CIP-015-1 is a NERC reliability standard for internal network security monitoring, or INSM. FERC approved it on 26 June 2025. It asks operators of bulk electric system assets to watch traffic inside their trusted network zones, keep the relevant data, and protect that data from tampering. Compliance dates are phased.
What INSM means
Most perimeter controls watch traffic at the edge. INSM watches inside. The idea is that an intruder who already got past the firewall still has to move around, and that movement can look unusual.
According to a law firm summary of the FERC order, the standard has three jobs:
- Collect, detect, evaluate and respond to anomalous traffic inside the relevant electronic security perimeters.
- Retain INSM data tied to anomalous activity, such as logs, metadata and alerts, for as long as needed to investigate.
- Protect that data from unauthorized modification or deletion.
Entities must also keep compliance evidence for at least three years.
Who is in scope
CIP-015-1 applies to all high-impact BES Cyber Systems, and to medium-impact BES Cyber Systems that have external routable connectivity. The order also directs NERC to propose changes, within 12 months of the order taking effect, that extend INSM to electronic access control or monitoring systems and physical access control systems outside the perimeter.
How the dates work
The requirements take effect on the first day of the first calendar quarter that is 36 months after the order's effective date, which the summary gives as 2 September 2025. Only certain control centers that perform real-time monitoring and management for the grid must comply at that point. Other entities get an additional 24 months.
Confirm the exact dates against the NERC and FERC documents before building a plan, because this is a secondary summary.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through the demo and watch how a change after a clean first scan is caught later. INSM applies the same idea to network traffic.
Getting ready
Practical steps that do not depend on a specific tool:
- Draw the current network zones and mark which carry high-impact systems.
- Decide where a sensor can see east-west traffic.
- Agree what counts as an anomaly, using a baseline of normal.
- Plan storage for alerts and metadata, and who can delete it.
- Decide who triages an alert at 3 a.m.
Safeguard does not offer network traffic monitoring. For the software your operators run, it offers SBOM and dependency scanning, asset discovery and continuous scanning, which feed the evidence side of a compliance file.
Quick check
Does CIP-015-1 apply to every utility asset?
No. Per the summary, it covers all high-impact BES Cyber Systems and medium-impact ones with external routable connectivity.
Is the standard in force for everyone now?
Compliance is phased. The summary says certain control centers come first and others get another 24 months.
Sources
Last reviewed: 19 October 2026.
