The U.S. Federal Energy Regulatory Commission (“FERC”) recently issued Order No. 907 (the “Order”), approving a new Critical Infrastructure Protection (“CIP”) Reliability Standard, CIP-015-1.  The new standard will require covered entities that maintain certain bulk electric systems (“BES”) to implement Internal Network Security Monitoring (“INSM”) for network traffic within their “electronic security perimeter,” i.e., the logical border surrounding the network of interconnected devices that comprise a BES Cyber System.  However, as discussed below, these requirements will not go into effect for approximately three years, and many covered entities will have an additional two years before they are required to comply.

The Order also directed the North American Electric Reliability Corporation (“NERC”) to propose modifications to CIP-015-1 within 12 months of the Order’s effective date to extend INSM requirements to additional systems, such as electronic and physical access control systems, that are not within the electronic security perimeter.

The new standard will be of interest to covered entities, as well as service providers that develop, implement, or maintain hardware or software for operational technologies associated with BES.

Background

As discussed in a previous blog post, FERC issued Order No. 887 in January 2023, directing NERC to develop new INSM requirements for CIP networked environments.  NERC then proposed Reliability Standard CIP-015-1 in June 2024, which was followed in September 2024 by a Notice of Proposed Rulemaking, seeking public comment.  FERC issued the final Order on June 26, 2025, noting that none of the commenters opposed the approval of CIP-015-1.

Reliability Standards

CIP-015-1 will apply to medium-impact BES Cyber Systems that have external routable connectivity, defined as the ability to access a BES Cyber System from outside of its associated electronic security perimeter, and all high-impact BES Cyber Systems, whether or not they have external routable connectivity.  The standard establishes three requirements:

• Monitoring and Detection: Implement processes to collect, detect, evaluate, and respond to anomalous network traffic within relevant electronic security perimeters.  

• Data Retention: Establish processes to retain INSM data associated with anomalous activity (e.g., logs, metadata, alerts) at a minimum for the duration necessary to investigate and respond to the activity.

• Data Protection: Implement controls to protect INSM data from unauthorized modification or deletion.

Covered entities are required to retain data or evidence to show compliance with the requirements for a period of at least three years.

Effective Dates and Compliance Dates

The Order also approved NERC’s proposal for a phased implementation that provides covered entities several years to come into compliance.  Under the implementation plan, the INSM requirements will go into effect “on the first day of the first calendar quarter that is thirty-six (36) months after” the Order’s effective date, September 2, 2025.  However, only certain control centers that conduct real-time monitoring and management for BES will be required to comply with the new requirements as of that date.  Other entities will have an additional 24 months to come into compliance.

Expansion of “CIP-Networked Environments” Definition

In addition to approving CIP-015-1 as currently drafted, the Order also clarified the scope of INSM requirements under FERC’s initial Order No. 887.  Specifically, the agency explained that CIP-networked environments include not only network traffic inside the electronic security perimeter, but also network connections among and between electronic access control or monitoring systems (“EACMS”) and physical access control systems (“PACS”) that are outside the electronic security perimeter.  FERC noted that the scope of the current standard leaves a “reliability and security gap” and directed NERC to propose modifications that would extend the requirements to include EACMS and PACS within 12 months of the Order’s effective date.