NERC CIP-015-1 Data Protection: Requirements, Scope, and Compliance Guide

NERC CIP-015-1 addresses this security gap by requiring applicable energy organizations to monitor network activity inside protected environments. Its official title is Cyber Security – Internal Network Security Monitoring, and its purpose is to improve the probability of detecting anomalous or unauthorized network activity so organizations can respond to and recover from attacks faster.

Although CIP-015-1 is frequently discussed as a data protection requirement, it is not a general privacy standard. Its primary focus is internal network visibility. However, it also includes requirements for retaining and protecting internal network security monitoring data against unauthorized deletion or modification. These protections help ensure that evidence remains available during investigation, response, and regulatory review.

FERC approved CIP-015-1 through Order No. 907 on June 26, 2025. Since then, NERC has also developed CIP-015-2 to extend monitoring to additional systems outside the Electronic Security Perimeter. As of August 2026, CIP-015-2 has been submitted to FERC for approval under Docket No. RD26-6-000.

What Is NERC CIP-015-1?

NERC CIP-015-1 is a Critical Infrastructure Protection Reliability Standard created to establish internal network security monitoring, commonly called INSM, for specified Bulk Electric System Cyber Systems.

Traditional perimeter monitoring focuses on traffic crossing an Electronic Security Perimeter. It may identify a suspicious external connection, unauthorized inbound request, or known malicious communication attempting to enter the protected environment.

Internal network security monitoring takes a different view. It examines activity occurring inside a trusted network zone. This includes east-west communications between systems, devices, servers, workstations, applications, and other networked components.

This visibility matters because an attacker may already have crossed the network boundary. The attacker could have obtained a legitimate user’s credentials, compromised a third-party connection, exploited a trusted device, or installed unauthorized software on an internal asset.

Once inside, the attacker may attempt to:

• Discover other systems and devices
• Escalate account privileges
• Move laterally between network segments
• Establish persistent access
• Communicate with compromised hosts
• Execute unauthorized commands
• Modify configurations
• Remove evidence of malicious activity

FERC found that the existing CIP standards did not fully require monitoring of this internal activity. CIP-015-1 therefore adds controls for collecting network data, detecting anomalies, evaluating identified activity, retaining relevant information, and protecting that information from tampering.

Organizations seeking a broader explanation of the CIP framework can also read VComply’s complete guide to NERC CIP compliance.

Is CIP-015-1 Really a Data Protection Standard?

CIP-015-1 should not be treated as a direct replacement for NERC CIP-011, which focuses specifically on protecting BES Cyber System Information.

The central purpose of CIP-015-1 is threat detection through internal network monitoring. Yet data protection remains an important part of the standard because the information created by monitoring systems can become valuable evidence.

Monitoring data may reveal:

• Network architecture and communication paths
• Source and destination addresses
• Connected systems and devices
• Communication protocols
• Timing and frequency of communications
• Detected anomalies
• Investigation findings
• Incident response actions
• Security tool configurations
• Network communication baselines

If attackers can delete or alter this information, they may be able to conceal their actions. Security teams could then lose the evidence required to understand how an attack occurred, which assets were affected, and what response is necessary.

CIP-015-1 therefore includes two data-focused controls:

• Requirement R2: Retain internal network security monitoring data associated with anomalous activity until the related evaluation or action is complete.
• Requirement R3: Protect monitoring data collected under R1 and retained under R2 against unauthorized deletion or modification.

In this context, NERC CIP-015-1 data protection means maintaining the availability and integrity of cybersecurity monitoring evidence. It does not establish privacy rights, personal data processing principles, or consumer data protection obligations.

Who Must Comply With CIP-015-1?

CIP-015-1 applies to Responsible Entities with relevant high-impact BES Cyber Systems or medium-impact BES Cyber Systems with External Routable Connectivity.

The functional entities listed by the standard include:

• Balancing Authorities
• Certain Distribution Providers
• Generator Operators
• Generator Owners
• Reliability Coordinators
• Transmission Operators
• Transmission Owners

An entity that has no high-impact BES Cyber Systems and no medium-impact BES Cyber Systems with External Routable Connectivity may be exempt under the standard’s applicability provisions.

Other exclusions apply to specified nuclear-regulated systems, certain communication links between separate Electronic Security Perimeters, and systems or equipment excluded under the Distribution Provider applicability language.

Applicability should be determined through the entity’s CIP-002 asset identification and categorization process. Teams should not assume that every operational technology network, substation, generation facility, or control environment automatically falls within CIP-015-1. The relevant BES Cyber System categorization and connectivity conditions must be assessed and documented.

For an overview of managing multiple energy-sector obligations, see VComply’s compliance software for energy and utility organizations.

