CIP-015 INSM readiness cost and timeline

What CIP-015 INSM readiness costs and how long it takes

CIP-015-1 is subject to enforcement from 1 October 2028 for high and medium impact systems at Control Centers and backup Control Centers, and other medium impact systems with External Routable Connectivity are due 24 calendar months after that. FERC's Order No. 907 estimated that 400 of about 1,636 CIP-registered US entities would take on extra paperwork for CIP-015-1, at 340 hours and $32,116 per entity per year in each of the first three years, using an $85 loaded hourly wage. That figure is a national average for paperwork, not a quote for your program, and your organization owns every control, document and decision in it. An implementation partner prepares systems, configurations and evidence on your behalf, but only your team can approve the risk-based rationale for each data feed and sign off on the monitoring program.

The real cost depends on scope and maturity. The number of high and medium impact BES Cyber Systems and the networks inside their Electronic Security Perimeters set how many monitoring points, data feeds and baselines you need. Existing network visibility, such as flow collection, asset inventories and logging already tied to CIP-007 event review, lowers the build effort, while a network with little documented communication behavior raises it, because the baseline used to detect anomalies must be built before it can be tested. Documentation maturity matters as much as tooling: the processes for data retention, evaluation, escalation and protection of monitoring data are written artifacts that an auditor will read. Ask any partner to price these as separate line items: discovery and baselining, tool deployment, documentation, retention storage, and recurring tuning and review.

Expect a mix of one-time and recurring costs. One-time work includes scoping, initial policy development, sensor and collector deployment, and baseline creation. Recurring costs include license or support fees for any tools, storage for retained monitoring data, analyst time to evaluate anomalies, and periodic review. Work backward from 1 October 2028 and confirm with your Regional Entity which systems fall in the first phase, since the second-phase deadline depends on that classification. If you plan for CIP-015-2, note that NERC lists its extension to EACMS and PACS with an effective date of 1 October 2029, so ask your partner whether the architecture can add those systems without redesign.

Who is paid for what in INSM readiness

This table compares each cost component of CIP-015 INSM readiness by who pays for it, whether it is one-time or recurring, and what drives it up or down. Read it before requesting quotes so each proposal can be checked against the same components. The main takeaway is that the only effort figure with a published source is FERC's Order No. 907 estimate, and most other costs depend on your own network and staffing.

Cost component	Who is paid	One-time or recurring	What drives it up or down
Internal staff time for INSM policy	Your own staff (internal labor)	One-time to draft, then recurring to review	Size of the program, number of ESPs in scope, and how much existing network monitoring documentation you can reuse
Internal staff time for operations	Your own staff (internal labor)	Recurring	Alert volume, number of anomalies investigated, and how well escalation links to existing CIP-008 incident response plans
Monitoring tooling and software licenses	Software vendor or open-source project support provider	Initial setup one-time, licenses or support recurring	Number of network segments monitored, data retention period, and whether you choose open-source or commercial components
Sensors, data feeds and storage infrastructure	Your hardware, cloud or data center providers	Initial purchase one-time, storage and hosting recurring	Traffic volume, retention needed for R2 anomaly data, and how many network data feeds your risk-based rationale selects
Implementation partner for scoping and documentation	Implementation partner under a written scope (if engaged)	One-time for scoping and documents, optional recurring for support	Scope agreed in writing, number of Applicable Systems, and how much evidence preparation your team does itself
Regional Entity or auditor monitoring	Compliance Enforcement Authority for audits; independent auditors are not used for CIP certificates	Recurring on a monitoring schedule set by the Regional Entity	Risk-based audit schedule, prior compliance history, and how well evidence is organized before the engagement
Compliance audit certificate fee	Not charged by NERC or Regional Entities	Not applicable	No CIP certificate exists, so no certificate fee should appear in any quote
Documentation effort estimated by FERC	Your internal staff, as estimated in FERC Order No. 907	Order No. 907 estimated 340 hours and $32,116 per entity per year for the first three years	Order No. 907 used an $85 loaded hourly wage and estimated 400 of about 1,636 CIP-registered entities would take on this paperwork

Phased INSM dates from 2028 to 2029

The first deadline for internal network security monitoring under CIP-015-1 is 1 October 2028, and it applies to high impact and medium impact BES Cyber Systems at Control Centers and backup Control Centers. Those systems carry the most exposure, so they are the first group to need INSM data feeds, documented baselines and detection processes in place. Other medium impact BES Cyber Systems with External Routable Connectivity follow within 24 calendar months after that date, which gives a second wave of work. Entities should map each asset to one of these two groups now, because the group decides when its network data feeds must be live and which evidence must exist on the first day of enforcement.

