CIP-015-1 and CIP-015-2 are NERC Critical Infrastructure Protection reliability standards concerning internal network security monitoring for certain bulk electric system cyber systems and related systems. They address visibility into activity within protected environments, where suspicious behavior may not be apparent from a network perimeter alone. Applicability and obligations depend on the standard’s scope and the systems involved.
In practice, monitoring can help security teams detect and evaluate unusual connections or other activity inside operational networks. Endpoint and asset information may provide context for deciding whether an event is expected, while risk scores can help prioritize review. Such tools support monitoring and investigation, but their presence alone does not establish compliance: organizations must assess their applicable requirements, system scope, monitoring coverage, and review processes.