Implementation Plan - Project 2023-03 Internal Network Security Monitoring (INSM) - Reliability Standard CIP-015-1

Sep 11, 2026

Uploaded by Oliver

Implementation Plan for Project 2023-03 Internal Network Security Monitoring (INSM) under Reliability Standard CIP-015-1, which implements FERC Order No. 887 requirements for internal monitoring of High and Medium Impact Bulk Electric System (BES) Cyber Systems with External Routable Connectivity. The plan outlines applicable entities, background context, general considerations for developing Requirements R1–R3, and phased compliance timelines prioritizing Control Centers. It also addresses procurement of sensors, network modifications, technical data ingestion and analysis, and implementation constraints such as vendor availability and scheduling of operational outages.

LanguageEnglish

CategoryPresentations

FormatPDF

Pages3

Reading Time1 min

AccessFree to download

Background

General Considerations

Effective Date and Phased-In Compliance Dates

Reliability Standard – CIP-015-1 Internal Network Security Monitoring

Compliance Date for – CIP-015-1 Internal Network Security Monitoring

Implementation Plan Project 2023-03 Internal Network Security Monitoring (INSM) Reliability Standard CIP-015-1 Applicable Standard(s) • CIP-015-1 – Cyber Security – Internal Network Security Monitoring Requested Retirement (s) • None Applicable Entities • Balancing Authority • Distribution Provider 1 • Generator Operator • Generator Owner • Reliability Coordinator • Transmission Operator • Transmission Owner Background On January 19, 2023, the Federal Energy Regulatory Commission (FERC) issued Order No. 887 directing NERC to develop requirements within the Critical Infrastructure Protection (CIP) Reliability Standards for INSM of all high-impact Bulk Electric System (BES) Cyber Systems and medium impact BES Cyber Systems with External Routable Connectivity (ERC)2. INSM permits entities to monitor traffic within a trusted zone, such as the Electronic Security Perimeter, to detect intrusions or malicious activity. Specifically, Order No. 887 directs NERC to develop Reliability Standard (s) requirement (s) for any new or modified CIP Reliability Standards that address three security issues. 1 See Applicability Section of Revised CIP Standards and Definitions for additional information on Distribution Providers subject to the standards. 2 Internal Network Security Monitoring for High and Medium Impact Bulk Electric System Cyber Systems, Order No. 887, 182 FERC ¶ 61,021 (2023) . 2 Id. P 5. (Order No. 887 provides that any new or modified CIP Reliability Standards should: (1) address the need for responsible entities to develop baselines of their network traffic inside their CIP-networked environment; (2) address the need for responsible entities to monitor for and detect unauthorized activity, connections, devices, and software inside the CIP-networked environment) and (3) require responsible entities to identify anomalous activity to a high level of confidence by logging network traffic, maintaining logs and other data collected regarding network traffic, and implementing measures to minimize the likelihood of an attacker removing evidence of their tactics, techniques, and procedures from compromised devices) . In Order No. 887, FERC directs NERC to submit these revisions for approval within 15 months of the final rule’s effective date, i.e., July 9, 2024. Order No. 887 also directed NERC to conduct a study on the risks of lack of INSM for medium impact BES Cyber Systems without ERC, and all low-impact BES Cyber Systems, and on the challenges and solutions for implementing INSM for those BES Cyber Systems. NERC has completed this study, and it was filed with FERC on January 18, 2024. General Considerations This implementation plan reflects consideration that entities will need time to develop and implement Requirements R1, R2, and R3 . In order to achieve the objectives of the requirements, all affected Responsible Entities may need to: (1) procure sensors to facilitate the gathering of network data for applicable networks, taking into consideration the availability of products and services by a relatively small vendor marketplace and supply chain challenges; (2) make modifications to networks to better align with the standard; (3) deploy technical solutions to gather network information, which could require outages of operational facilities, which can be challenging to schedule; and (4) implement capabilities to ingest large amounts of network information and perform the necessary analysis. This phased implementation plan is intended to provide additional time to fully comply with Reliability Standard CIP-015-1, prioritizing that the most critical networks, such as Control Centers, are addressed first. Effective Date and Phased-In Compliance Dates The effective dates for the proposed Reliability Standard are provided below. Where the standard drafting team identified the need for a longer implementation period for compliance with a particular section of a proposed Reliability Stan

FAQs

What is the purpose of CIP-015-1 Internal Network Security Monitoring (INSM)?

CIP-015-1 establishes requirements for responsible entities to monitor network traffic within a trusted zone to detect intrusions or malicious activity and to identify anomalous activity with high confidence using logging and supporting measures.

Which entities are considered applicable for this implementation plan?

The plan lists applicable entities including the Balancing Authority, Distribution Provider 1, Generator Operator, Generator Owner, Reliability Coordinator, Transmission Operator, and Transmission Owner.

How does phased compliance work under CIP-015-1 for different system locations?

Control Centers and backup Control Centers initially comply upon the effective date of CIP-015-1, while medium impact BES Cyber Systems with External Routable Connectivity (excluding the Control Center categories) must apply CIP-015-1 within 24 calendar months after that effective date.

Sep 11, 2026

Uploaded by Oliver