NERC CIP-015 sensor placement depends on risk and evidence

At a glance

What this is: This article explains how utilities should choose INSM sensor placement and data feeds under NERC CIP-015, with the central finding that defensible monitoring depends on risk-based rationale rather than a fixed design.

Why it matters: It matters because identity, device and network activity are only monitorable when collection points and data sources are chosen to match operational reality, audit expectations and the specific ways attackers abuse legitimate access.

Context

NERC CIP-015 pushes utilities toward risk-driven internal network security monitoring, but it does not prescribe a single sensor layout or feed strategy. That creates a governance gap rather than a technical shortcut: teams still have to justify where they monitor, what they collect and why those choices fit the environment.

The practical issue is that monitoring value depends on the combination of network traffic, logs and operational context, not packet capture alone. In OT environments, that often intersects with human-to-machine access, privileged changes and controller actions, so collection design becomes part of access governance as much as telemetry engineering.

The article argues that mature programs blend impact-based and threat-based placement, then validate the design through physical walkdowns and periodic reassessment. That is typical for complex utility estates, because paper diagrams rarely match the conditions that determine whether monitoring actually works.

Key questions

Q: How should utilities choose sensor placement for INSM under CIP-015?

A: Utilities should choose sensor placement by mapping monitoring locations to the risks they are meant to cover, then validating that choice against the site’s actual architecture and operational constraints. The strongest designs combine impact-based priority with threat-based choke points, because that balances compliance defensibility with attack-path visibility.

Q: Why do packet captures alone often fail in OT monitoring programs?

A: Packet captures can show traffic, but they often miss the control context behind encrypted or privileged actions. Logs from controllers, authentication systems and devices reveal changes such as account creation, configuration updates and operator activity, which is why layered telemetry is usually needed for defensible monitoring.

Q: What breaks when a sensor plan is designed only from diagrams?

A: A diagram-only plan often breaks when the team meets unavailable power, consumed ports, bandwidth limits or older facilities that no longer match documentation. Those constraints can delay deployment, reduce visibility or force redesign, so physical validation is part of the control, not optional follow-up.

Q: How do utilities know whether their CIP-015 monitoring rationale is defensible?

A: They know it is defensible when they can explain the collection strategy, show that placement aligns to risk, provide written justification for each location and produce evidence that the design is reviewed when the environment changes. Defensibility comes from consistency, documentation and periodic reassessment.

Technical breakdown

Risk-based sensor placement under NERC CIP-015

CIP-015 requires utilities to identify network data collection locations and methods based on network security risk, not to follow a fixed topology rule. That matters because the same environment can have different choke points depending on operational criticality, communications paths and where adversaries can realistically reach control systems. Impact-based placement prioritises high-consequence assets such as engineering workstations, SCADA servers and access systems. Threat-based placement instead follows likely attack paths, which is often better at revealing lateral movement and abuse of legitimate tools. The technical challenge is that monitoring value depends on the interaction between topology, protocol visibility and operational process, not on one universal sensor recipe.

Practical implication: Document the specific risk logic behind each sensor location so auditors can trace the monitoring design to the environment.

Why data feeds matter more than packet capture alone

A network sensor without the right data feed can miss the control actions that matter most. Packet capture offers high-fidelity visibility, but encrypted human-to-machine activity, configuration changes and controller events often become understandable only when logs, flows and telemetry are layered together. In OT, that distinction is critical because a privileged user may add an account or change logic without producing obvious evidence in traffic alone. Good INSM programs therefore combine PCAP, flow metadata and device logs to create correlated evidence. The article’s core technical point is that collection design must match the type of event you need to detect, not just the transport you can observe.

Practical implication: Pair traffic visibility with device and authentication logs wherever encrypted or privileged actions would otherwise be opaque.

Walkdowns, SDN and the reality of legacy infrastructure

The design that works on paper often fails when the team encounters unavailable power, full switch ports, constrained bandwidth or older plants that no longer match diagrams. That is why the walkdown is a technical necessity, not an administrative formality. In some facilities, software-defined networking can simplify collection by aggregating multiple device-to-device streams into centrally controlled capture points, especially where adding physical mirroring infrastructure is expensive or impractical. This is still a collection engineering problem, but it is also a governance problem because the chosen mechanism has to be defensible, repeatable and maintainable across site variation.

Practical implication: Validate every planned sensor and feed against site constraints before committing to a deployment sequence.

Threat narrative

Attacker objective: The attacker aims to use trusted OT access paths and legitimate credentials to manipulate systems, persist in the environment and cause operational disruption or loss of control.

1. Entry occurs through legitimate operational pathways such as IT-OT access routes, engineering workstations or control-system communications that are already trusted by the environment.
2. Escalation follows when an attacker abuses legitimate tools or credentials, which can let them move across monitored and unmonitored segments without needing an obvious exploit.
3. Impact occurs when the adversary can change logic, add users, wipe data or disrupt operations before the monitoring design produces usable evidence.

