NERC CIP-015 sensor placement: how should utilities decide?

TL;DR: CIP-015 sensor placement has no single correct design because utilities must align monitoring locations and feeds to risk, operations and audit defensibility, with impact-based and threat-based strategies each shaping different collection choices, according to Nozomi Networks. The program’s real test is whether the rationale survives change, walkdowns and evidence review.

Editorial analysis by NHI Mgmt Group, based on content published by Nozomi Networks: “NERC CIP‑015 in Practice #3: Sensor Placement and Data Feeds”.

Key questions

Q: How should utilities choose sensor placement for INSM under CIP-015?

A: Utilities should choose sensor placement by mapping monitoring locations to the risks they are meant to cover, then validating that choice against the site’s actual architecture and operational constraints.

Q: Why do packet captures alone often fail in OT monitoring programs?

A: Packet captures can show traffic, but they often miss the control context behind encrypted or privileged actions.

Q: What breaks when a sensor plan is designed only from diagrams?

A: A diagram-only plan often breaks when the team meets unavailable power, consumed ports, bandwidth limits or older facilities that no longer match documentation.

Practitioner guidance

• Define a risk-based collection rationale Map each sensor and feed to the specific risk it is meant to reduce, then document why that location or source is the right one for the site.
• Blend impact and threat placement Use criticality to prioritise high-consequence assets, then test whether likely attack paths create additional choke points that also need coverage.
• Layer logs with traffic data Add controller, authentication and configuration logs where encrypted or privileged actions would otherwise be invisible in packet data alone.

Bottom line: NERC CIP-015 turns sensor placement into a risk-based governance decision, not a fixed engineering template.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →