Preparing for CIP-015-1 and CIP-015-2 internal network security monitoring

Scope

CIP-015-1 takes effect in the U.S. on October 1, 2028 for high-impact BES Cyber Systems and medium-impact systems at Control Centers and backup Control Centers; other medium-impact BES Cyber Systems with External Routable Connectivity must comply within 24 more months (October 1, 2030). It looks inside the ESP — traffic between devices — rather than only at the boundary.

CIP-015-2: the next version

CIP-015-2 extends INSM to the EACMS and PACS associated with those BES Cyber Systems, and to the Shared Cyber Infrastructure (SCI) that supports them in virtualized environments. FERC approved CIP-015-2 on August 10, 2026 (Docket No. RD26-6-000), and NERC lists its U.S. effective date as October 1, 2029.

Its implementation plan keeps the CIP-015-1 dates and adds two steps, each a year after the matching CIP-015-1 date: EACMS and PACS for high-impact systems and for medium-impact systems at Control Centers from October 1, 2029, and for the remaining medium-impact systems with External Routable Connectivity from October 1, 2031.

Sources: NERC Project 2025-02 FAQ for CIP-015-2 (December 2025), the NERC Weekly Regulatory Update of October 26, 2026, and the FERC letter order of August 10, 2026 in Docket No. RD26-6-000.

R1 — monitor, detect, evaluate

• Part 1.1 — risk-based network data feeds: decide, with a documented risk-based rationale, where to collect network data inside the ESP (connections, devices, communications) — e.g. SPAN or mirror ports, network TAPs.
• Part 1.2 — detect anomalous network activity from those feeds — new devices, unexpected protocols, write commands where only reads are expected.
• Part 1.3 — evaluate the anomalous activity to determine further action.

R2 — retain the data

Keep the monitoring data associated with activity you determined to be anomalous at least until the action decided under Part 1.3 is complete, under documented processes (except during CIP Exceptional Circumstances).

R3 — protect the data

Protect the monitoring data collected for R1 and retained for R2 from unauthorized deletion or modification, under documented processes. In practice INSM data reveals how the control system works, so limiting access to the people who analyze it is a sensible way to do this.

Practical steps

• Start passive: monitoring that only listens cannot disturb protection systems.
• Prioritize segments where a malicious command would matter most — protection and control.
• Decide in advance who looks at alerts and how quickly.