Understanding the Three CIP-015-1 Requirements

CIP-015-1 contains three core requirements. Together, they create a process for observing internal network activity, identifying suspicious behavior, reviewing alerts, preserving relevant data, and protecting that data.

Requirement R1: Monitor, Detect, and Evaluate Network Activity

Requirement R1 applies to networks protected by Electronic Security Perimeters associated with high-impact BES Cyber Systems and medium-impact BES Cyber Systems with External Routable Connectivity.

The requirement contains three parts.

R1.1: Select and Implement Network Data Feeds

Responsible Entities must use a risk-based rationale to implement network data feeds capable of monitoring connections, devices, and network communications.

The standard does not prescribe one specific technology or demand that every communication path be monitored in the same way. Instead, the organization must determine which data feeds provide a reasonable opportunity to detect anomalous or unauthorized activity.

Possible sources can include:

• Network taps
• Switch port mirroring
• Packet metadata
• Network flow records
• Industrial protocol monitoring
• Firewall and network device telemetry
• Passive OT network sensors
• Virtual network monitoring
• Traffic data from selected network segments

The entity’s reasoning is as important as the selected technology. Documentation should explain the networks assessed, identified risks, available monitoring points, technical limitations, selected feeds, excluded feeds, and why the final design provides suitable coverage.

Examples of higher-risk areas may include energy management systems, distributed control systems, third-party connections, remote access paths, critical servers, engineering workstations, and communication paths that could enable lateral movement.

R1.2: Detect Anomalous Network Activity

Once the data feeds are established, the entity must implement one or more methods to detect anomalous activity.

Detection may use:

• Baselines of expected communication
• Behavioral analytics
• Protocol analysis
• Asset and device profiling
• Signature-based indicators
• Rule-based alerts
• Unauthorized device detection
• Unexpected connection identification
• Changes in normal communication patterns
• Threat intelligence indicators

CIP-015-1 does not define every event that must be treated as anomalous. Each organization must configure its methods according to its architecture, operating conditions, assets, protocols, and risk exposure.

A baseline can help identify communications that differ from expected operations. For example, a workstation communicating with a new device, a control system using an unexpected protocol, or an unusual increase in traffic between two network segments may require evaluation.

Evidence may include monitoring system configurations, alert records, documented baselines, detection rules, reports, and records of anomalous network events.

R1.3: Evaluate Detected Anomalies

Detection alone does not satisfy the standard. Responsible Entities must evaluate anomalous activity and determine whether further action is needed.

The evaluation process should help personnel distinguish among:

• Expected operational changes
• Incorrectly configured alerts
• False positives
• Approved maintenance activity
• New but legitimate devices
• Policy violations
• Suspicious communications
• Attempted compromise
• Confirmed cybersecurity incidents

The documented process should establish who reviews alerts, how quickly they are assessed, what contextual information is required, how decisions are recorded, and when activity is escalated.

Where activity may represent a reportable Cyber Security Incident, the process can connect with the organization’s CIP-008 incident response plan.

Evidence may include analyst notes, incident tickets, investigation records, escalation decisions, response actions, case histories, and records showing why an alert was closed or escalated.

Requirement R2: Retain Data Associated With Anomalous Activity

Requirement R2 addresses the retention of monitoring data connected to activity that the Responsible Entity determines to be anomalous.

The data must be retained, at a minimum, until the action required under R1.3 is complete.

This does not mean every packet or every piece of non-anomalous network data must be stored indefinitely. The standard specifically notes that an entity is not required to retain monitoring data that is unrelated to anomalous activity detected under R1.2.

A practical retention process should define:

• What data is captured when an alert occurs
• How the data is linked to the alert or case
• Where the information is stored
• Who can access it
• How long it remains available during evaluation
• What happens after an event is closed
• When CIP-008 or another retention policy applies
• How legal holds or regulatory requests are handled

Data connected with a false positive may no longer need to be retained under R2 after the evaluation is completed. Data associated with a suspected compromise may need to move into an incident response process with separate retention requirements.

Organizations should also distinguish between operational monitoring data and compliance evidence. The CIP-015-1 compliance section requires evidence demonstrating performance of the requirements to be retained for three calendar years, unless the Compliance Enforcement Authority directs a longer period or unresolved noncompliance requires continued retention.

Requirement R3: Protect Monitoring Data

Requirement R3 requires documented processes that protect monitoring data collected under R1 and retained under R2 from unauthorized deletion or modification.

The purpose is to keep attackers, unauthorized users, or inappropriate administrative actions from destroying or altering evidence.

