NERC CIP-015 mock audits: what practitioners need to test first

TL;DR: NERC CIP-015 mock audits only work when the auditor is independent, the risk-based rationale for feed placement is defensible, and anomaly evaluation can survive tough questioning before the real audit arrives, according to Nozomi Networks research. The control problem is not detection speed, but proving that evaluation, retention, and escalation decisions are consistent, documented, and auditable.

Editorial analysis by NHI Mgmt Group, based on content published by Nozomi Networks: “NERC CIP-015 in Practice #8: INSM Audit Readiness and Running a Mock Audit”.

Key questions

Q: What should teams do first when a NERC CIP-015 programme has not yet been tested by audit?

A: Start with an independent mock audit that is run by someone outside the programme design team.

Q: Why does poor documentation create audit risk in NERC CIP-015 monitoring programmes?

A: Because the auditor is not just checking whether documentation exists.

Q: Where do NERC CIP-015 controls fail in practice when anomaly evaluation is informal?

A: They fail when the organisation relies on ad hoc judgement, incomplete protocol knowledge, or overloaded reviewers who cannot explain why a flagged event was or was not escalated.

Practitioner guidance

• Run the mock audit independently Use a reviewer who did not design the CIP-015 programme and, where possible, has real auditor experience so the exercise surfaces weak assumptions instead of confirming them.
• Document the risk-based feed rationale Record why each network point was selected for monitoring, what scope it covers, and how that decision maps to the requirement language rather than to convenience.
• Stress-test anomaly evaluation questions Require the team to explain what counts as an anomaly, how it is evaluated, what further action follows, and why the decision is defensible under audit scrutiny.

Bottom line: The article’s central risk is that a monitoring programme can look complete while still failing under audit because its rationale and evidence trail are weak.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →