Key Insights for NERC CIP-015 Compliance: Anomaly Detection vs. Detecting Anomalous Activity
Summary: In 2023, FERC directed NERC to develop Critical Infrastructure Protection requirements for Internal Network Security Monitoring covering all high impact Bulk Electric System Cyber Systems and medium impact systems with External Routable Connectivity, codified in the proposed standard NERC CIP-015. The standard's R1.2 requires entities to implement one or more methods to detect anomalous network activity using the network data feeds established under R1.1, and Dragos argues that anomaly detection alone generates high volumes of false positives that can let adversaries evade detection.
Bottom line: CIP-015 R1.2 asks entities to detect anomalous activity, not merely run anomaly detection, and a flood of false positives is exactly the condition an adversary can use to hide in - so the detection method you choose determines whether the required east-west monitoring actually surfaces a threat.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026