Depending on the entity’s architecture and risk assessment, controls may include:

• Role-based access restrictions
• Separate administrative accounts
• Multi-factor authentication
• Centralized or remote log storage
• Write-restricted repositories
• Immutable or append-only storage
• Encryption
• Integrity monitoring
• File or record hashing
• Backup and recovery controls
• Administrative activity logging
• Security alerts for deletion attempts
• Separation between monitored assets and evidence repositories
• Periodic access reviews

CIP-015-1 does not mandate one particular control. The entity must demonstrate that its selected protections reduce the risk of unauthorized deletion or modification.

Some INSM information may meet the definition of BES Cyber System Information. Where that is the case, the entity may be able to use established CIP-011 information protection controls. If the data is not classified as BCSI, the organization still needs documented safeguards that meet R3.

VComply’s guide to NERC CIP compliance software explains how organizations can connect requirements, controls, evidence, policies, tasks, and audit records.

How CIP-015-1 Differs From CIP-005 and CIP-007

CIP-015-1 does not replace perimeter security, malware controls, system logging, or incident response. It adds an internal network monitoring layer to the existing CIP control structure.

CIP-005 focuses on Electronic Security Perimeters, Electronic Access Points, interactive remote access, and control of communications entering or leaving protected environments.

CIP-007 includes system security management requirements such as ports and services, security patch management, malicious code prevention, security event monitoring, and account controls.

CIP-015-1 focuses on network communications occurring within applicable protected environments. It is designed to find anomalous activity that may not appear in host logs or at the perimeter.

For example, CIP-005 may help identify a suspicious connection crossing the perimeter. CIP-007 may capture failed logins or malicious code events on an individual Cyber Asset. CIP-015-1 may identify unusual communication between two internal systems after an attacker has obtained network access.

These controls should exchange information rather than operate as disconnected programs. INSM alerts may require host logs from CIP-007, access records from CIP-005, incident escalation under CIP-008, information protection under CIP-011, or vendor investigation under CIP-013.

For more information about third-party cybersecurity obligations, read the VComply guide to NERC CIP-013 supply chain risk management.

CIP-015-1 Implementation Timeline

The approved CIP-015-1 implementation plan uses a phased approach.

The standard becomes effective on the first day of the first calendar quarter that is 36 months after the effective date of the applicable governmental authority’s order, unless the authority establishes another date.

FERC Order No. 907 became effective on September 1, 2025. Based on the approved implementation formula, this points to October 1, 2028, for the initial CIP-015-1 effective date in the United States, unless CIP-015-2 or another regulatory action changes the schedule.

Applicable systems located at Control Centers and backup Control Centers must comply when the standard becomes effective. Applicable medium-impact BES Cyber Systems with External Routable Connectivity outside those Control Centers receive an additional 24 calendar months.

The longer implementation period recognizes that organizations may need to procure sensors, change network configurations, plan operational outages, integrate large data volumes, test detection methods, and tune alerting before compliance begins.

Because CIP-015-2 is now under FERC review, Responsible Entities should track the final approved implementation plan rather than relying only on the original CIP-015-1 dates.

What Is Changing Under CIP-015-2?

FERC approved CIP-015-1 but found that its scope did not cover the full CIP-networked environment contemplated by Order No. 887.

The Commission directed NERC to extend internal monitoring to Electronic Access Control or Monitoring Systems and Physical Access Control Systems outside the Electronic Security Perimeter. These systems may become trusted paths into protected environments if compromised.

NERC subsequently developed CIP-015-2. The proposed revision expands the systems considered under R1 to include applicable:

• High-impact BES Cyber Systems
• Medium-impact BES Cyber Systems with External Routable Connectivity
• Electronic Access Control or Monitoring Systems
• Physical Access Control Systems
• Protected Cyber Assets
• Shared Cyber Infrastructure supporting applicable systems

NERC submitted CIP-015-2 to FERC for approval on June 18, 2026, under Docket No. RD26-6-000. Until FERC issues its decision, organizations should distinguish between the approved CIP-015-1 requirements and the proposed successor requirements.

How to Prepare for NERC CIP-015 Compliance

1. Confirm Applicability

Review CIP-002 categorizations, External Routable Connectivity, Control Center designations, Electronic Security Perimeters, associated assets, and applicable functional registrations.

2. Map the Network

Document network segments, communication paths, systems, devices, protocols, trust relationships, remote connections, third-party access points, and available monitoring locations.

3. Develop the Risk-Based Rationale

Evaluate which data feeds provide meaningful visibility. Document why feeds were selected, what risks they address, and why other locations were excluded.

4. Establish Normal Network Behavior

Identify expected devices, communication pairs, protocols, ports, traffic patterns, operating schedules, and approved changes. Update baselines when the environment changes.

5. Define Alert Evaluation Procedures

Assign alert owners, severity levels, review timeframes, escalation criteria, documentation requirements, and connections to CIP-008 incident response.

