What is NERC CIP-015 and what does it require?

NERC CIP-015-1 (FERC Order 907) mandates Internal Network Security Monitoring inside the Electronic Security Perimeter of BES Cyber Systems. Approved June 2025, effective September 2, 2025. Three requirements: R1.1, collect network traffic data from inside the ESP; R1.2, run anomaly detection against those feeds; R1.3, evaluate and document the response to detected anomalies.

What is the CIP-015 compliance deadline?

October 1, 2028 for High-impact BES Cyber Systems and Medium-impact systems with External Routable Connectivity. October 1, 2030 for Medium-impact BES Cyber Systems without ERC. If High-impact systems are in scope, the 2028 clock is already running.

What is Internal Network Security Monitoring (INSM)?

INSM is continuous visibility into traffic and behavior inside the ESP, not just at the perimeter. Perimeter firewalls and IT SIEM tools cannot see east-west lateral movement between OT assets. CIP-015 was written because threats like Volt Typhoon showed that perimeter monitoring alone is insufficient.

Which BES Cyber Systems are in scope for CIP-015?

2028 deadline: High-impact BES Cyber Systems and Medium-impact with ERC. 2030 deadline: Medium-impact BES Cyber Systems without ERC. High-impact systems include certain control centers, generation facilities, and transmission substations. Applicability is determined by your CIP-002 categorizations.

Can AtlasCyber operate in an air-gapped or isolated environment?

Yes. AtlasCyber is fully capable in air-gapped, sovereign cloud, and isolated OT environments. All PCAP capture, anomaly detection, and R1.3 documented response output runs inside your ESP. No external connectivity is required at any stage.

Do we need to build a SOC to comply with CIP-015?

No. CIP-015 R1.3 requires a documented evaluation and response process, not a 24/7 SOC. AtlasCyber integrates as a dedicated OT visibility and threat hunting layer into your existing security operations, or operates standalone for utilities without a dedicated SOC. ClemAI generates structured, MITRE-mapped documented response that your team acts on directly.

How does AtlasCyber detect east-west lateral movement without signatures?

AtlasCyber captures full PCAP inside the ESP and runs behavioral analysis against per-asset OT protocol baselines. When an asset communicates in a pattern that deviates from its established behavior, different destination, unusual protocol, or unexpected timing, the system flags it regardless of whether the traffic carries known malicious signatures. Every detection auto-maps to MITRE ATT&CK for ICS.

Guide

NERC CIP-015. Implementing INSM.

CIP-015 requires a documented internal network security monitoring (INSM) process: collect network data, detect anomalous activity, evaluate what it means, and preserve the evidence behind that process.

7 min readSources: NERC, FERC

Read CIP-015-2

Current status

CIP-015-1 and CIP-015-2 are approved and subject to future enforcement. The first FERC-jurisdiction compliance milestone is October 1, 2028. 3 4

If you only read one thing.

The standard turns internal network monitoring into a documented detect, evaluate, and retain process. 1 2

R1.1 · Collect network data
Select network data feeds using a documented risk-based rationale.
R1.2 · Detect anomalous activity
Use the selected feeds to identify activity that meets the entity's anomaly-detection methods.
R1.3 · Evaluate the anomaly
Determine what the detected activity means and what further action is needed.
R2 / R3 · Retain and protect evidence
Keep relevant INSM data through the required action and protect it from unauthorized deletion or modification.

01 · The phased dates

The implementation is phased.

CIP-015-1 establishes the first milestone. CIP-015-2 carries that work forward and expands the applicable-system scope. 3

October 1, 2028 · CIP-015-1 first milestone: Initial covered Control Center environments reach the first milestone, including high impact BES Cyber Systems and applicable medium impact BES Cyber Systems with ERC.
October 1, 2029 · CIP-015-2 takes effect: CIP-015-2 takes effect and expands Control Center scope to associated EACMS, PACS, and supporting Shared Cyber Infrastructure.
October 1, 2030 · Remaining medium impact: Remaining applicable medium impact environments reach their milestone, including associated Protected Cyber Assets and supporting Shared Cyber Infrastructure.
October 1, 2031 · Expanded scope completes: The expanded systems for those remaining medium impact environments reach their final milestone, including associated EACMS, PACS, and supporting Shared Cyber Infrastructure.

No required product

CIP-015 does not prescribe one commercial product, feed type, or monitoring architecture. The Responsible Entity documents how its chosen approach satisfies the requirement.

Dates reflect the approved implementation sequence for FERC jurisdiction. Confirm applicability, jurisdiction, CIP-002 categorization, and current NERC or Regional Entity guidance before making compliance decisions.

02 · Build visibility

Build visibility around the scope.

The question is not whether a utility has a sensor. It is whether the selected feeds can observe the right activity and support evaluation after a detection.

INSM needs visibility into

Connections between applicable systems
Devices participating in the activity
Network communications between those systems
The paths where relevant activity can occur

The implementation should answer

Which in-scope paths can we observe?
Where are the visibility gaps?
Why was each data source selected?
Will the evidence support evaluation?

Choose feeds that support investigation.

CIP-015 does not give every utility the same sensor-placement diagram. Collection points should follow the applicable systems, communication paths, and documented risk rationale.

