FERC Approves NERC’s Proposed INSM Standard

AI generated summary

On June 26, FERC approved NERC's proposed reliability standard mandating utilities to implement internal network security monitoring (INSM) to enhance cybersecurity measures. This decision follows a directive from FERC in 2023 and aims to address vulnerabilities highlighted by incidents like the SolarWinds hack in 2020. The approved standard, CIP-015-1, requires high-impact grid-connected cyber systems to adopt INSM, with modifications needed to clarify the scope of the standard in light of evolving cybersecurity threats.

FERC's modifications include extending INSM implementation to electronic access control and physical access control systems outside the electronic security perimeter, which are considered potential targets for cyberattacks. The commission has given NERC 12 months to file the modified standard, while CIP-015-1 will take effect 60 days after its publication in the Federal Register. Additionally, FERC withdrew a Notice of Inquiry regarding potential gaps in the Critical Infrastructure Protection (CIP) standards, noting that recent improvements in cybersecurity measures have addressed many concerns raised since the inquiry's initiation.