Explore

Simplify NERC CIP Compliance and Audit Readiness

Turn continuous OT visibility and monitoring into evidence for NERC CIP compliance. The Nozomi Networks platform helps streamline compliance activities as part of normal operations, while integrating with your existing technology stack to minimize additional investment.

Where Are You in Your CIP-015 Journey?

Your CIP-015 Journey

Step 1 - Plan

Scoping My INSM Program


Start with the requirements. Understand what CIP-015-1 asks of your organization, what CIP-015-2 will add, and what early adopters are learning as they build their INSM programs...

Step 2 - Build

Designing and Deploying INSM


Get the architecture right the first time. Learn how to classify your INSM system, where to place sensors, which network data feeds to collect, and how to tune anomaly detection...

Step 3 - Prove

Operating and Preparing for Audit


Turn monitoring into evidence. Learn what evidence to collect, how to store and retain it, and how to meet CIP-015 evidence requirements so you can walk into your audit with con...

Want the full picture? Watch the complete NERC CIP-015 series below ↓
Anchor: on-demand

See NERC CIP-015 INSM in Practice

Get practical, real-world guidance from Nozomi Networks and industry experts on INSM strategy, implementation, sensor placement, network data feeds, anomaly detection, evidence collection, and audit readiness.

Explore

See How Vermont Electric Co-op Secures the Grid

Vermont Electric Cooperative delivers reliable power to 75 communities across eight counties. Its operations team was stitching together data from three separate systems by hand. With Nozomi Networks, they now see every network asset and how it communicates, get real-time alerts on anomalies, and save 10–12 hours of manual work every week.

CUSTOMER SPOTLIGHT - ELECTRIC UTILITY

“Nozomi Networks' Guardian solution delivers the reliability, cybersecurity and operational efficiency benefits that we sought. Its performance gives me peace of mind because we’re continuously improving our security profile.” Kris Smith Manager of Operations Engineering Vermont Electric Cooperative

Why Nozomi Networks

How Nozomi Networks Simplifies NERC CIP Compliance

We understand the complexities and burden of NERC CIP-015-1 compliance for responsible entities.

Compliance Assurance

  • Audit-ready evidence generation mapped directly to CIP-015-1 INSM requirements
  • Nozomi NERC CIP SMEs who support our customers' programs and evidence needs
  • Data retention, management, and redundancy that meet evidence retention requirements

Seamless Program Integration

  • Easy incorporation into your existing NERC CIP program
  • An extensive set of native integrations to common industry tools
  • Integration into your environment with assurance of operational uptime

Flexible & Scalable Approach

  • Scalable from a single sensor to a multi-tier enterprise architecture
  • On-prem, Hybrid, and SaaS (Licensing Only) deployment options
  • Wide range of sensor options, including embedded, lightweight, endpoint, virtual, and physical

Explore

Prepare for What’s Next
 NERC CIP-015-2 will expand INSM beyond the electronic security perimeter

NERC CIP-015-2 is poised to significantly expand Internal Network Security Monitoring (INSM) requirements beyond the traditional Electronic Security Perimeter (ESP), introducing new considerations for Electronic Access Control and Monitoring Systems (EACMS) and Physical Access Control Systems (PACS). For utilities, this evolution will likely drive important architectural, operational, and compliance changes that impact how internal OT networks are monitored, secured, and managed. Understanding what these changes mean for your environment — and how to prepare your INSM strategy accordingly — will be critical for reducing regulatory risk and maintaining compliance readiness.

Learn more about what’s changing and how utilities can prepare for the next phase of NERC CIP-015 requirements.

Navigate NERC CIP-015 with Practical Guidance

Explore insights from early implementations, including common pitfalls, sensor placement, system classification, anomaly detection, and other considerations for building an effective INSM program.

Episode 4: INSM Systems Classification

How are you going to classify your INSM system? As an EACMS, PCA, or BCSI storage location? The classification can significantly affect the effort required to stay compliant with CIP-015. This ses...

How to Ensure You Have Complete OT/ICS Asset Visibility

It takes a combination of passive and active cybersecurity sensors, OT/IoT protocol support, third-party connectors and AI-powered asset intelligence to achieve a complete asset inventory.

Using Nozomi Asset Intelligence to Simplify OT Asset Management

Managing a large asset inventory with dozens of different vendors, terms and device types can be a huge challenge. Our Asset Intelligence engine harnesses the power of machine learning algorithms t...

