FERC Approves Reliability Standard CIP-015-1 on Internal Network Security Monitoring

At its open meeting on June 26, 2025, the Federal Energy Regulatory Commission (FERC) issued Order No. 907, approving Reliability Standard CIP-015-1 – Cyber Security – Internal Network Security Monitoring (INSM). This new standard focuses on enhancing the cybersecurity of the Bulk Electric System by requiring INSM of east-west network traffic within “trust zones” specifically, the Critical Infrastructure Protection (CIP) networked environment, which includes and extends beyond the electronic security perimeter (ESP). The rule establishes a September 2, 2025 effective date which will initiate the implementation plan for the new standard. 

Key Determinations and Clarifications 

FERC approved CIP-015-1, finding it largely responsive to directives previously issued in Order No. 887 and aligned with efforts to strengthen grid security. However, FERC also directed the North American Electric Reliability Corporation (NERC) to revise the standard within 12 months to extend INSM requirements to include electronic access control or monitoring systems (EACMS) and physical access control systems (PACS). This extension applies to systems located outside the ESP. 

FERC also clarified the term CIP-networked environment as used in CIP-015-1 to include  

• Traffic within the ESP 
• Systems within the ESP 
• Network connections among and between EACMS and PACS—even if located outside the ESP

Rational for Including EACMS and PACS 

FERC agreed with stakeholder commenters that incorporating EACMS and PACS into INSM provides significant reliability benefits. These systems can serve as attack vectors if compromised from outside the trust zone. Once compromised, they may introduce trusted communications into the ESP, thereby bypassing traditional security measures. 

To mitigate this risk, FERC directed that EACMS and PACS be included in the CIP-networked environment and monitored accordingly.

Implementation Plan 

The start date for implementation (T0) for CIP-015-1 is September 2, 2025. All Responsible Entities as defined in the applicability section of the standard must begin compliance based on system type and location as follows:  

• For applicable systems located at Control Centers and backup Control Centers (as identified under CIP-002-5.1(a), Requirement R1, Parts 1.1 and 1.2), full compliance with CIP-015-1 is required by T + 36 months. 
• All other applicable systems must achieve compliance by T + 60 months.