Key Insights for NERC CIP-015 Compliance: Anomaly Detection vs. Detecting Anomalous Activity

**Executive summary:** This Dragos blog explains the proposed NERC CIP-015 Internal Network Security Monitoring (INSM) requirements driven by FERC/NERC and focuses on R1.2’s mandate to detect anomalous network activity; it describes four complementary detection approaches—behavioral, indicators, configuration, and modeling—and argues that combining them reduces false positives, improves contextual response, and helps utilities meet compliance while positioning the Dragos Platform as a solution for implementing these detection capabilities.