Key takeaways
- CIP-015-1 traces to FERC Order No.
- In the same Order No.
- Build the risk-based rationale for Part 1.1's data feed selection now, well before 2028.
NERC CIP-015-1, "Cyber Security – Internal Network Security Monitoring," is the Bulk Electric System's first mandatory Reliability Standard requiring utilities to monitor network activity inside their Electronic Security Perimeter (ESP) — not just at the perimeter. Per its own Purpose clause, it exists "to improve the probability of detecting anomalous or unauthorized network activity in order to facilitate improved response and recovery from an attack." Older CIP standards such as CIP-005 focus on controlling what crosses the ESP boundary (north-south traffic); CIP-015-1 instead targets east-west traffic between systems that are already inside that boundary, on the premise that a sufficiently capable adversary will eventually get past the perimeter and the next line of defense needs to be internal visibility.
Where it came from
CIP-015-1 traces to FERC Order No. 887, issued 18 January 2023 (182 FERC ¶ 61,021), which directed NERC to develop internal network security monitoring (INSM) requirements for all high impact BES Cyber Systems and medium impact BES Cyber Systems with External Routable Connectivity (ERC). FERC's underlying concern was that existing CIP standards addressed perimeter defense and some internal controls, but nothing specifically required baselining normal network traffic inside the "CIP-networked environment" or detecting anomalous activity once an adversary was already past the ESP boundary. NERC's Project 2023-03 standard drafting team produced CIP-015-1, which the NERC Board of Trustees adopted on 9 May 2024. FERC approved it via Order No. 907 on 26 June 2025 (Docket No. RM24-7-000, 90 FR 28889, 191 FERC ¶ 61,224), with the order's effective date set at 2 September 2025.
The three requirements, in NERC's own words
CIP-015-1 is short — three requirements — but each is specific about what a Responsible Entity must document and implement:
| Req. | VRF | What it requires |
|---|---|---|
| R1 | Medium | Implement documented process(es) for internal network security monitoring of networks protected by the entity's ESP(s) for high impact BES Cyber Systems and medium impact BES Cyber Systems with ERC, covering three parts: 1.1 network data feed(s) selected using "a risk-based rationale"; 1.2 method(s) to detect anomalous network activity from those feeds; 1.3 method(s) to evaluate detected anomalies and determine further action |
| R2 | Lower | Retain internal network security monitoring data associated with network activity determined to be anomalous, at minimum until the R1 Part 1.3 action is complete (except during CIP Exceptional Circumstances) |
| R3 | Lower | Protect the data collected under R1 and retained under R2 against the risk of unauthorized deletion or modification (except during CIP Exceptional Circumstances) |
A quiet but deliberate design choice sits in R2's own note: the Responsible Entity is "not required to retain internal network security monitoring data that is not relevant to anomalous network activity" — the retention duty attaches only to data tied to something flagged as anomalous under R1, not to all collected network data indefinitely. All three requirements require evidence retention for three calendar years, the same default CIP evidence-retention period used elsewhere in the standard family.
Who must comply, and the staggered compliance dates
CIP-015-1 applies to the same functional entity types covered by the CIP suite generally — Balancing Authorities, certain Distribution Providers, Generator Operators and Owners, Reliability Coordinators, and Transmission Operators and Owners — but only where a Facility has a high impact BES Cyber System, or a medium impact BES Cyber System with External Routable Connectivity, as categorized under CIP-002. Entities that identify no such systems are exempt entirely, alongside Canadian Nuclear Safety Commission- and US NRC-regulated Cyber Systems and a short list of ESP-to-ESP communication-link exemptions.
NERC's Implementation Plan for Project 2023-03 sets a two-phase schedule:
Control Centers and backup Control Centerswith applicable high or medium impact (ERC) BES Cyber Systems must comply upon CIP-015-1's own effective date — the Implementation Plan reasons this priority reflects "the increased reliability risk posed by high impact BES Cyber Systems, Control Centers, and backup Control Centers." All other applicable medium impact BES Cyber Systems with ERC(outside Control Centers) get a further 24 calendar months after that effective date, acknowledging "the limited pool of vendors" for INSM tooling and the added complexity of bringing widely dispersed generation and substation assets into scope.
