CIP-015-1 R1 Internal network security monitoring
Collecting network data feeds inside the ESP based on a risk-based rationale, detecting anomalous network activity against them, and evaluating detected anomalies to decide further action.
CIP-015 Internal network security monitoring
CIP-015-1 (subject to future enforcement): internal network security monitoring (INSM) inside Electronic Security Perimeters of high impact and medium impact (with External Routable Connectivity) BES Cyber Systems, and the CIP-015-2 extension to EACMS and PACS.
CIP-015-1 R2 INSM data retention
Keeping network monitoring data tied to anomalous activity at least until the evaluation and response action is complete, without a requirement to keep all captured traffic.
CIP-015-1 R3 INSM data protection
Protecting collected and retained network monitoring data from unauthorized deletion or modification so attackers cannot erase evidence of their activity.
