Prepare to Implement NERC CIP-015 Internal Network Security Monitoring (INSM) Requirements
Summary: FERC issued Order 907 on June 26, 2025, approving NERC CIP-015-1, which requires Internal Network Security Monitoring for traffic inside Electronic Security Perimeters across the North American electric sector, and directed NERC to modify the standard within one year to cover EACMS/PACS outside ESPs. The standard traces back to FERC Order 887 of January 19, 2023, which directed NERC to develop INSM requirements for high impact BES Cyber Systems and medium impact BES Cyber Systems with External Routable Connectivity, with the NERC Board of Trustees adopting CIP-015-1 on May 9, 2024.
Bottom line: The requirements obligate responsible entities to detect and evaluate anomalous network activity inside trusted zones, retain that data until response actions are complete, and protect it from unauthorized deletion or modification - work the source says can take considerable time, with FERC Order 893 incentives available only to utilities that begin before the standard becomes mandatory and enforceable.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026