CIP-015-1's own effective-date formula (first day of the first calendar quarter 36 months after the FERC approval order's effective date) resolves, given the 2 September 2025 order effective date, to 1 October 2028 for Control Centers and 1 October 2030 for the remaining medium impact BES Cyber Systems with ERC.
CIP-015-2 is already in motion
In the same Order No. 907, FERC found CIP-015-1 "not fully responsive" to its original Order No. 887 directive, because the standard excludes Electronic Access Control or Monitoring Systems (EACMS) and Physical Access Control Systems (PACS) located outside the ESP — systems FERC concluded present "potential avenues for attackers to infiltrate BES Cyber Systems" that CIP-015-1 as approved does not monitor. FERC directed NERC to submit a fix within 12 months of the order's effective date, and issued a clarifying Order No. 907-A on 21 August 2025 scoping the "CIP-networked environment" to communications among BES Cyber Systems, EACMS, PACS and Protected Cyber Assets (explicitly excluding PACS-to-non-PACS-controller communication). NERC's Project 2025-02 produced CIP-015-2, which retires CIP-015-1 and carries forward its Control Center / 24-month phased structure for the original BES Cyber System scope, while layering in EACMS, PACS and Shared Cyber Infrastructure monitoring on a 12-month offset from each corresponding CIP-015-1 date. CIP-015-1 is the standard enforceable today; entities should track NERC's Project 2025-02 page directly for CIP-015-2's final FERC action before treating any later compliance date as settled.
A workable starting point
Build the risk-based rationale for Part 1.1's data feed selection now, well before 2028. NERC's own Implementation Plan cites "a relatively small vendor marketplace" for INSM sensors and tooling as a reason the compliance date sits years out — early vendor selection and network-tap planning avoids a late scramble. Separate "collect" from "retain" in your designR1's data feeds can be broad, but R2's retention duty attaches only to data tied to activity actually determined anomalous under Part 1.2 — building a pipeline that distinguishes the two from the start avoids over-retaining raw network capture that CIP-015-1 never required you to keep. Treat R3's data-integrity protection as a forensic-chain-of-custody requirement, not just storage security — the standard's own language ties it explicitly to "unauthorized deletion or modification," the same concern that drives evidence handling in incident response generally. Track CIP-002 categorization changes against the two-phase compliance clockA Facility's Control Center status or ERC determination under CIP-002 directly decides which of the two 2028/2030 compliance dates applies to it. Scope EACMS/PACS network visibility alongside CIP-015-1 work, not after it, given CIP-015-2's 12-month-offset expansion is already drafted — INSM sensor placement decisions made for CIP-015-1 compliance will likely need to extend to EACMS/PACS network segments shortly after.
SoftWSP's OT network assessments can help document the network data feeds, anomaly-detection methods, and data-retention evidence CIP-015-1 requires: see OT Snapshot.
This guide quotes NERC's own published text of CIP-015-1 and its Implementation Plan, and the Federal Register text of FERC Order No. 907; it is not a substitute for the full standard, NERC's implementation plan, or compliance/legal advice. CIP-015-1 is the standard in force today — CIP-015-2 is drafted but its FERC approval status should be confirmed directly with NERC before relying on any date beyond 1 October 2030.
Sources
- NERC: CIP-015-1 — Cyber Security – Internal Network Security Monitoring (full standard text: Purpose, Applicability, Requirements R1-R3 with Measures, Compliance, Violation Severity Levels, Version History)
- NERC: Implementation Plan — Project 2023-03 Internal Network Security Monitoring (CIP-015-1 effective date formula and the Control Center / 24-month phased compliance dates)
- Federal Register: Critical Infrastructure Protection Reliability Standard CIP-015-1 (FERC Order No. 907, Docket No. RM24-7-000, 90 FR 28889, approved 2025-06-26, published 2025-07-02)
- NERC: Implementation Plan — Project 2025-02 Internal Network Security Monitoring (CIP-015-2; background on FERC Order No. 907 and Order No. 907-A, and the carried-forward CIP-015-1 phased dates)
Frequently asked questions
What is NERC CIP-015-1, and why does it exist?
