INSIGHTS

Internal Network Security Monitoring for Utilities

Internal Network Security Monitoring (INSM) is transforming how electric utilities protect critical infrastructure. With NERC CIP-015 requirements and evolving cyber threats, INSM provides essential visibility into trusted network zones while supporting regulatory compliance and operational resilience.

INSM Fundamentals
Internal network security monitoring (INSM) provides continuous visibility into trusted network zones, enabling utilities to detect threats that bypass perimeter defenses.
INSM Requirements
NERC CIP-015 mandates comprehensive internal network security monitoring capabilities for High and Medium Impact BES Cyber Systems. Requirements include monitoring network data feeds, detecting anomalous activity, analyzing threats, protecting monitoring data, and retaining investigation records
CIP-015 Compliance Deadline: October 1, 2028
Asset owners have just over 3 years to implement internal network security monitoring for High and Medium Impact BES Cyber Systems. Start planning now
Case study
This case study examines how Dominion Energy transformed their security posture through a comprehensive implementation of the Dragos Platform for internal network security monitoring. What distinguishes Dominion’s approach is their fundamental recognition that “being compliant doesn’t equal being cyber secure.”
Related Resources
Webinar
Tim Conway (SANS) & Robert M. Lee (Dragos) share how to approach INSM for CIP-015—covering planning, implementation, compliance prep, and what effective INSM looks like in practice
FAQ

Begin with a comprehensive industrial cyber risk assessment guide that identifies all OT assets, evaluates current security controls, and maps potential threat vectors. The SANS 5 Critical Controls provide an excellent starting framework for prioritizing security investments.

Industrial systems prioritize availability and safety over confidentiality, operate on different protocols, and requires unique strategies outside of “patch immediately.” OT cyber risk management must account for operational impact, safety consequences, and regulatory compliance specific to industrial environments.

Industrial systems prioritize availability and safety over confidentiality, operate on different protocols, and requires unique strategies outside of “patch immediately.” OT cyber risk management must account for operational impact, safety consequences, and regulatory compliance specific to industrial environments.

Insurance providers recognize that robust operational technology security programs significantly reduce claim likelihood and severity. Visibility, threat detection, and preparedness have measurable risk-reduction that can be taken into account when determining coverage, regulatory compliance, and legal considerations.

Industrial-specific threat intelligence helps organizations understand adversary tactics targeting their sector, prioritize vulnerabilities based on active threats, and implement proactive defenses rather than reactive measures.

Choose solutions that have functionality proven to reduce risk. Strong incident response capabilities with insurance industry recognition; real-time OT asset visibility, advanced threat detection specific to industrial protocols, actionable threat intelligence, and risk-based vulnerability management.

Take the next step to protect your ICS environment now with a free demo.