What is NERC CIP-015 and what does it require?

NERC CIP-015-1 (FERC Order 907) mandates Internal Network Security Monitoring inside the Electronic Security Perimeter of BES Cyber Systems. Approved June 2025, effective September 2, 2025. Three requirements: R1.1, collect network traffic data from inside the ESP; R1.2, run anomaly detection against those feeds; R1.3, evaluate and document the response to detected anomalies.

What is the CIP-015 compliance deadline?

October 1, 2028 for High-impact BES Cyber Systems and Medium-impact systems with External Routable Connectivity. October 1, 2030 for Medium-impact BES Cyber Systems without ERC. If High-impact systems are in scope, the 2028 clock is already running.

What is Internal Network Security Monitoring (INSM)?

INSM is continuous visibility into traffic and behavior inside the ESP, not just at the perimeter. Perimeter firewalls and IT SIEM tools cannot see east-west lateral movement between OT assets. CIP-015 was written because threats like Volt Typhoon showed that perimeter monitoring alone is insufficient.

Which BES Cyber Systems are in scope for CIP-015?

2028 deadline: High-impact BES Cyber Systems and Medium-impact with ERC. 2030 deadline: Medium-impact BES Cyber Systems without ERC. High-impact systems include certain control centers, generation facilities, and transmission substations. Applicability is determined by your CIP-002 categorizations.

Can AtlasCyber operate in an air-gapped or isolated environment?

Yes. AtlasCyber is fully capable in air-gapped, sovereign cloud, and isolated OT environments. All PCAP capture, anomaly detection, and R1.3 documented response output runs inside your ESP. No external connectivity is required at any stage.

Do we need to build a SOC to comply with CIP-015?

No. CIP-015 R1.3 requires a documented evaluation and response process, not a 24/7 SOC. AtlasCyber integrates as a dedicated OT visibility and threat hunting layer into your existing security operations, or operates standalone for utilities without a dedicated SOC. ClemAI generates structured, MITRE-mapped documented response that your team acts on directly.

How does AtlasCyber detect east-west lateral movement without signatures?

AtlasCyber captures full PCAP inside the ESP and runs behavioral analysis against per-asset OT protocol baselines. When an asset communicates in a pattern that deviates from its established behavior, different destination, unusual protocol, or unexpected timing, the system flags it regardless of whether the traffic carries known malicious signatures. Every detection auto-maps to MITRE ATT&CK for ICS.

What Does NERC CIP-013 Require?

CIP-013 requires applicable entities to manage cyber risk introduced through vendors, products, software, and remote access. The standard defines the process. Operators still need evidence when trusted activity creates a security question.

Explore Network Detection & Response Power & Energy

What CIP-013 requires.

CIP-013-2 is the mandatory and enforceable baseline. Build the supply chain risk plan, use it, and keep it current.

CIP-013-2 ↗ Current status ↗

CIP-013-2 Enforceable baseline

15 months Plan review cycle

3 years Evidence retention

01

Vendor incidents

Vendor incident notification
Incident response coordination

02

Vendor access

Access termination
Vendor-initiated remote access

03

Product risk

Vulnerability disclosure
Software integrity and authenticity

R2: implement the plan. R3: review and approve it at least once every 15 calendar months.

Read CIP-013-2

Vendor risk becomes an investigation problem.

Access controls tell you who is allowed in. Evidence tells you what happened after the connection was made.

01

See it

Can you observe vendor and third-party activity across the network segments you monitor?

02

Scope it

What systems, destinations, protocols, and access paths were involved?

03

Investigate it

Was the behavior expected, suspicious, or malicious, and what evidence supports that conclusion?

Authorization establishes permission. It does not establish behavior.

NERC CIP-015

CIP-013 questions, answered.

What is NERC CIP-013?

CIP-013 is NERC's Cyber Security - Supply Chain Risk Management standard. It requires applicable Responsible Entities to develop, implement, review, and approve supply chain cyber security risk management plans.

What version of CIP-013 is enforceable?

NERC currently lists CIP-013-2 as mandatory and subject to enforcement. CIP-013-3 is subject to future enforcement.

Does CIP-013 address vendor remote access?

Yes. R1.2.6 requires the supply chain risk management process to address coordination of controls for vendor-initiated remote access.

Does CIP-013 require network monitoring?

CIP-013 is a supply chain risk management standard, not a general network-monitoring requirement. Network evidence can still support investigation of vendor access, third-party activity, and supply chain incidents.

NERC CIP-013-2 ↗ NERC current status ↗ FERC Order 912 ↗ Project 2025-06 ↗

Educational guidance only. Confirm applicability and implementation requirements with current NERC, FERC, Regional Entity, legal, engineering, and compliance guidance.

Where CrunchAtlas fits.

CrunchAtlas supports the evidence and investigation side of supply chain risk. Passive network telemetry shows what vendor or third-party activity did, then carries suspicious behavior into an investigated case.

Trusted access still needs evidence.

See what vendor and third-party activity actually did, then investigate what doesn't fit.

Talk With CrunchAtlas Explore NDR

Coverage depends on deployment scope, available telemetry, and the systems being monitored.