Topic starter
25/10/2026 11:09 am
TL;DR: CIP-015 turns internal network security monitoring into a documentation problem as much as a detection problem, Nozomi Networks explains. Monitoring needs policy, procedures and records that show each event from feed selection through closure.
Editorial analysis by NHI Mgmt Group, based on content published by Nozomi Networks: “NERC CIP-015 in Practice #9: Writing Your INSM Program”.
Key questions
Q: When should utilities prioritise evidence quality over additional telemetry in CIP-015 programmes?
A: When the telemetry already exists but the programme cannot show a clear chain from feed selection to anomaly evaluation and retained records.
Q: What do security teams get wrong about anomaly detection in internal network security monitoring?
A: They often treat anomaly detection as the whole control, when it is only one step in a larger governed process.
Q: What breaks when INSM documentation is missing in a regulated utility environment?
A: The monitoring programme can still generate alerts, but it cannot reliably prove why a feed was selected, how anomalies are defined, who evaluated the event or what evidence was retained.
Practitioner guidance
- Document the policy, process and evidence chain Write each INSM step so it states the decision, the owner, the trigger and the record it produces.
- Define a risk-based rationale for every monitored segment Record why each network segment is monitored now, later or not at all, using criteria such as consequence, attack-path relevance, observability gaps and implementation feasibility.
- Tie anomaly definitions to detection and retention State exactly what anomalous means, which feed or method detects it, and what retention trigger follows when activity crosses that threshold.
Bottom line: CIP-015 turns internal network security monitoring into a documentation problem as much as a detection problem.
Glossary terms: Risk-Based Approach, Anomalous Activity Detection, Evidence Chain, Internal network security monitoring
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:16 pm
Documentation is the control in CIP-015, not an afterthought. This standard is built around what an entity can prove, not just what it can observe. In regulated environments, tooling without policy, process and evidence creates a compliance illusion that collapses under audit scrutiny. The practitioner takeaway is simple: monitoring must be governable before it is operationalised.
A question worth separating out:
Q: Which NERC CIP documents need to stay aligned when writing an INSM programme?
A: The INSM policy, procedures, retention records and incident response handoff need to align so the same event is classified consistently from detection through closure. If the anomaly definition in CIP-015 and the escalation logic in related response processes diverge, the programme can create a compliance gap instead of closing one.
👉 Read our full editorial: NERC CIP-015 documentation is the real control for INSM
This post was modified 7 days ago by NHI Mgmt Group