CIP-015-2 changes the picture for the later phase. It was approved by FERC on 10 August 2026, extends INSM to the associated Electronic Access Control or Monitoring Systems (EACMS) and Physical Access Control Systems (PACS), and takes effect 1 October 2029. That date is offset 12 months from the CIP-015-1 dates, and CIP-015-2 retires CIP-015-1. An entity that plans only to the 2028 dates may therefore be building a monitoring design that will need to be extended to access control systems within a year. Architects should ask whether their collection points and retention stores can accept EACMS and PACS traffic without a redesign.

Before committing budget, confirm every date against the NERC CIP standards page and the implementation plans for Project 2023-03 and Project 2025-02, since the phase boundaries depend on the exact wording of each plan. Ask your Regional Entity how it will read the 24-month follow-on for your medium impact sites, and confirm whether your assets fall in the Control Center group or the follow-on group. Record the outcome in your CIP-002 categorization so the INSM project plan, the procurement schedule and the evidence calendar all use the same dates.

What must be documented under CIP-015-1 R1 and R2

CIP-015-1 asks for documented processes, not just monitoring tools. The six documents below show what an entity must write down for networks inside Electronic Security Perimeters, and where each one feeds into the cost and timing of readiness work.

Documented INSM process for ESP networks

R1 requires a documented process for internal network security monitoring across networks protected by the Electronic Security Perimeters of high impact BES Cyber Systems and medium impact BES Cyber Systems with External Routable Connectivity. This is the anchor document that names the in-scope networks, the monitoring owner and how detections move through review. Confirm the scope against your CIP-002 categorization before drafting, because every later document inherits it.

Risk-based rationale for data feeds

Auditors expect a written explanation of why each network data feed was chosen, such as which switch, firewall or tap traffic is collected and which detection gaps that choice closes. Record the rationale alongside the feed inventory so it can be reviewed when the network changes. Planning teams often underestimate this work because it requires engineering judgment that must be signed off, not just a list of sensors.

Network communication baseline

The baseline is the documented picture of normal traffic that anomaly detection is measured against. It should record expected communication paths, protocols and endpoints inside the ESP, and how the baseline was built and when it is reviewed. An incomplete baseline produces either noise or missed events, so ask for the baseline method and its update cycle when scoping any INSM tool or service.

Anomaly evaluation and actions taken

For each detected anomaly, the entity must document how it was evaluated and what action followed, including closure decisions and any escalation. Evidence examples include detection events and the records of actions taken on them. Keep these records in a form a Regional Entity can sample quickly, since the volume of events during a monitoring period can be large.

Escalation tied to CIP-008

Escalation procedures should state when an anomaly becomes a Cyber Security Incident and hands off to the CIP-008 incident response plan. The CIP-015-1 evidence examples name this link directly, so the INSM process and the incident plan must describe the same thresholds and roles. Review both documents together before the 2028 date rather than updating them separately.

R2 retention until the action completes

R2 requires documented processes to retain INSM data tied to anomalous activity until the action under R1 Part 1.3 is complete, except during CIP Exceptional Circumstances. The retention period is set by when the response finishes, not by a fixed calendar number, so the document must define the completion trigger and the storage location. Confirm retention capacity and data protection terms with any vendor or cloud provider storing this data.

What evidence auditors will look for

What evidence shows the rationale for choosing INSM data feeds?

Auditors expect written, risk-based documentation explaining which network data feeds you collect inside each Electronic Security Perimeter and why those feeds were chosen. The record should link each feed to the network segments and BES Cyber Systems it covers, state what it can reveal about anomalous activity, and show who approved the decision and when. Keep the rationale current when you add or remove a feed, since a stale list is a common finding. Confirm the exact format and depth your Regional Entity expects before you build the document, because approaches vary across regions and audit teams.

What records prove anomalous network activity was detected?

