Anchor: Register-now1

Webinar Series: NERC CIP-015 INSM in Practice

Field lessons, architecture considerations, and deployment strategies for Internal Network Security Monitoring.

The final episode: Ask Our Experts Anything.


The finale isn't until Sept 30. We want time to collect every good question you've got, so send them in early and often. This is the last episode in the CIP-015 INSM series, and it runs entirely on your questions. Whatever you submit, our experts will answer live. No slides, no set agenda; the session is built from what you send in.
Anchor: on-demand

Watch the NERC CIP-015 INSM in Practice Series On Demand

Catch up on practical guidance from Nozomi Networks, SEL, and Emerson experts on INSM strategy, implementation, sensor placement, and network data feeds for electric utilities.

Read the Newest Blogs

Explore Nozomi Networks' latest insights on INSM strategy, deployment, network visibility, and CIP-015 readiness.
Anchor: Register-now

Learn more about what's left of the NERC CIP-015 in Practice Series

Episode 1: What Utilities Are Actually Running Into — and How They’re Solving It (recording and blog are available) Wed, March 18, 2026 at 8 AM - 9 AM PT

After a quick overview of the INSM standard, this session will explore how security and compliance teams are approaching INSM in practice — where they’re running into challenges...

Episode 2:  INSM Current State of Implementations (recording and blog are available) Wed, April 8, 2026, at 8 AM - 8:30 AM PT

Are you running behind, on track or ahead of schedule with your CIP-015 INSM implementation? Do you know? In this session, we’ll look at ...

Episode 3: Sensor Placement and Network Data Feeds with SEL and Emerson (recording and blog are available) Wed, April 29, 2026, at 8 AM -8:30 AM PT

Join Will Edwards, Head of Cyber Services at Schweitzer Engineering Laboratories (SEL), Nicholas Janouskovec, Global Cybersecurity at Emerson, and Markus Mueller as they break down how to effe...

Episode 4: INSM Systems Classification (recording and blog are available) Wed, May 20, 2026, at 8 AM -8:30 AM PT

How are you going to classify your INSM system? As an EACMS, PCA or BCSI storage location? The classification can significantly affect the effort required to stay...

Episode 5: INSM Anomaly Detection Strategies (recording and blog are available) Wed, June 10, 2026 at 8 AM -8:30 AM PT

To detect network anomalies for CIP-015 compliance, you must first baseline normal behavior. But without careful tuning, anomaly detection can introduce a lot of noise. Thi...

Episode 6: Evidence Generation and Collection (recording and blog are available)  Wed, July 1, 2026 at 8 AM -8:30 AM PT

Evidence collection and retention are key requirements for proving compliance with CIP-015 during an audit. This session will cover all things ...

Watch the on demand

Episode 7: Anomaly Investigation and Response with Skyhelm (recording and blog are available) Wed, July 22, 2026 at 8 AM - 9 AM PT

CIP-015-1 & 2 require that entities evaluate the anomalous network activity. How these processes are developed, implemented, and maintained can significantly impact the long-term sustainab...

Watch the ondemand

Episode 8: INSM Audit Readiness (Running A Mock Audit) with Archer (recording) Wed, August 19, 2026 at 8 AM - 9 AM PT

Making it through an audit without any findings or areas of concern takes preparation and forethought.
This session will provide guidance on preparing for an audit, i...

Episode 9: Writing Your NERC CIP-015 INSM Program Wed, Sept 9, 2026 at 8 AM - 9 AM PT

The basis for a successful NERC CIP program is often the written policies and processes that define how an entity will meet the requirements. CIP-015 INSM is no different, and this session pro...

Episode 10: Finale Ask Our Experts Anything Session Wed, Sept 30, 2026 at 8 AM - 9 AM PT

Ask the Nozomi Networks team anything. In this interactive session, our Subject Matter Experts will address questions from the audience and the field, diving deeper into the topics covered thr...

Meet our Speakers

The professionals who will teach you

Markus Mueller

Field CISO

Markus has over 20 years of experience in OT, working across a wide range of industries, with a particular emphasis on utilities, energy and manufacturing. In his previous roles, he led OT tea...

Steve Parker

Managing Partner & Principal Consultant
Archer

At Archer, Steven serves as Managing Partner and Principal Consultant, leading NERC CIP compliance engagements, audit readiness efforts, regulatory strategy development, security control matur...

Leonard Chamberlin | CISSP, CISA, PSP, C3P, NIST CSF 2.0

Managing Partner & Principal Consultant

At Archer, Leonard serves as Managing Partner and Principal Consultant, leading NERC CIP compliance programs, audit-readiness engagements, cybersecurity architecture design reviews (including ...

