CIP-015-1 is a North American Electric Reliability Corporation (NERC) reliability standard requiring documented internal network security monitoring for specified high- and medium-impact Bulk Electric System cyber systems. Internal monitoring looks for suspicious activity within protected networks, such as unexpected connections, unusual traffic, or previously unknown communicating devices.
The standard matters because activity inside an operational technology network may evade perimeter defenses, while monitoring data can expose sensitive system details. A compliant program involves selecting and documenting relevant data feeds, evaluating anomalies, and protecting monitoring records; it does not mandate a particular product or mean every alert should trigger a patch. Security tools can help identify and prioritize issues, but operators still need documented review, evidence handling, and controlled remediation that accounts for testing, change management, and operational safety.