Auditors look for dated detection event records that show the INSM system flagged network activity deviating from the baseline. Each record should identify the source, destination, protocol and time, and show the criteria that triggered the alert. Retain these records in a form that can be reviewed after the fact, not only as dashboard screenshots. Auditors often sample a set of events and trace each one through evaluation and any follow-up, so the chain from detection to disposition must be easy to reconstruct. Ask your Regional Entity how many events it expects to sample and over what audit period.

What INSM configuration evidence do auditors request?

Auditors typically ask for exported or captured configuration settings of the INSM system, showing the monitored interfaces, collection and analysis rules, alert thresholds, and retention settings in effect during the audit period. The evidence should show what the system was configured to do at each point in time, so change records matter as much as the current state. Store configuration snapshots and link each change to an approved change request under your change management process. Confirm with your Regional Entity whether it wants raw exports, screenshots, or a documented summary, since expectations differ.

What baseline documentation do auditors expect for anomaly detection?

Auditors expect a documented network communication baseline that defines normal traffic patterns used to detect anomalies, along with the method used to build it. The record should state when the baseline was created, what data it was drawn from, and every update made since, with the reason for each update. A baseline that has never been reviewed is a frequent concern, so set and document a review cadence and keep the approval trail. Confirm with your Regional Entity how it evaluates baseline changes made during a monitoring period, because the answer shapes how you record updates.

What records show actions taken on detected anomalies?

For each anomaly you evaluate, auditors look for a record of the evaluation, the decision reached, and any action taken, such as blocking, isolating a device, or escalating. Escalations may route into your CIP-008 incident response plan, so the record should show whether the event was treated as a Cyber Security Incident and who made that call. Ticketing or case management records that tie the detection to its outcome and closure date usually satisfy this best. Ask your Regional Entity how it expects you to show evaluation of events that were judged benign.

What retention records does CIP-015-1 R2 require auditors to check?

Auditors check that your documented retention process exists and that INSM data tied to anomalous activity was kept at least until the related action was complete. Evidence includes the retention procedure, retention settings, and records showing that data was not deleted before the action closed. R2 also allows for CIP Exceptional Circumstances, so any period in which normal retention was suspended should be documented with its justification and dates. Keep retention records separate enough that you can show data existed when an action was open. Confirm with your Regional Entity how it wants retention settings and deletion logs presented.

What FERC's per-entity effort estimate covers

FERC's Order No. 907 estimated that 400 of about 1,636 CIP-registered US entities would take on extra paperwork for CIP-015-1. The estimate put the burden at 340 hours and $32,116 per entity per year in each of the first three years, or $11,595,360 a year in total, using an $85 loaded hourly wage. Treat these figures as a regulator's average across a population, not a quote for your organization. Your effort depends on how many high and medium impact systems you run, how many data feeds you monitor, and how much of your monitoring tooling already produces the records the standard asks for.

The 340 hours break down into a 40-hour item for documenting the INSM processes and four 60-hour items: documenting the network data feeds and the rationale for choosing them, the anomaly detection baselines, the evaluation and escalation methods, and the data retention and data protection practices. The estimate also includes initial policy development. Those items map directly to the R1 and R2 documentation the standard requires, so the hours mostly go to writing, reviewing and approving policy and technical records rather than to buying equipment. Confirm with your own compliance team which of these items already exist in your CIP-007 or CIP-008 documentation, since reuse can reduce the new work.

Use the estimate as a planning baseline, then build your own. Ask each candidate partner to price the documentation items separately from configuration work, state which roles (compliance lead, network engineer, security analyst, legal reviewer) are assumed for each hour, and say whether the estimate covers the first three years only or continues after that. Check the figures against the NERC CIP standards page for current status, since the standard has since been revised in CIP-015-2, which changes the scope and dates.

Which parts to keep in-house and which to outsource

Entities that already run a SIEM and network monitoring staff usually have data feeds, alert handling and retention in place, so the CIP-015 work is mostly about mapping that existing capability to the ESP boundary and writing it down. Internal staff should keep ownership of the risk-based rationale for selecting data feeds, the anomaly detection baseline, and the decisions on what counts as anomalous. Outside help is most useful for drafting the INSM process documents from existing runbooks and for preparing evidence packages.