Marc Berner

Product Managmenet Nozomi Networks

Marc is a technology leader with over a decade of experience orchestrating high-performing teams to deliver cutting-edge, scalable solutions that drive business transformation.

Michael Dutko

Sales Engineer Nozomi Networks

Mike is an experienced ICS/OT Senior Security Consultant with a demonstrated track record across multiple industrial verticals. Focus on assessments and helping clients build and develop their...

Sandeep Lota

Global Field CTO

Sandeep Lota is a seasoned professional in the fields of cybersecurity and technology, currently serving as Global Field CTO at Nozomi Networks, his responsibilities include overseeing technic...

Chris Grove

Director Cybersecurity Strategy

Chris brings over 25 years of cybersecurity experience across IT, OT, and IoT environments, leading complex security initiatives for mission-critical infrastructure worldwide. He has supported...

Will Edwards

Head of Cyber Services Schweitzer Engineering Laboratories (SEL)

Will is presently the head of SEL Cyber Services team within Secure Solutions. Prior to joining SEL, William worked for Concurrent Computer Corporation, where he ensured quality...

Nicholas Janouskovec

Global Cybersecurity at Emerson

Nicholas is the Business Development Manager for Emerson’s Guardian™ digital platform and cybersecurity solutions and services for the power and water industries.

Jeff Foley

Chief Technology Evangelist for Cybersecurity Siemens

Jeff Foley, with Siemens since 1998 and now Chief Technology Evangelist for Cybersecurity, leads global ICS cybersecurity development. With nearly 30 years at Siemens, he works across manufact...

Jeremy Dreyer

CEO, SkyHelm

Jeremy Dreyer is the founder and CEO of SkyHelm, a cybersecurity firm focused on protecting America's critical infrastructure. He has spent more than 20 years in OT and network security, desig...

Logan Sarrington

Leads deployments, SkyHelm

Logan Sarrington leads deployments for SkyHelm’s OT monitoring practice. He works with electric utilities across the country, scoping and deploying OT monitoring sensors, building asset invent...

Tim Pierce

Sr. Technical Sales Engineer Nozomi Networks

Tim Pierce is a professional at Nozomi Networks with a strong background in cybersecurity and industrial network protection. He brings experience working with organizations to secure critical ...

Get Ready: NERC CIP-015-2 Will Expand INSM Beyond the Electronic Security Perimeter

NERC CIP-015-2 is poised to significantly expand Internal Network Security Monitoring (INSM) requirements beyond the traditional Electronic Security Perimeter (ESP), introducing new considerations for Electronic Access Control and Monitoring Systems (EACMS) and Physical Access Control Systems (PACS). For utilities, this evolution will likely drive important architectural, operational, and compliance changes that impact how internal OT networks are monitored, secured, and managed. Understanding what these changes mean for your environment — and how to prepare your INSM strategy accordingly — will be critical for reducing regulatory risk and maintaining compliance readiness.

Learn more about what’s changing and how utilities can prepare for the next phase of NERC CIP-015 requirements.

NERC CIP‑015 in Practice: Early Challenges and Common Pitfalls for Utilities

Utilities preparing for NERC CIP-015 are quickly discovering that compliance is more than deploying sensors — it requires operational alignment, architecture planning, and a clear understanding of Internal Network Security Monitoring (INSM) expectations. From visibility gaps and network segmentation challenges to data collection, alert tuning, and audit readiness, early adopters are already encountering common pitfalls that can slow progress and increase risk.
Learn about the real-world challenges utilities face as they implement INSM programs, and share practical guidance to help organizations avoid costly mistakes and accelerate compliance readiness.

Why Nozomi Networks for NERC CIP-015-1?

Compliance Assurance


  • Audit-ready evidence generation mapped directly to CIP-015-1 INSM requirements

  • Nozomi NERC CIP SMEs who support our customers...

Seamless Program 
Integration

  • Easy incorporation into your existing NERC CIP program
  • An extensive set of native integrations to co...

Flexible & Scalable 
Approach


  • Scalable from a single sensor to a multi-tier enterprise architecture
  • On-prem, Hybrid, and SaaS ...

Collaboration

We foster teamwork and open communication, believing that the best ideas come from collaboration.

Innovation

We foster teamwork and open communication, believing that the best ideas come from collaboration.

Discover More

Episode 4: INSM Systems Classification

How are you going to classify your INSM system? As an EACMS, PCA, or BCSI storage location? The classification can significantly affect the effort required to stay compliant with CIP-015. This ses...

