Last month, on June 26, 2025, the Federal Energy Regulatory Commission (FERC) approved NERC CIP-015-1, introducing one of the most significant cybersecurity requirements the electric utility industry has seen in years. The new standard requires Internal Network Security Monitoring (INSM) within Electronic Security Perimeters (ESPs), fundamentally changing how utilities must defend critical operational technology (OT) environments.
For years, utilities have invested heavily in perimeter security through firewalls, VPNs, and access controls. CIP-015-1 recognizes what cybersecurity professionals have known for a long time: attackers who breach the perimeter often move laterally inside trusted environments without being detected.
The new standard shifts the focus from simply preventing intrusions to continuously detecting malicious activity already inside the network.
At FrontLine Cyber Solutions, this philosophy has been at the core of our OT cybersecurity strategy since the development of our Watcher Security Platform. Combined with our 24x7x365 Cyber Fusion Center, organizations gain not only continuous visibility into their operational networks but also a dedicated team capable of responding to threats in real time.
The Evolution of OT Cybersecurity
Traditional security architectures were designed around a simple assumption:
“If we protect the perimeter, the inside network is trusted.”
Unfortunately, modern cyberattacks have proven otherwise.
Whether through phishing, compromised vendors, stolen credentials, vulnerable remote access solutions, or supply chain attacks, adversaries routinely gain legitimate access into trusted environments.
Once inside, attackers begin:
- Discovering assets
- Enumerating services
- Mapping industrial processes
- Moving laterally
- Establishing persistence
- Manipulating industrial protocols
- Exfiltrating sensitive operational data
- Deploying ransomware or destructive payloads
Most of these actions occur entirely inside the trusted OT network—exactly where traditional security controls have the least visibility.
That is precisely the gap CIP-015-1 is designed to close.
What is Internal Network Security Monitoring (INSM)?
Internal Network Security Monitoring provides continuous visibility into communications occurring inside trusted OT environments.
Instead of only monitoring traffic entering or leaving a network, INSM focuses on East-West communications between controllers, HMIs, engineering workstations, servers, relays, RTUs, PLCs, historians, and other industrial assets.
An effective INSM solution should continuously:
- Discover every connected asset
- Map network communications
- Identify protocols in use
- Build behavioral baselines
- Detect anomalous communications
- Alert on unauthorized devices
- Detect unauthorized software
- Record network traffic
- Preserve forensic evidence
- Support incident investigations
This visibility allows operators to identify malicious activity before it impacts operations.
Why CIP-015-1 Matters
The new NERC standard requires responsible entities to implement documented processes capable of:
Developing Network Baselines
Organizations must understand:
- What devices normally communicate
- Which protocols are expected
- Normal communication timing
- Normal traffic volumes
- Authorized devices
Without an accurate baseline, anomaly detection becomes nearly impossible.
Detecting Unauthorized Activity
Utilities must identify:
- Unknown devices
- Unauthorized communications
- Suspicious protocols
- Rogue software
- Unexpected services
- Changes in device behavior
Simply collecting logs is no longer sufficient.
Continuous monitoring is required.
Preserving Evidence
Organizations must also retain monitoring data to support:
- Incident response
- Root cause analysis
- Regulatory investigations
- Threat hunting
- Recovery operations
This means protecting logs from tampering while maintaining sufficient retention periods.
How FrontLine Addresses CIP-015-1
Unlike products originally built for enterprise IT and later adapted for industrial environments, Watcher was engineered specifically for Operational Technology.
Industrial environments behave differently than corporate networks.
Protocols are deterministic.
Assets often operate for decades.
Availability is critical.
Safety always comes first.
Watcher was designed around these realities.
Comprehensive OT Asset Discovery
Watcher continuously discovers:
- PLCs
- RTUs
- HMIs
- Historians
- Protection relays
- SCADA servers
- Engineering workstations
- Industrial switches
- Firewalls
- Remote communication devices
- Serial gateways
- IIoT devices
- Unknown assets
Organizations gain an always-current inventory without interrupting operations.
Automatic Network Mapping
Understanding communication paths is essential for CIP compliance.
Watcher automatically maps:
- North-South communications
- East-West communications
- Device relationships
- Trust boundaries
- Network topology
Operators gain complete visibility into operational communications.
