Change record: FERC approves NERC CIP-015-1
Order No. 907 approved the proposed NERC internal network security monitoring standard and directed further modifications.
What changed
Order No. 907 approved the proposed NERC internal network security monitoring standard and directed further modifications.
This entry preserves the event separately from maintained provider and capability conclusions. A rule, announcement, release, enforcement record, or market transaction can be material before enough evidence exists to revise a company classification or comparison.
Operating consequence
Covered entities need evidence for selected network feeds, anomaly detection, evaluation, escalation, and implementation within controlling scope and dates.
Teams should identify which records, populations, systems, transactions, jurisdictions, products, or decisions fall within the change. Then assign an accountable owner, response date, evidence requirement, and disposition. Broad reassessment is not always necessary, but a material event deserves a documented decision.
Capabilities to revisit
Passive OT Asset Discovery And Inventory
Review the maintained workflow definition, then ask affected organizations to show how this event alters inputs, governed rules, human judgment, exceptions, action, evidence retention, and downstream exchange for passive OT asset discovery and inventory.
Industrial Protocol Identification And Deep Packet Inspection
Review the maintained workflow definition, then ask affected organizations to show how this event alters inputs, governed rules, human judgment, exceptions, action, evidence retention, and downstream exchange for industrial protocol identification and deep packet inspection.
Anomaly And Behavioral Detection
Review the maintained workflow definition, then ask affected organizations to show how this event alters inputs, governed rules, human judgment, exceptions, action, evidence retention, and downstream exchange for anomaly and behavioral detection.
Alert Triage And Investigation Workflow
Review the maintained workflow definition, then ask affected organizations to show how this event alters inputs, governed rules, human judgment, exceptions, action, evidence retention, and downstream exchange for alert triage and investigation workflow.
Packet Capture And Forensic Evidence
Review the maintained workflow definition, then ask affected organizations to show how this event alters inputs, governed rules, human judgment, exceptions, action, evidence retention, and downstream exchange for packet capture and forensic evidence.
Compliance Mapping And Control Evidence
Review the maintained workflow definition, then ask affected organizations to show how this event alters inputs, governed rules, human judgment, exceptions, action, evidence retention, and downstream exchange for compliance mapping and control evidence.
Questions for operating teams
- Which exact population and effective date does the source establish?
- Does the change alter authority, policy, content, workflow, integration, evidence, or only market positioning?
- What customer-controlled interpretation, configuration, or process remains outside a provider's responsibility?
- What test case would show whether the operational consequence has reached production?
- What record will close, defer, or supersede this review?
Evidence boundary
The source class is Official commission action. It establishes only the statements supported by the linked record and does not, by itself, establish implementation depth, market-wide availability, transaction-specific applicability, independent efficacy, or a universal buyer conclusion.