How to Ensure You Have Complete OT/ICS Asset Visibility

It takes a combination of passive and active cybersecurity sensors, OT/IoT protocol support, third-party connectors and AI-powered asset intelligence to achieve a complete asset inventory.

Using Nozomi Asset Intelligence to Simplify OT Asset Management

Managing a large asset inventory with dozens of different vendors, terms and device types can be a huge challenge. Our Asset Intelligence engine harnesses the power of machine learning algorithms t...

How to Classify Your NERC CIP-015-1 INSM System Correctly

NERC CIP-15-1 requires entities to classify their INSM system as a PCA, EACMS or BCSI. Avoid headaches by determining the right classification based on location, function and data.

How to Classify Your NERC CIP-015-1 INSM System Correctly

NERC CIP-15-1 requires entities to classify their INSM system as a PCA, EACMS or BCSI. Avoid headaches by determining the right classification based on location, function and data.

NERC CIP‑015 in Practice #3: Sensor Placement and Data Feeds

Deciding on sensor placement and what network data feeds to collect are key considerations for utilities and power producers implementing INSM for NERC CIP-015. Here’s the guidance you need.

Nozomi Networks Academy | Course Catalog

Nozomi Networks Academy offers public and private instructor-led training, on-demand courses, and self-directed eLearning to help you and your team excel in your understanding of Nozomi Networks so...

Product Tour

Explore Nozomi Networks' interactive asset inventory management product tour, featuring real-time asset visibility, threat detection, and AI-driven insights.

Download the 2026 Gartner Magic Quadrant for CPS Protection Platforms

Nozomi Networks is a Leader in the Magic Quadrant™ for Cyber-Physical System Protection Platforms

Get Complete Asset Data & Context

See how the Nozomi Networks platform automates asset inventory with passive and active monitoring, DPI and AI-enhanced detection

INSM & NERC CIP: What Municipal Electric Utilities Need to Know

Learn how INSM helps municipal electric utilities meet NERC CIP requirements, improve OT visibility, and strengthen critical infrastructure security.

NERC CIP-015 in Practice #7: Anomaly Investigation and Response

NERC CIP-015 requires utilities to evaluate anomalies and take action, including a possible escalation to incident response under CIP-008. See what evaluation processes and common responses apply t...

Nozomi Networks Labs Discovers 9 Vulnerabilities Affecting Cognex InSight IS2000M-120 Smart Camera

Nozomi Networks Labs discovered vulnerabilities in the Cognex IS2000M-120 industrial smart camera.

NERC CIP Compliance Guide

This mapping guide demonstrates how Nozomi Networks’ platform supports the NERC CIP compliance requirements.

Preparing for NERC CIP-015-1: Internal Network Security Monitoring for Electric Utilities

The NERC CIP-015-1 reliability standard mandating internal network security monitoring has been approved and goes into effect September 2, 2025, kicking off implementation timelines for BESs. Here'...

NERC CIP-015 in Practice #2: The Current State of INSM in Utilities

NERC CIP-015-1 implementations are well underway. Here’s what’s changing with CIP-015-2 and how regulated entities can set themselves up for success.

Episode 3: Sensor Placement and Network Data Feeds with SEL and Emerson

Join Will Edwards, Head of Cyber Services at Schweitzer Engineering Laboratories (SEL), Nicholas Janouskovec, Global Cybersecurity at Emerson, and Markus Mueller as they break down how to effective...

NERC CIP‑015 in Practice #1: Early Challenges and Common Pitfalls for Utilities

As NERC-regulated utilities begin to tackle CIP-015, here are some challenges and pitfalls they’re running into, from underestimating the data management and evidence collection burden to treating ...

4 OT Attack Scenarios: How Arc Embedded Detects Threats in Your Networks

Modernizing Asset Inventory: A Smarter Approach to Securing Industrial Environments

See how modernizing asset inventory enhances security and compliance in industrial environments through improved visibility and risk management

Counterpoint: Not All OT Security Acquisitions Are the Same

Mitsubishi Electric is acquiring Nozomi not simply for our technology, but for our established and growing market position, strong customer base, and proven revenue stream.

Counterpoint: Not All OT Security Acquisitions Are the Same

Mitsubishi Electric is acquiring Nozomi not simply for our technology, but for our established and growing market position, strong customer base, and proven revenue stream.

Nozomi Arc: An Endpoint Sensor for OT and IoT Cybersecurity Environments -June 2025

Nozomi Networks Vantage

Vantage leverages the power and simplicity of SaaS to deliver unmatched security and visibility across your OT, IoT & IT networks.