Risk rationale: Internal security and CIP leads decide which data feeds are in scope and document why, since that rationale is the entity's own judgment.
Baseline and tuning: Operations staff own the network communication baseline and the configuration of detection rules.
Document drafting: A partner can convert existing SIEM runbooks into INSM processes that map to R1 and R2.
Evidence preparation: Configuration exports, detection event samples and retention settings can be assembled with outside support, then reviewed internally.
Approval: The CIP Senior Manager or delegate approves the processes. No outside party approves them.

Before engaging anyone, confirm with your Regional Entity how it expects existing SIEM evidence to be presented against the ESP boundary.

The readiness sequence from scoping to audit evidence

This sequence takes an entity from knowing which BES Cyber Systems fall under CIP-015-1 to holding a documented, tested internal network security monitoring program with the records an auditor will ask to see. Each phase closes with a named output that feeds the next, so gaps surface before the enforcement date rather than during an audit.

Confirm impact categorization under CIP-002
The compliance lead and the CIP Senior Manager review the current CIP-002 categorization of every BES Cyber System and identify which are high impact, and which are medium impact with External Routable Connectivity. Control Centers and backup Control Centers are checked first, because they carry the earliest CIP-015-1 dates. The output is a signed-off list of in-scope systems, and you know this step is done when every in-scope system maps to a documented Electronic Security Perimeter and a named owner.
Define electronic security perimeter boundaries
Network and operations staff trace the Electronic Security Perimeter around each in-scope system, documenting the Electronic Access Points, the network segments inside the perimeter and the points where traffic crosses into or out of it. CIP-015-1 monitoring applies to the networks these perimeters protect, so an unclear boundary makes every later scope decision uncertain. The output is a current network diagram and boundary inventory that matches what is actually deployed, verified against configuration exports.
Select and justify internal data feeds
Security engineers identify the internal network traffic sources they can monitor, such as flow records, packet capture points, or logs from devices inside the perimeter, and record why each one was chosen and what it leaves unseen. The rationale must be risk-based and written down, because auditors look for the reasoning behind the selection as well as the selection itself. The output is a data feed register with the justification, coverage limits and the owner of each feed.
Document the R1 monitoring process
The compliance team writes the processes that describe how anomalous network activity is detected, evaluated and escalated, including how escalation connects to the CIP-008 incident response plan where relevant. The document should name roles, the tools used, and how detection results feed into action tracking. This step produces the approved R1 procedure, and it is complete when a reviewer who did not write it can follow the steps from a detection event to a closed action.
Establish network communication baselines
Engineers observe normal communication patterns inside each perimeter over a representative period and record the expected sources, destinations, protocols and volumes. The baseline is what makes an anomaly detectable, so it must be reviewed by people who understand the operational process, not only the tool output. The output is a versioned baseline document with the method, the observation window and the approval record, plus a plan for how and when the baseline is updated after network changes.
Run the INSM system in a test period
Operations and security staff run the monitoring tooling against live traffic in a controlled test period, tuning detection rules, checking for missed events and confirming that alerts reach the people responsible for evaluating them. Tuning decisions and false positive reviews are logged, because they show how the process matured. The output is a test report listing configuration changes, known gaps and the actions taken to close them before the program goes live.
Produce evidence and retention records
The team assembles the artifacts an auditor will request: the INSM configuration settings, anomaly detection records, the documented actions taken on each anomaly, escalation records, and the data retention schedule that keeps monitoring data for anomalous activity until the related action is complete. Each record should be traceable to a requirement part and stored where it can be produced on request. The step closes when a sample request can be answered from the evidence set within a short internal drill.

What delays INSM projects and inflates their cost

Most CIP-015 delays do not come from monitoring technology. They come from scope questions that were never settled, documents that were never written, and purchases made before the boundary was clear. Each pitfall below adds rework, and each has a check you can run before the project grows.

Unclear ESP boundaries

CIP-015-1 R1 applies to networks protected by the Electronic Security Perimeters of high impact BES Cyber Systems and medium impact BES Cyber Systems with External Routable Connectivity. If engineers disagree about where an ESP ends, sensors get placed on the wrong segments and the baseline covers the wrong traffic. Before buying anything, produce a current network diagram that marks every ESP boundary, every Electronic Access Point and every zone it protects, and have the CIP program owner sign it off. Treat any segment without a clear answer as an open item.

