Topic starter
24/10/2026 8:47 pm
TL;DR: Sensor placement under CIP-015 has no fixed template because utilities must align monitoring locations and feeds to risk, operations and audit defensibility, according to Nozomi Networks. Defensible INSM depends on choices that can survive walkdowns, change and evidence review.
Editorial analysis by NHI Mgmt Group, based on content published by Nozomi Networks: “NERC CIP‑015 in Practice #3: Sensor Placement and Data Feeds”.
Key questions
Q: Why do packet captures alone often fail in OT monitoring programs?
A: Packet captures can show traffic, but they often miss the control context behind encrypted or privileged actions.
Q: What breaks when a sensor plan is designed only from diagrams?
A: A diagram-only plan often breaks when the team meets unavailable power, consumed ports, bandwidth limits or older facilities that no longer match documentation.
Q: How should utilities choose sensor placement for INSM under CIP-015?
A: Utilities should choose sensor placement by mapping monitoring locations to the risks they are meant to cover, then validating that choice against the site’s actual architecture and operational constraints.
Practitioner guidance
- Define a risk-based collection rationale Map each sensor and feed to the specific risk it is meant to reduce, then document why that location or source is the right one for the site.
- Blend impact and threat placement Use criticality to prioritise high-consequence assets, then test whether likely attack paths create additional choke points that also need coverage.
- Layer logs with traffic data Add controller, authentication and configuration logs where encrypted or privileged actions would otherwise be invisible in packet data alone.
Bottom line: NERC CIP-015 turns sensor placement into a risk-based governance decision, not a fixed engineering template.
Glossary terms: Internal network security monitoring, Risk-based sensor placement, High-value data feeds, Walkdown
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:12 am
Risk-based monitoring is becoming a governance test, not just a network design choice. CIP-015 makes the organization justify why specific locations and feeds were selected, which means the quality of the rationale matters as much as the sensor itself. That shifts INSM from a tooling discussion into a control-evidence discipline. Practitioners should treat monitoring design as a defensible governance artefact, not a static engineering diagram.
A question worth separating out:
Q: How do utilities know whether their CIP-015 monitoring rationale is defensible?
A: They know it is defensible when they can explain the collection strategy, show that placement aligns to risk, provide written justification for each location and produce evidence that the design is reviewed when the environment changes. Defensibility comes from consistency, documentation and periodic reassessment.
👉 Read our full editorial: NERC CIP-015 sensor placement depends on risk and evidence
This post was modified 6 days ago by NHI Mgmt Group