Cybersecurity for the Bulk Electric System (BES) continues to evolve as new technologies, threats, and operational challenges emerge. In 2025, several key updates to NERC’s Critical Infrastructure Protection (CIP) standards are reshaping how utilities approach internal network monitoring, security management controls, and remote access. These updates, including the approval of CIP-015-1, ongoing revisions to CIP-003-12, and refinements to CIP-005, reflect a growing emphasis on network visibility, accountability, and proactive cyber defense. All these updates are vital to ensure compliance and enhance the reliability of the bulk electric system.

1. CIP-015-1: Internal Network Security Monitoring (INSM)

CIP-015-1, approved by FERC on June 26, 2025, mandates Internal Network Security Monitoring (INSM) to detect malicious activity via risk-justified data feeds or sensors placed within the Electronic Security Perimeter (ESP). It expands the traditional perimeter-only view to include ‘east-west’ traffic inside trust zones.

Applicable entities are now required to:

• Implement monitoring capabilities for internal (“east-west”) network traffic between BES Cyber Systems.
• Document use cases, thresholds, and alerting procedures for identifying abnormal behavior.
• Ensure evidence of monitoring and incident response activities is retained for audit verification.

CIP-015-1 became effective on September 2, 2025. However, FERC has directed NERC to broaden the scope of CIP-015-2 to include Electronic Access Control and Monitoring Systems (EACMS) and Physical Access Control Systems (PACS) associated with the Electronic Security Perimeter (ESP). Therefore, entities should proactively evaluate their network visibility and logging architectures to prepare for compliance.

2. CIP-003-12: Updates to Security Management Controls

NERC has drafted CIP-003-12, which proposes updates to security management controls to align with new detection and incident reporting expectations. The proposed revisions highlight the importance of monitoring inbound and outbound network traffic for malicious communications. The revisions also reinforce baseline security practices for low-impact BES Cyber Systems.

Key enhancements include:

• Integration of detection requirements into existing documented policies.
• Alignment with revised incident reporting thresholds.
• Entities are expected to provide clearer evidence demonstrating continuous monitoring and response activities.

Entities should review current documentation under CIP-003-11 and update procedures, detection mechanisms, and recordkeeping to meet these expanded expectations.