6. Create Retention and Protection Controls

Define which anomaly-related data must be stored, where it is stored, when it can be deleted, and how it is protected against unauthorized changes.

7. Build an Evidence Register

Maintain the risk assessment, data-feed inventory, configurations, baselines, detection records, evaluation records, response actions, retention evidence, access records, and data protection controls.

8. Test the Process

Use simulated events, tabletop exercises, control testing, and internal audits to confirm that monitoring systems detect activity and personnel follow the documented workflow.

A centralized system can help teams assign control owners, collect evidence, track remediation, manage reviews, and maintain a defensible audit history. VComply’s NERC compliance software and compliance management platform are designed to support these execution and evidence-management activities.

Common CIP-015-1 Compliance Mistakes

One common mistake is treating the purchase of an INSM tool as the completion of compliance. The standard requires documented processes, risk-based decisions, implemented detection methods, evaluation records, retention controls, and data protections.

Another mistake is capturing large volumes of data without defining how alerts will be evaluated. An organization may have extensive network telemetry but still fail to show that anomalous activity is consistently reviewed and acted upon.

Poor documentation is also a significant risk. Data-feed selection may make technical sense, but the entity must be able to explain its rationale to auditors and regulators.

Other problems include:

• Failing to update baselines after network changes
• Retaining alerts without related investigation records
• Allowing excessive administrative access to monitoring data
• Storing evidence only on the systems being monitored
• Failing to link serious anomalies to CIP-008
• Confusing R2 operational retention with three-year compliance evidence retention
• Ignoring the proposed scope expansion under CIP-015-2

The strongest programs connect technical monitoring with governance, ownership, documentation, evidence, and incident response.

Final Thoughts

NERC CIP-015-1 changes the cybersecurity assumption that activity inside an Electronic Security Perimeter can be trusted simply because it has passed boundary controls.

The standard requires applicable energy organizations to create visibility into internal communications, detect anomalous behavior, evaluate what the behavior means, retain relevant evidence, and protect that evidence against deletion or modification.

For compliance teams, the work is not limited to installing sensors. It requires coordinated action across cybersecurity, operational technology, network engineering, incident response, records management, legal, internal audit, and regulatory compliance.

Organizations that begin with applicability analysis, network mapping, documented risk decisions, alert workflows, data integrity controls, and structured evidence management will be better positioned for both CIP-015-1 and the broader scope proposed under CIP-015-2.

Frequently Asked Questions (FAQs)

1. What is the purpose of NERC CIP-015-1?

CIP-015-1 is intended to improve the probability of detecting anomalous or unauthorized internal network activity. This allows Responsible Entities to identify attacks earlier and improve their response and recovery.

2. Is CIP-015-1 a data privacy standard?

No. CIP-015-1 is an internal network security monitoring standard. Its data protection provisions concern the retention and integrity of monitoring data, not personal information or consumer privacy rights.

3. What are the three requirements of CIP-015-1?

R1 requires monitoring, detection, and evaluation of anomalous network activity. R2 requires retention of monitoring data related to anomalous activity until the necessary action is completed. R3 requires protection of collected and retained monitoring data from unauthorized deletion or modification.

4. Does CIP-015-1 apply to low-impact BES Cyber Systems?

CIP-015-1 does not generally apply to entities that have no high-impact BES Cyber Systems and no medium-impact BES Cyber Systems with External Routable Connectivity. Applicability should be confirmed through the entity’s CIP-002 categorization process.

5. Must an organization retain all network traffic?

No. CIP-015-1 does not require indefinite retention of all network traffic. R2 focuses on data associated with activity determined to be anomalous. That data must be retained at least until the R1.3 evaluation or related action is complete.

6. How long must CIP-015-1 compliance evidence be retained?

The standard requires Responsible Entities to retain evidence of each requirement for three calendar years. Evidence connected to identified noncompliance must be retained until mitigation is approved and complete, or for the normal retention period, whichever is longer.

7. How can monitoring data be protected under R3?

Organizations may use access controls, centralized repositories, immutable storage, encryption, integrity checks, backups, administrative logging, separation of duties, and alerts for unauthorized deletion or modification. The selected controls should be based on the entity’s architecture and documented processes.

8. What is the difference between CIP-015-1 and CIP-015-2?

CIP-015-1 focuses primarily on networks protected by Electronic Security Perimeters for applicable high- and medium-impact BES Cyber Systems. Proposed CIP-015-2 expands coverage to network activity involving associated EACMS, PACS, Protected Cyber Assets, and certain Shared Cyber Infrastructure. CIP-015-2 was submitted to FERC in June 2026 and remains subject to regulatory approval.