Behavioral Baselining
One of the most challenging requirements of CIP-015-1 is establishing accurate network baselines.
Watcher continuously learns:
- Normal protocol behavior
- Expected communication paths
- Typical device interactions
- Traffic frequency
- Command patterns
- Operational timing
Unlike static rule-based systems, Watcher continuously refines its understanding of your unique environment.
Industrial Protocol Visibility
Watcher was designed to understand OT communications rather than treating industrial traffic as generic network packets.
Current protocol support includes numerous industrial and enterprise protocols, with our engineering team capable of adding support for new protocols—typically within 90 days or less—as customer requirements evolve.
Examples include:
- DNP3
- Modbus
- IEC 61850
- IEC 60870
- OPC
- EtherNet/IP
- PROFINET
- BACnet
- S7
- Proprietary industrial protocols
This protocol awareness allows Watcher to detect anomalies that generic IDS platforms often miss.
Intelligent Threat Detection
Watcher continuously monitors for:
- Indicators of Compromise (IOCs)
- Malware behaviors
- Unauthorized communications
- New devices
- Port changes
- Service changes
- Protocol anomalies
- Lateral movement
- Insider threats
- Command anomalies
- Custom customer-defined events
Rather than overwhelming operators with alerts, Watcher prioritizes events requiring immediate attention.
Complete Network Forensics
When incidents occur, investigators need evidence.
Watcher provides:
- Full packet capture (PCAP)
- Historical communications
- Asset timelines
- Behavioral comparisons
- Event reconstruction
- Security event correlation
This significantly accelerates investigations and supports compliance with CIP-015-1 retention requirements.
Beyond Monitoring: FrontLine’s Cyber Fusion Center
Technology alone does not stop cyberattacks.
Many organizations struggle to staff experienced OT cybersecurity analysts around the clock.
That is where FrontLine’s Cyber Fusion Center provides a critical advantage.
Our Cyber Fusion Center delivers 24x7x365 operational support by continuously monitoring customer environments and responding to emerging threats.
Our analysts provide:
- Continuous security monitoring
- Threat hunting
- OT-specific alert validation
- Incident response support
- Escalation management
- Vulnerability intelligence
- Compliance reporting
- Executive dashboards
- Root cause analysis
- Forensic investigations
This combination of advanced technology and human expertise enables organizations to detect and respond to threats before they impact operations.
Built for Critical Infrastructure
FrontLine supports organizations across critical infrastructure sectors, including:
- Electric Utilities
- Generation Facilities
- Transmission Operators
- Distribution Providers
- Oil & Gas
- Water & Wastewater
- Manufacturing
- Chemical Processing
- Food Processing
- Transportation
- Defense Industrial Base
- Aerospace
- Healthcare
- Government
Our experience spans NERC CIP, IEC 62443, NIST 800-82, NIST CSF, CMMC, ISO 27001, NRC, NEI, and other critical cybersecurity frameworks.
Preparing for Compliance Starts Today
Although compliance deadlines extend through 2028 and 2030, implementing Internal Network Security Monitoring is not an overnight project.
Organizations should begin now by:
- Identifying critical assets
- Mapping network communications
- Establishing behavioral baselines
- Evaluating current monitoring capabilities
- Identifying visibility gaps
- Developing retention strategies
- Testing incident response procedures
- Building documentation required for compliance
Early planning reduces implementation risk while improving cybersecurity long before regulatory deadlines arrive.
The FrontLine Advantage
At FrontLine Cyber Solutions, we believe cybersecurity should provide more than compliance—it should strengthen operational resilience.
Our Watcher Security Platform was purpose-built to protect Operational Technology environments, and our Cyber Fusion Center extends that protection with around-the-clock monitoring and expert support.
Whether you’re preparing for CIP-015-1, strengthening your OT security posture, or seeking greater visibility into your industrial networks, FrontLine Cyber delivers an integrated solution designed specifically for critical infrastructure.
As regulatory expectations continue to evolve, organizations that invest in continuous visibility, behavioral analytics, and expert operational monitoring will be best positioned to defend against today’s threats and tomorrow’s challenges.
Ready to prepare for CIP-015-1? Contact FrontLine Cyber Solutions to schedule an OT cybersecurity assessment and learn how Watcher and our Cyber Fusion Center can help your organization achieve compliance while improving the security and resilience of your critical operations.
