FERC approved CIP-015-2 on 10 August 2026, and the approval was announced the following week. The headline is straightforward: internal network security monitoring now reaches considerably further into a utility's environment than CIP-015-1 required. The less obvious consequence is that several asset classes utilities had treated as security infrastructure are now things that must themselves be monitored.
The deadlines look comfortable and are not. Enforcement begins 1 October 2028 and the phases run to 2031, but the work that determines whether you make those dates is scoping and architecture, and that work has a long lead time in a control center. Our comparison of NERC CIP and IEC 62443 covers how these obligations sit alongside each other.
What INSM actually requires
CIP-015-1 is built on three requirements, and understanding their shape matters because CIP-015-2 extends the scope rather than rewriting the obligations.
|
Req |
What it requires |
|
R1 |
Documented processes for internal network security monitoring. R1.1 identify network data collection locations and methods based on security risk. R1.2 implement methods to detect anomalous network activity using that data. R1.3 implement methods to evaluate detected activity and determine an appropriate response. |
|
R2 |
Protect the collected INSM data from unauthorized deletion or modification, except during CIP Exceptional Circumstances. |
|
R3 |
Retain network communications data and metadata in sufficient detail and for sufficient duration to support the analysis required by R1.3, except during CIP Exceptional Circumstances. |
Note the structure of R1.1. It is risk-based: you identify where to collect based on security risk rather than being handed a list of locations. That is flexibility, and it is also an evidence burden, because your risk rationale is what you will defend at audit.
What CIP-015-2 added
CIP-015-1 applied to high and medium impact BES Cyber Systems with External Routable Connectivity inside Electronic Security Perimeters, with the original FERC directive focused on Control Centers. CIP-015-2 brings in four further classes.
|
Asset class |
What it covers in practice |
|
EACMS |
Electronic Access Control or Monitoring Systems. Firewalls, authentication gateways, and the access control infrastructure itself. |
|
PACS |
Physical Access Control Systems. Badge and door control servers and associated physical security systems. |
|
SCI |
Shared Cyber Infrastructure. Virtualization platforms, hypervisors and shared storage. |
|
PCAs |
Protected Cyber Assets. Engineering workstations, patch management servers and similar assets inside the perimeter. |
|
The part that surprises people: your firewall is now a monitored asset Bringing EACMS into scope inverts a familiar assumption. The firewall has been the thing doing the monitoring. Under CIP-015-2 it is also a thing to be monitored, because an adversary who compromises an access control system owns the boundary and can authorize their own traffic. The same logic applies to the hypervisor under your control center servers. If you have treated security infrastructure as inherently trusted, that assumption is now a compliance gap as well as a security one. |
The phased timeline
|
Date |
What happens |
|
1 October 2028 |
CIP-015-1 becomes enforceable. |
|
1 October 2029 |
CIP-015-2 Phase 1 takes effect, covering EACMS, PACS and SCI at Control Centers. CIP-015-1 retires. |
|
1 October 2030 |
Phase 2a adds the remaining Medium Impact systems and PCAs. |
|
1 October 2031 |
Phase 2b brings full enforcement across all Medium Impact assets. |
Two years to the first date sounds generous. It is not, for a simple reason: you cannot monitor what you have not mapped, and in most control centers the authoritative network diagram does not exist. Asset inventory and conduit mapping are the long-lead items, not sensor procurement.
The requirement people underestimate: R3
Detection gets the attention. Retention quietly drives the cost. R3 requires you to keep network communications data and metadata in sufficient detail and duration to support the evaluation in R1.3, and R2 requires that data be protected from unauthorized deletion or modification.
Full packet capture at control center volumes, retained long enough to investigate, protected from tampering, becomes a storage and architecture problem quickly. Most utilities land on retaining metadata and flow records long-term with selective full capture, but that is a decision to make deliberately and document as part of your R1.1 rationale, not something to discover when the first investigation needs data you no longer have.
There is also an egress question. If monitoring data has to leave a protected zone to reach your analysis platform, that transfer path is itself a security decision. Hardware-enforced one-way transfer is the usual answer where the zone must not accept an inbound path, and we cover that in what is a data diode.
What to do in the next twelve months
- Settle applicability first. Which of your assets are high impact, medium impact with External Routable Connectivity, EACMS, PACS, SCI and PCA. Get this wrong and every downstream decision is wrong.
- Build the asset inventory and the conduit map. The long-lead item. See our guide to non-disruptive OT asset discovery.
- Write the R1.1 risk rationale. Where you will collect and why. This document is the spine of your compliance evidence.
- Decide the retention architecture. Metadata, flow, full capture, and for how long. Cost it before you commit.
- Pilot one zone. Prove detection and triage on a single conduit before scaling. The gap is almost never the sensor, it is whether anyone can act on what it produces.
For the technology decisions behind that, see our guide to passive OT intrusion detection and sensor placement.
Why Choose Arista Cyber
We work on live control environments and we treat INSM as an engineering problem before a compliance one, because a monitoring deployment that satisfies an auditor but produces alerts nobody can act on has failed at the thing it was built for. We deliver asset inventory, conduit mapping and OT intrusion detection across North America. See our case studies.
Next Steps
Start with applicability and the conduit map. Utilities that reach 2028 comfortably will be the ones that spent 2027 mapping rather than evaluating vendors. The sensors are the easy part.
Common Questions
When was CIP-015-2 approved?
FERC approved it on 10 August 2026, with the announcement the following week. It expands the internal network security monitoring scope established by CIP-015-1.
What does CIP-015-2 add to CIP-015-1?
Four asset classes: EACMS, PACS, SCI and PCAs. CIP-015-1 applied to high and medium impact BES Cyber Systems with External Routable Connectivity, with the original directive focused on Control Centers.
When do we have to comply?
CIP-015-1 becomes enforceable 1 October 2028. CIP-015-2 Phase 1 takes effect 1 October 2029 and CIP-015-1 retires. Phase 2a follows on 1 October 2030 and Phase 2b on 1 October 2031.
Does INSM require full packet capture?
The standard does not mandate a specific method. R1.1 is risk-based: you identify collection locations and methods and justify them. R3 then requires retention sufficient to support your evaluation process, which is what makes the retention decision consequential.
Is a perimeter firewall enough to satisfy INSM?
No, and that is the point of the standard. INSM is about monitoring inside the trusted zone to find activity that has already passed the perimeter. Under CIP-015-2 the firewall is itself an in-scope asset to be monitored.
|
Two years to the first deadline, and mapping is the long pole. Arista Cyber supports utilities through INSM readiness: applicability determination, asset inventory and conduit mapping, the R1.1 collection rationale, retention architecture and a piloted detection deployment. |