Breaches seen in the wild

• HPE Aruba Instant On hard-coded credentials: Hard-coded admin credentials in HPE Aruba Instant On access point firmware let anyone bypass login (CVE-2025-37103); no exploitation reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Risk-based monitoring is becoming a governance test, not just a network design choice. CIP-015 makes the organization justify why specific locations and feeds were selected, which means the quality of the rationale matters as much as the sensor itself. That shifts INSM from a tooling discussion into a control-evidence discipline. Practitioners should treat monitoring design as a defensible governance artefact, not a static engineering diagram.

Sensor placement is really a question of where identity and control intersect. In OT, the most valuable telemetry often comes from engineering workstations, access systems and controller logs because those are the points where human intent becomes machine action. That is where IAM and privileged access thinking becomes relevant to industrial monitoring. Teams should map monitoring to the places where authentication, authorization and operational change converge.

Collect everything is not the same as monitor effectively. Broad capture can simplify early decisions, but it still leaves gaps if encrypted actions, device state changes and privileged events are not correlated. The named concept here is monitoring rationale drift: the gap between an initial justification and the reality of what the program actually observes. Practitioners should keep collection logic aligned to current risk, not inherited assumptions.

Threat-based placement is useful because attackers do not respect asset criticality labels. The article’s examples show that realistic attack paths may target access points, engineering stations or change-capable systems, even when those assets are not the most obvious compliance focus. That means monitoring strategy must account for adversary behavior, not just operational hierarchy. Practitioners should align detection coverage to plausible abuse of legitimate access.

Physical reality remains part of cyber governance in OT. Walkdowns, cable routes, power availability and switch capacity all shape whether the control can actually be implemented. This is why monitoring programs fail when they are designed only from architecture diagrams. Practitioners should validate deployment feasibility early and treat site constraints as part of the control requirement, not an afterthought.

What this signals

Monitoring rationale drift: the gap between a sensor plan approved on paper and the telemetry the site can actually sustain is one of the biggest execution risks in OT security. Practitioners should expect deployment decisions to change after walkdowns, especially in older or distributed facilities where the physical environment no longer matches the design.

INSM programs will increasingly be judged on whether they can prove why each feed exists, not just whether they have coverage. That pushes utilities toward evidence-backed design reviews, where collection scope, logging depth and site constraints are revisited as part of normal control maintenance rather than one-time implementation.

In practice, the control objective is to make privileged changes and operationally relevant communications observable enough to support investigation and audit. Where those events remain opaque, monitoring coverage is too abstract to satisfy either security or compliance needs.

For practitioners

• Define a risk-based collection rationale Map each sensor and feed to the specific risk it is meant to reduce, then document why that location or source is the right one for the site.
• Blend impact and threat placement Use criticality to prioritise high-consequence assets, then test whether likely attack paths create additional choke points that also need coverage.
• Layer logs with traffic data Add controller, authentication and configuration logs where encrypted or privileged actions would otherwise be invisible in packet data alone.
• Run a physical walkdown before deployment Verify power, port availability, cable routes and bandwidth constraints on site so the monitoring plan matches operating conditions.
• Reassess collection design annually Review sensor placement and feed choices whenever the environment changes, because the monitoring rationale must stay aligned to current risk and architecture.

Key takeaways

• NERC CIP-015 turns sensor placement into a risk-based governance decision, not a fixed engineering template.
• The strongest monitoring designs combine impact-based priority, threat-path thinking and layered telemetry.
• Physical site constraints and periodic reassessment are part of the control, because monitoring that cannot be deployed or maintained is not defensible.

Key terms

• Internal network security monitoring: Internal network security monitoring is the practice of observing traffic and activity inside trusted environments to detect anomalies, evidence misuse, and support investigations. In OT settings, it is most useful when paired with access controls that reduce exposure before suspicious activity can spread.
• Risk-based sensor placement: Risk-based sensor placement is the method of choosing monitoring points based on operational impact, threat pathways and evidence needs rather than architectural convenience. It is central to defensible monitoring because it ties each sensor location to a specific security or compliance purpose.
• High-value data feeds: High-value data feeds are telemetry sources that materially improve detection or investigation value, such as logs from controllers, authentication systems, switches or endpoints. They matter because meaningful visibility often comes from combining multiple feeds, not from traffic capture alone.
• Walkdown: A walkdown is a physical validation of the environment to confirm that planned controls can actually be installed and maintained. In OT and industrial settings, it helps teams discover constraints such as power limits, exhausted ports, cable routing issues and outdated site diagrams.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It is designed for practitioners who need to connect identity controls to broader security and compliance programmes.