guidance, and NIS2 and the Dutch Cybersecurity Act make timely detection a legal necessity. Without situational awareness, Security becomes reactive and production stays vulnerable.