Late CIP-002 categorization changes

The INSM scope follows the impact rating in CIP-002. A reclassification of a Control Center or a medium impact asset after design work starts can add or remove monitored networks and change the compliance date that applies. Confirm the current categorization against the CIP-002 bright-line criteria, and check whether any pending version changes, such as the revised Control Center definition in CIP-002-8, would alter your ratings before the 2028 dates. Freeze the categorization record before design begins and reopen it only through a documented change.

Undocumented data feed rationale

CIP-015-1 evidence examples include documentation of the risk-based rationale for selecting data feeds. Teams often deploy taps, flow exporters and log sources first and explain them later, which forces an assessor-facing rewrite under time pressure. Record for each feed what it sees, why that visibility matters to detecting anomalous activity, what it cannot see, and who approved it. Keep the rationale in the same repository as the configuration so that changes to feeds update the record.

Baselines built too late

Anomaly detection needs a network communication baseline to compare against, and an anomaly baseline cannot be reconstructed after the fact. If monitoring goes live without a baseline period, the first months generate noise, triage queues grow and the documented baseline has no clean source. Plan an observation window in which traffic is recorded, reviewed and approved as expected before alerting thresholds are set. Ask the vendor or integrator how the baseline is stored, versioned and exported for evidence.

Retention gaps

CIP-015-1 R2 requires documented processes to retain INSM data tied to anomalous activity, at a minimum until the action supporting R1 Part 1.3 is complete, except during CIP Exceptional Circumstances. Many monitoring platforms apply a default retention period that expires data while an investigation is still open. Write the retention rule for each data type, configure storage to match it, and test that a held event survives the default purge. Confirm with the vendor how legal holds and archive exports work in your environment.

Tooling bought before scope is set

Buying a sensor platform before the ESP map, feed list and retention rules exist usually means buying the wrong capacity, licensing for the wrong number of collection points or discovering that the product cannot ingest a required source. Costs then recur through licenses, storage and integration work that a scoped design would have avoided. Ask for a written scope, a feed inventory and a sizing assumption set first, then request quotes against that document. Ask each vendor to state which CIP-015 evidence the product produces and which it leaves to your staff.

CIP-015 INSM questions buyers ask before hiring help

How much effort does CIP-015 INSM documentation take per entity?

FERC's Order No. 907 estimated that 400 of about 1,636 CIP-registered US entities would take on extra paperwork for CIP-015-1, at 340 hours and $32,116 per entity per year in each of the first three years, using an $85 loaded hourly wage. The estimate is a paperwork burden for documenting processes, not the cost of building monitoring tools. Its breakdown assigns 40 hours to documenting INSM processes and 60 hours each to documenting network data feeds and their rationale, anomaly detection baselines, evaluation and escalation methods, data retention and data protection, with initial policy development included. Your own figure will depend on how many high and medium impact sites you operate, how many data feeds you collect, and how much of the documentation already exists in your CIP-008 and CIP-007 programs. Ask any vendor or consultant to price each documentation item against this list.

When does CIP-015-1 monitoring become enforceable?

CIP-015-1 is subject to future enforcement from 1 October 2028 for high and medium impact systems at Control Centers and backup Control Centers. Other medium impact systems with External Routable Connectivity follow within 24 calendar months after that date. Work should be planned backward from these dates, because documentation, procurement of data collection and retention capacity, and staff training all need to be finished before the first audit period that covers them. Confirm the exact dates for your asset types against the NERC implementation plan, since they vary by asset category.

What does our internal team need to provide?

Your team owns the controls, the risk-based rationale and the decisions that auditors will test. Expect to provide the network architecture for each Electronic Security Perimeter, an inventory of the systems that generate network data, access to switches, firewalls and collection points, and the people who understand which anomalies matter to operations. Operations and security staff must agree on what counts as anomalous activity and who acts on it. Compliance staff need to map the monitoring process to CIP-008 incident response and to the evidence retention practices already used for other CIP requirements. Ask a prospective partner to list these inputs in writing before work begins.

Can our team do CIP-015 readiness without outside help?