CIP-015-1, "Cyber Security – Internal Network Security Monitoring," is a mandatory NERC Reliability Standard whose Purpose clause states it exists "to improve the probability of detecting anomalous or unauthorized network activity in order to facilitate improved response and recovery from an attack." It is the Bulk Electric System's first CIP standard to require internal (east-west) network monitoring inside an Electronic Security Perimeter (ESP), rather than only perimeter-facing (north-south) controls. NERC developed it in response to a Federal Energy Regulatory Commission (FERC) directive, Order No. 887 (18 January 2023, 182 FERC ¶ 61,021), which found that existing CIP standards left "a security gap" once an adversary got past the perimeter, since nothing required monitoring of what happened to network traffic after that point.
What do CIP-015-1's three requirements actually say?
Per NERC's published standard text: Requirement R1 (Violation Risk Factor: Medium) requires each Responsible Entity to implement documented process(es) for internal network security monitoring of networks protected by its Electronic Security Perimeter(s) covering high impact BES Cyber Systems and medium impact BES Cyber Systems with External Routable Connectivity (ERC), broken into three parts: Part 1.1, implement — "using a risk-based rationale" — network data feed(s) to monitor network activity including connections, devices and network communications; Part 1.2, implement method(s) to detect anomalous network activity from those feeds; and Part 1.3, implement method(s) to evaluate detected anomalous activity to determine further action. Requirement R2 (VRF: Lower) requires retaining internal network security monitoring data associated with activity determined anomalous, at minimum until the Part 1.3 action is complete — data that turns out not to be anomalous does not have to be retained. Requirement R3 (VRF: Lower) requires protecting both the data collected under R1 and the data retained under R2 against the risk of unauthorized deletion or modification. Both R2 and R3 apply except during CIP Exceptional Circumstances.
Who must comply, and when?
CIP-015-1 applies to the same Responsible Entity types as other CIP standards — Balancing Authorities, certain Distribution Providers, Generator Operators and Owners, Reliability Coordinators, and Transmission Operators and Owners — but only for Facilities with high impact BES Cyber Systems or medium impact BES Cyber Systems with External Routable Connectivity; entities with no such systems (per CIP-002's categorization) are exempt, along with Canadian Nuclear Safety Commission- and NRC-regulated Cyber Systems and a few ESP-to-ESP communication-link exemptions. NERC's Implementation Plan (Project 2023-03) sets a two-phase compliance schedule keyed to CIP-015-1's own effective date: Control Centers and backup Control Centers with applicable BES Cyber Systems must comply immediately on that effective date, while other medium impact BES Cyber Systems with ERC (outside Control Centers) get 24 additional calendar months. FERC approved CIP-015-1 via Order No. 907 on 26 June 2025 (Docket No. RM24-7-000, 90 FR 28889, 191 FERC ¶ 61,224), with the order itself effective 2 September 2025; per the Implementation Plan's 36-months-after-FERC-approval formula, that puts the Control Center compliance date at 1 October 2028 and the remaining-assets date at 1 October 2030.
Is CIP-015-1 already being superseded?
It is being expanded, not replaced yet. In the same Order No. 907, FERC found CIP-015-1 "not fully responsive" to its original Order No. 887 directive because it excludes Electronic Access Control or Monitoring Systems (EACMS) and Physical Access Control Systems (PACS) located outside the ESP, leaving what FERC called a reliability gap — and directed NERC to submit a fix within 12 months. FERC also issued a clarifying Order No. 907-A on 21 August 2025 scoping the "CIP-networked environment" to communications between BES Cyber Systems, EACMS, PACS and Protected Cyber Assets. NERC's Project 2025-02 produced the result, CIP-015-2, which carries forward CIP-015-1's Control Center / non-Control-Center phased structure for the original BCS scope while adding new EACMS/PACS/Shared Cyber Infrastructure monitoring on a 12-month offset from each corresponding CIP-015-1 date. CIP-015-1 remains the standard in force today; device and asset owners should track NERC's Project 2025-02 page directly for CIP-015-2's final FERC approval status before assuming any later date is settled.
In this cluster