Observe the path: Identify where in-scope network activity is visible to a monitoring source.
Find the blind spot: Identify segments or communication paths the proposed feeds cannot adequately observe.
Explain the feed: Document why each source contributes useful visibility for detection and evaluation.
Test the investigation: Confirm the collected evidence can support evaluation after an anomaly is detected.

Passive collection

Passive collection fits this architecture without probing or changing operational devices, but coverage still depends on what traffic and telemetry the deployment can actually see.

03 · Evaluate and retain

Detection is only the start.

R1.3 requires a method to evaluate anomalous activity and determine further action. The evidence should stay tied to that decision.

Trigger: What activity opened the evaluation?
Systems: Which devices and systems are involved?
Timing: What happened before and after the detection?
Scope: How far does the related activity extend?
Evidence: What supports or weakens the finding?
Decision: Close, continue, escalate, or move into incident response?

Keep the evidence tied to the decision.

CIP-015 separates retention of relevant INSM data from the longer retention of evidence used to demonstrate compliance.

INSM data

Retain data associated with activity determined to be anomalous at least until the R1.3 action is complete.

Compliance evidence

Retain evidence for each requirement for three calendar years, subject to longer retention in specified mitigation or enforcement circumstances.

Evidence trail

Keep the detection, supporting data, evaluation, decision, and resulting action connected.

The point

Detection creates the question. Evaluation has to produce a documented basis for the next action.

04 · What to do now

What utilities should do now.

Build the workflow before the deadline. Start with the parts of the environment and process you can document today.

Map the scope
Identify applicable systems and communication paths.
Find visibility gaps
Determine where current telemetry cannot adequately observe those paths.
Choose the feeds
Document the risk-based rationale behind each network data source.
Define detection
Establish how anomalous network activity will be identified.
Define evaluation
Establish who reviews a detection, what evidence they use, and how action is determined.
Test the evidence trail
Make sure the process can show what was detected, evaluated, decided, and done.

Timing

October 2028 is the first compliance milestone. It should not be the first time the INSM workflow runs end to end.

See what your INSM workflow can actually investigate.

Talk with our team about turning passive network evidence into investigated, operator-reviewed cases.

Talk to our team

05 · Where CrunchAtlas fits

Where CrunchAtlas fits.

CrunchAtlas supports the monitoring, investigation, and evidence workflow around CIP-015. It does not determine applicability, certify compliance, or replace the Responsible Entity's compliance program.

CrunchAtlas deploys in the cloud, on-premises, or fully air-gapped. Coverage depends on deployment scope and available telemetry. Consequential actions remain operator controlled.

Network Detection and Response

Passively observe supported network segments and carry the evidence into the investigation without probing operational devices.

Alert Investigation

Work detected activity into an evidence-backed case with scope, confidence, uncertainty, and next steps for operator review.

Incident Reporting

Build the report from the investigated case so the finding, evidence, affected systems, timeline, and next actions stay connected.

06 · FAQ

CIP-015 questions, answered.

Does CIP-015 require full packet capture?

No. CIP-015 requires network data feeds selected using a risk-based rationale. It does not prescribe full packet capture as the required feed everywhere.

Does CIP-015 require a network baseline?

Not as the only detection method. A network communication baseline is listed as one example of evidence, but the standard allows other methods for detecting anomalous network activity.

Does CIP-015 require a specific INSM product?

No. The standard defines monitoring, detection, evaluation, retention, and protection requirements. It does not name a required commercial platform or sensor.

What changed in CIP-015-2?

CIP-015-2 expands the applicable-system structure beyond the CIP-015-1 ESP-focused scope, explicitly covering applicable EACMS, PACS, Protected Cyber Assets, and supporting Shared Cyber Infrastructure, with phased implementation through 2031.

When does CIP-015-2 take effect?

Under the approved implementation sequence for FERC jurisdiction, CIP-015-2 takes effect on October 1, 2029, when CIP-015-1 retires. Additional phased milestones follow on October 1, 2030 and October 1, 2031.

How long does CIP-015 data need to be retained?

R2 requires relevant INSM data associated with anomalous activity to be retained at least until the R1.3 action is complete. Separately, evidence used to demonstrate compliance with each requirement is retained for three calendar years, subject to longer retention in specified circumstances.

07 · Sources

Sources.

Primary NERC standards, implementation material, and the current approval record.

Educational guidance only. Confirm applicability, implementation dates, and compliance requirements against current NERC, FERC, Regional Entity, legal, engineering, and compliance guidance.

Get INSM running before 2028.

Talk with our team about what AtlasCyber watches inside the perimeter and the evidence it keeps for your CIP-015 work.

Talk to our team Sign up for our newsletter

NERC CIP-015. Implementing INSM.

The implementation is phased.

Build visibility around the scope.

INSM needs visibility into

The implementation should answer

Choose feeds that support investigation.

Detection is only the start.

Keep the evidence tied to the decision.

INSM data

Compliance evidence

Evidence trail

What utilities should do now.

Map the scope

Find visibility gaps

Choose the feeds

Define detection

Define evaluation

Test the evidence trail

See what your INSM workflow can actually investigate.

Where CrunchAtlas fits.

Network Detection and Response

Alert Investigation

Incident Reporting

CIP-015 questions, answered.

Sources.

Keep reading.

NERC CIP-013

What is NDR?

Power and energy

Get INSM running before 2028.