Many registered entities can, particularly those with mature CIP programs and existing network monitoring. The work splits into three parts: policy and documentation, technical deployment of data collection and analysis, and evidence production. Internal teams usually handle policy and the CIP interpretation, while the technical deployment often needs engineering time that competes with operations. Outside help is most useful for designing the monitoring architecture, building baselines, configuring the analysis platform and producing repeatable evidence. Compare the internal hours required against the FERC estimate and your current staffing before deciding. A fixed-scope engagement can cover only the parts you choose to hand off, so define the boundary in writing.

Can a consultant or implementation partner issue a CIP-015 compliance finding?

No. Only the Compliance Enforcement Authority, which is a Regional Entity or NERC, monitors compliance and makes findings through Compliance Audits, Spot Checks, Self-Certifications, Self-Reports, investigations and complaints. There is no CIP certificate. DeployOpen prepares systems, controls and evidence, but it does not issue audit reports, attestations or findings, and your organization remains responsible for its own compliance. Any consultant who claims to certify CIP compliance should be treated with caution. Ask instead how the partner will document the evidence so your compliance staff can present it during a monitoring engagement, and whether the work includes a review by your own CIP team.

How does CIP-015-2 change our planning?

CIP-015-2, approved by FERC on 10 August 2026, extends internal network security monitoring to associated Electronic Access Control or Monitoring Systems (EACMS) and Physical Access Control Systems (PACS) from 1 October 2029. That date is offset 12 months from the CIP-015-1 dates, and CIP-015-2 retires CIP-015-1. Entities should therefore design the monitoring architecture and data retention so it can extend to EACMS and PACS without a redesign. Ask whether your collection points, storage capacity and analysis tooling can cover those systems later. Budget and documentation for the extension are not covered by the FERC estimate for CIP-015-1, so request separate scoping for it.

What should we ask for in a CIP-015 quote?

Ask for a written scope that lists each Electronic Security Perimeter, each in-scope asset category and each deliverable, with the documentation items matched to CIP-015-1 Requirement R1 and R2. The quote should state what is one-time, such as design, documentation and deployment, and what recurs, such as baseline reviews, log retention and support. Request the assumptions behind any effort figure, the internal staff time the plan requires, the acceptance criteria for each deliverable and how changes to scope are priced. Confirm whether the work includes the CIP-015-2 extension and who owns the evidence afterward. DeployOpen provides a quote only after written scope is agreed, so expect the detail to follow from your own environment.

What evidence will auditors look for under CIP-015?

Auditors will look for documented processes for internal network security monitoring of the networks protected by the relevant ESPs, and evidence that those processes run. Typical evidence includes the risk-based rationale for selecting each data feed, records of anomalous network detection events, INSM system configuration settings, the network communication baseline used to detect anomalies, records of actions taken on detected anomalies, and escalation processes that may link to CIP-008 incident response plans. Under Requirement R2, you must also retain monitoring data associated with anomalous activity until the related action is complete, except during CIP Exceptional Circumstances. Plan retention and access controls early, because the data itself can be sensitive. Confirm the specific expectations with your Regional Entity.

How DeployOpen prepares INSM systems and evidence

DeployOpen works on CIP-015 INSM readiness as a fixed-scope engagement inside your own infrastructure. We prepare the monitoring systems, the documented processes and the evidence that an independent auditor or Regional Entity would review, while your organization keeps ownership of its controls and compliance decisions.

How we scope

Agree in writing which high and medium impact BES Cyber System networks fall inside the scope.
Map the ESP boundaries, candidate network data feeds and the retention approach for each network.
Confirm the CIP-015-1 dates that apply to your assets, and whether CIP-015-2 planning should run alongside.

How we build

Deploy and configure open-source monitoring components within your own cloud, data center or air-gapped network.
Set network communication baselines and anomaly detection rules, then record the configuration settings used.
Test detection and escalation paths, including hand-offs to CIP-008 incident response plans, before handover.

How we hand over

Prepare documentation of the risk-based rationale for each data feed and the INSM processes for R1 and R2.
Assemble evidence packages covering detection events, baselines, actions taken and retained monitoring data.
Deliver written runbooks so your own staff can operate, review and explain the system to an auditor.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after handover.
Retainers can cover baseline tuning, documentation updates and changes to CIP-015 versions.
Confirm with us in the quote how support, upgrade windows and testing cadence are priced and scheduled.

CIP-015 INSM readiness: timeline and cost