R1
Monitor, detect, evaluate
Use risk-based network data feeds, detect anomalous network activity, and evaluate what you find to determine whether further action is needed.
Independent field guideNERC CIP-015
Know your normal.Detect the anomalous.
A live compliance clock and practical guide to building internal network security monitoring that is useful, defensible, and ready before the compliance date.
—
Days
—
Hours
—
Min
—
Sec
Phase 1 window elapsed
—%
FERC approval · Jun 2025
Oct 1, 2028
Target: Oct 1, 2028 · 00:00 EDT
— days to Phase 2
Approved standardCIP-015-1
2028 phaseControl Centers
2030 phaseOther applicable systems
Next revisionCIP-015-2 filed, pending approval
The requirement, without the fog
Three things every defensible INSM program must do.
CIP-015 is not simply a sensor requirement. It creates a detect-and-evaluate loop, then asks you to preserve and protect the evidence that supports it.
R2
Retain the evidence
Keep monitoring data associated with an identified anomaly until evaluation and response activities are complete.
R3
Protect the record
Protect collected and retained monitoring data from unauthorized deletion or modification.
The compliance clock
One standard. Two implementation phases.
FERC Order No. 907
FERC approved CIP-015-1 and established the implementation schedule.
Phase 1 · Control Centers
Applicable systems at Control Centers and backup Control Centers reach the first compliance date.
Phase 2 · Other locations
Other applicable medium-impact systems with external routable connectivity follow in the second phase.
Status checked August 2026. Always confirm against NERC's official standard page.
From clock to capability
A practical readiness path.
The deadline is when the program must be working and defensible. Procurement is only one step.
01 · Map
Identify applicable systems, internal traffic paths, and the visibility gaps inside each ESP.
02 · Design
Choose defensible data feeds and document the risk-based rationale behind each one.
03 · Detect
Build a living understanding of normal behavior so anomalous activity stands out.
04 · Operationalize
Define triage, evaluation, retention, protection, and evidence-handling workflows.
05 · Prove
Test the program and produce audit-ready evidence before the compliance date arrives.
Oct 1, 2028
A working, defensible INSM program by the Phase 1 compliance date.
Budget → procure → deploy → tune → prove.
Each step is measured in quarters, not weeks.
Externally hosted · DarktraceRead the countdown article ↗
Analysis & primary sources
Go deeper than the countdown.
Start with the official record. Then explore practical interpretation grounded in real OT environments.
Featured analysis · Jeffrey Macre · Published at Darktrace
The CIP-015 Countdown: What Utilities Should Be Doing Before October 2028
A practical look at visibility, anomaly detection, evaluation, evidence, and the work that needs to happen now.
Read article ↗
Explainer · Jeffrey Macre
Understanding the NERC CIP-015 INSM requirements
Read article ↗ Primary source · NERCCIP-015-1 standard and implementation plan
Open source ↗ Primary source · FERCOrder No. 907 approving CIP-015-1
Open order ↗ Primary source · FERCOrder No. 907-A clarification of CIP-015-1
Open clarification ↗Stay on the clock
Get notified when the standard moves.
CIP-015-2 rulings, date changes, new analysis. No noise.
About the author
Jeffrey Macre
OT Cybersecurity · Author · Educator