How to Classify Your NERC CIP-015-1 INSM System Correctly

NERC CIP-15-1 requires entities to classify their INSM system as a PCA, EACMS or BCSI. Avoid headaches by determining the right classification based on location, function and data.

How to Classify Your NERC CIP-015-1 INSM System Correctly

NERC CIP-15-1 requires entities to classify their INSM system as a PCA, EACMS or BCSI. Avoid headaches by determining the right classification based on location, function and data.

NERC CIP‑015 in Practice #3: Sensor Placement and Data Feeds

Deciding on sensor placement and what network data feeds to collect are key considerations for utilities and power producers implementing INSM for NERC CIP-015. Here’s the guidance you need.

NERC CIP-015 in Practice #8: INSM Audit Readiness and Running a Mock Audit

A CIP-015 mock audit works best when you use internal or third-party independent auditors, pressure-test your risk-based rationale, and put your SMEs in the hot seat before the real auditors show up.

Nozomi Networks Academy | Course Catalog

Nozomi Networks Academy offers public and private instructor-led training, on-demand courses, and self-directed eLearning to help you and your team excel in your understanding of Nozomi Networks so...

Product Tour

Explore Nozomi Networks' interactive asset inventory management product tour, featuring real-time asset visibility, threat detection, and AI-driven insights.

Download the 2026 Gartner Magic Quadrant for CPS Protection Platforms

Nozomi Networks is a Leader in the Magic Quadrant™ for Cyber-Physical System Protection Platforms

Get Complete Asset Data & Context

See how the Nozomi Networks platform automates asset inventory with passive and active monitoring, DPI and AI-enhanced detection

INSM & NERC CIP: What Municipal Electric Utilities Need to Know

Learn how INSM helps municipal electric utilities meet NERC CIP requirements, improve OT visibility, and strengthen critical infrastructure security.

NERC CIP-015 in Practice #7: Anomaly Investigation and Response

NERC CIP-015 requires utilities to evaluate anomalies and take action, including a possible escalation to incident response under CIP-008. See what evaluation processes and common responses apply t...

Nozomi Networks Labs Discovers 9 Vulnerabilities Affecting Cognex InSight IS2000M-120 Smart Camera

Nozomi Networks Labs discovered vulnerabilities in the Cognex IS2000M-120 industrial smart camera.

NERC CIP Compliance Guide

This mapping guide demonstrates how Nozomi Networks’ platform supports the NERC CIP compliance requirements.

Preparing for NERC CIP-015-1: Internal Network Security Monitoring for Electric Utilities

The NERC CIP-015-1 reliability standard mandating internal network security monitoring has been approved and goes into effect September 2, 2025, kicking off implementation timelines for BESs. Here'...

NERC CIP-015 in Practice #2: The Current State of INSM in Utilities

NERC CIP-015-1 implementations are well underway. Here’s what’s changing with CIP-015-2 and how regulated entities can set themselves up for success.

Episode 3: Sensor Placement and Network Data Feeds with SEL and Emerson

Join Will Edwards, Head of Cyber Services at Schweitzer Engineering Laboratories (SEL), Nicholas Janouskovec, Global Cybersecurity at Emerson, and Markus Mueller as they break down how to effective...

NERC CIP‑015 in Practice #1: Early Challenges and Common Pitfalls for Utilities

As NERC-regulated utilities begin to tackle CIP-015, here are some challenges and pitfalls they’re running into, from underestimating the data management and evidence collection burden to treating ...

4 OT Attack Scenarios: How Arc Embedded Detects Threats in Your Networks

Modernizing Asset Inventory: A Smarter Approach to Securing Industrial Environments

See how modernizing asset inventory enhances security and compliance in industrial environments through improved visibility and risk management

Counterpoint: Not All OT Security Acquisitions Are the Same

Mitsubishi Electric is acquiring Nozomi not simply for our technology, but for our established and growing market position, strong customer base, and proven revenue stream.

Counterpoint: Not All OT Security Acquisitions Are the Same

Mitsubishi Electric is acquiring Nozomi not simply for our technology, but for our established and growing market position, strong customer base, and proven revenue stream.

Nozomi Arc: An Endpoint Sensor for OT and IoT Cybersecurity Environments -June 2025

Nozomi Networks Vantage

Vantage leverages the power and simplicity of SaaS to deliver unmatched security and visibility across your OT, IoT & IT networks.

Episode 7: Anomaly Investigation and Response with Skyhelm

CIP-015-1 & 2 require that entities evaluate the anomalous network activity. How these processes are developed, implemented, and maintained can significantly impact the long-term sustainability of ...

