NERC CIP-015-1 Is Approved—Here’s What Asset Owners Need to Do

FERC approved NERC CIP-015-1, requiring Internal Network Security Monitoring (INSM) — east–west traffic monitoring — inside Electronic Security Perimeters for High and Medium Impact BES Cyber Systems with External Routable Connectivity, with core requirements to collect/detect/analyze network activity, retain INSM data, and protect it from unauthorized modification or deletion. FERC also directed NERC to expand CIP-015’s scope to include Electronic Access Control or Monitoring Systems (EACMS) and Physical Access Control Systems (PACS) outside ESPs and to submit modifications within one year; CIP-015-1 becomes enforceable October 1, 2028. The document highlights practical preparation steps for asset owners, notes industry examples (Dragos platform capabilities and Dominion Energy’s deployment), and frames INSM as both a compliance and operational-resilience priority.