Project-2023-03-INSM

 

​​​​​​​​​​Related Files​

Status
A seven-day final ballot for Project 2023-03 Internal Network Security Monitoring is open through 8 p.m. Eastern, Tuesday, April 30, 2024  for the following standard and implementation plan:

• CIP-015-1 – Cyber Security – ​Internal Network Security Monitoring 

• ​Implementation Plan

On January 19, 2023, the Federal Energy Regulatory Commission (FERC) issued Order No. 887¹ directing NERC to develop requirements within the Critical Infrastructure Protection (CIP) Reliability Standards for internal network security monitoring (INSM) of all high impact BES Cyber Systems and medium impact BES Cyber Systems with External Routable Connectivity (ERC). INSM permits entities to monitor traffic once it is within a trusted zone, such as the Electronic Security Perimeter, to detect intrusions or malicious activity. Specifically, Order No. 887 directs NERC to develop Reliability Standards requirements that are “forward-looking, objective-based"² and address three security objectives outlined in Order No. 887. FERC directed NERC to submit these revisions for approval by July 9, 2024.​

Standard(s) Affected: CIP-015-1

​Purpose/Industry Need
While the CIP Reliability Standards require monitoring of the Electronic Security Perimeter and associated systems for high and medium impact Bulk Electric System (BES) Cyber Systems, the CIP networked environment remains vulnerable to attacks that bypass network perimeter-based security controls traditionally used to identify the early phases of an attack. This presents a gap in the currently effective CIP Reliability St​andards. To address this gap, CIP Reliability Standards should be created or modified to require INSM for all high impact BES Cyber Systems and medium impact BES Cyber Systems with External Routable Connectivity (ERC) to ensure the detection of anomalous network activity indicative of an attack in progress. These provisions will increase the probability of early detection and allow for quicker mitigation and recovery from an attack. Current CIP Reliability Standards are insufficient to protect against insider threats or vulnerabilities that are exploited through supply chain attacks such as SolarWinds.

Subscribe to this project's observer mailing list 
Select "NERC Email Distribution Lists" from the "Service" drop-down menu and specify “Project 2023-03 Internal Network Security Monitoring  Observer List" in the Description Box.​

¹ Internal Network Security Monitoring for High and Medium Impact Bulk electric System Cyber Systems, Order No. 887, 182 FERC ¶ 61,021 (Jan. 19, 2023).
² Order No. 87 at P 5.

​ 
​
​