Preparing for CIP-015-1 internal network security monitoring

Scope

CIP-015-1 takes effect in the U.S. on October 1, 2028 for high-impact BES Cyber Systems and medium-impact systems at Control Centers and backup Control Centers; other medium-impact BES Cyber Systems with External Routable Connectivity must comply within 24 more months (October 1, 2030). It looks inside the ESP — traffic between devices — rather than only at the boundary.

R1 — monitor, detect, evaluate

• Part 1.1 — risk-based network data feeds: decide, with a documented risk-based rationale, where to collect network data inside the ESP (connections, devices, communications) — e.g. SPAN or mirror ports, network TAPs.
• Part 1.2 — detect anomalous network activity from those feeds — new devices, unexpected protocols, write commands where only reads are expected.
• Part 1.3 — evaluate the anomalous activity to determine further action.

R2 — retain the data

Keep the monitoring data associated with activity you determined to be anomalous at least until the action decided under Part 1.3 is complete, under documented processes (except during CIP Exceptional Circumstances).

R3 — protect the data

Protect the monitoring data collected for R1 and retained for R2 from unauthorized deletion or modification, under documented processes. In practice INSM data reveals how the control system works, so limiting access to the people who analyze it is a sensible way to do this.

Practical steps

• Start passive: monitoring that only listens cannot disturb protection systems.
• Prioritise segments where a malicious command would matter most — protection and control.
• Decide in advance who looks at alerts and how quickly.