Arc Embedded for Schneider Electric SCADAPack 47xi RTUs

Nozomi Arc embedded directly into Schneider Electric RTUs is the next evolution in cyber-physical system protection.

Episode 2: INSM Current State of Implementations

Are you running behind, on track or ahead of schedule with your CIP-015 INSM implementation? Do you know? In this session, we’ll look at what requirements early adopters and strategic planners are ...

To Close the OT Cybersecurity Skills Gap, Let AI Do What AI Does Best

Between flat cybersecurity budgets and a shortage of experienced OT/IoT cybersecurity professionals, industrial environments present the ideal use case for AI.

Top Five Global Airport Improves Visibility and Security | Case Study | Nozomi Networks

Read the Top Five Global Airport Improves Visibility and Security case study and learn more.

Get Ready: NERC CIP-015-2 Will Expand INSM Beyond the Electronic Security Perimeter

Get Ready: NERC CIP-015-2 Will Expand INSM Beyond the Electronic Security Perimeter

Get Ready: NERC CIP-015-2 Will Expand INSM Beyond the Electronic Security Perimeter

Get Ready: NERC CIP-015-2 Will Expand INSM Beyond the Electronic Security Perimeter

GMT20260624-183605_Recording.cutfile.20260630174341807_gvo_1920x1080.mp4

The Security Sandbox | Combined OT, IoT and IT Threat Intelligence

Buyer’s Guide to OT & IoT Asset Inventory Solutions for Security Leaders

The Valencian Health Department Improves Security and Protection | Case Study | Nozomi Networks

Read the The Valencian Health Department Improves Security and Protection case study and learn more.

Vermont Electric Improves ICS Cybersecurity | Case Study | Nozomi Networks

Read the Vermont Electric Improves ICS Cybersecurity case study and learn more.

NERC CIP‑015 in Practice #8: INSM Audit Readiness (Running a mock audit)

Making it through an audit without any findings or areas of concern takes preparation and forethought. This session will provide guidance on preparing for an audit, including how to set up a mock ...

Unparalleled Asset Inventory: Solution Brief

Nozomi Asset Intelligence:PRODUCT OVERVIEW

NERC-CIP Compliance Guide

The Security Sandbox | Our Journey to Becoming a Leader for CPS Protection Platforms

NERC CIP-015 in Practice #4: INSM System Classification

How you classify your INSM system components for NERC CIP-15-1 translates into compliance burden and risk. NERC CIP-15-2 adds more complexity and impact to those decisions. Here’s guidance

Episode 6: Evidence Generation and Collection with Siemens

Evidence collection and retention are key requirements for proving compliance with CIP-015 during an audit. This session will cover all things evidence, including what to collect, how to store it (...

NERC CIP-015 in Practice #5: Anomaly Detection Strategies

NERC CIP-015 in Practice #5: Anomaly Detection Strategies

Episode 2: INSM Current State of Implementations- OLD

Are you running behind, on track or ahead of schedule with your CIP-015 INSM implementation? Do you know? In this session, we’ll look at what requirements early adopters and strategic planners are ...

Episode 5: INSM Anomaly Detection Strategies

To detect network anomalies for CIP-015 compliance, you must first establish a baseline of normal behavior. But without careful tuning, anomaly detection can introduce significant noise. This sessi...

The Nozomi Networks Platform for OT, IoT and CPS Security

Cybersecurity and Analytics for Industrial Control, OT and IoT Networks

NERC CIP-015 in Practice #6: Evidence Generation and Collection

Understand the fine points of NERC CIP 015-01 evidence collection including common examples for each type of evidence and retention requirements for operational data vs. evidence.

Nozomi-Networks-Asset-Management-Webinar-2025

Vermont Electric Secures the Grid with Nozomi Networks

Learn how Vermont Electric is keeping its operations resilient with Nozomi Networks

Episode 1: What Utilities Are Actually Running Into — and How They’re Solving It

In this session will explore how security and compliance teams are approaching INSM in practice — where they’re running into challenges, what early implementations are revealing and how risk-based ...

Oil & Gas Producer Deploys Global ICS Security Program | Case Study | Nozomi Networks

Read the Oil & Gas Producer Deploys Global ICS Security Program case study and learn more.

Mapping the Ransomware Landscape: Global Hotspots and Emerging Threats

We look at the most recent trends in the ransomware landscape, based on the unique real customer data, including top ransomware families, most targeted countries and industries.

Vermont Electric Case Study.pdf