Episode 7: Anomaly Investigation and Response with Skyhelm

CIP-015-1 & 2 require that entities evaluate the anomalous network activity. How these processes are developed, implemented, and maintained can significantly impact the long-term sustainability of ...

Arc Embedded for Schneider Electric SCADAPack 47xi RTUs

Nozomi Arc embedded directly into Schneider Electric RTUs is the next evolution in cyber-physical system protection.

Episode 2: INSM Current State of Implementations

Are you running behind, on track or ahead of schedule with your CIP-015 INSM implementation? Do you know? In this session, we’ll look at what requirements early adopters and strategic planners are ...

To Close the OT Cybersecurity Skills Gap, Let AI Do What AI Does Best

Between flat cybersecurity budgets and a shortage of experienced OT/IoT cybersecurity professionals, industrial environments present the ideal use case for AI.

Top Five Global Airport Improves Visibility and Security | Case Study | Nozomi Networks

Read the Top Five Global Airport Improves Visibility and Security case study and learn more.

Get Ready: NERC CIP-015-2 Will Expand INSM Beyond the Electronic Security Perimeter

Get Ready: NERC CIP-015-2 Will Expand INSM Beyond the Electronic Security Perimeter

Get Ready: NERC CIP-015-2 Will Expand INSM Beyond the Electronic Security Perimeter

Get Ready: NERC CIP-015-2 Will Expand INSM Beyond the Electronic Security Perimeter

GMT20260624-183605_Recording.cutfile.20260630174341807_gvo_1920x1080.mp4

The Security Sandbox | Combined OT, IoT and IT Threat Intelligence

Buyer’s Guide to OT & IoT Asset Inventory Solutions for Security Leaders

The Valencian Health Department Improves Security and Protection | Case Study | Nozomi Networks

Read the The Valencian Health Department Improves Security and Protection case study and learn more.

Vermont Electric Improves ICS Cybersecurity | Case Study | Nozomi Networks

Read the Vermont Electric Improves ICS Cybersecurity case study and learn more.

NERC CIP‑015 in Practice #8: INSM Audit Readiness (Running a mock audit)

Making it through an audit without any findings or areas of concern takes preparation and forethought. This session will provide guidance on preparing for an audit, including how to set up a mock ...

Unparalleled Asset Inventory: Solution Brief

Nozomi Asset Intelligence:PRODUCT OVERVIEW

NERC-CIP Compliance Guide

The Security Sandbox | Our Journey to Becoming a Leader for CPS Protection Platforms

NERC CIP-015 in Practice #4: INSM System Classification

How you classify your INSM system components for NERC CIP-15-1 translates into compliance burden and risk. NERC CIP-15-2 adds more complexity and impact to those decisions. Here’s guidance

Episode 6: Evidence Generation and Collection with Siemens

Evidence collection and retention are key requirements for proving compliance with CIP-015 during an audit. This session will cover all things evidence, including what to collect, how to store it (...

NERC CIP-015 in Practice #5: Anomaly Detection Strategies

NERC CIP-015 in Practice #5: Anomaly Detection Strategies

Episode 2: INSM Current State of Implementations- OLD

Are you running behind, on track or ahead of schedule with your CIP-015 INSM implementation? Do you know? In this session, we’ll look at what requirements early adopters and strategic planners are ...

Episode 5: INSM Anomaly Detection Strategies

To detect network anomalies for CIP-015 compliance, you must first establish a baseline of normal behavior. But without careful tuning, anomaly detection can introduce significant noise. This sessi...

The Nozomi Networks Platform for OT, IoT and CPS Security

Cybersecurity and Analytics for Industrial Control, OT and IoT Networks

NERC CIP-015 in Practice #6: Evidence Generation and Collection

Understand the fine points of NERC CIP 015-01 evidence collection including common examples for each type of evidence and retention requirements for operational data vs. evidence.

Nozomi-Networks-Asset-Management-Webinar-2025

Episode 1: What Utilities Are Actually Running Into — and How They’re Solving It

In this session will explore how security and compliance teams are approaching INSM in practice — where they’re running into challenges, what early implementations are revealing and how risk-based ...

Oil & Gas Producer Deploys Global ICS Security Program | Case Study | Nozomi Networks

Read the Oil & Gas Producer Deploys Global ICS Security Program case study and learn more.

Mapping the Ransomware Landscape: Global Hotspots and Emerging Threats

We look at the most recent trends in the ransomware landscape, based on the unique real customer data, including top ransomware families, most targeted countries and industries.