Why Did FERC Expand Network Monitoring Beyond the Perimeter?
The Federal Energy Regulatory Commission has opened a comment period on an updated critical infrastructure protection standard. The change extends internal network security monitoring to systems previously outside the electronic security perimeter.
The gap Order 907 identified
FERC issued Order No. 907 and its clarification Order No. 907-A directing the electric reliability organization to extend internal network security monitoring beyond the electronic security perimeter. The original CIP-015-1 standard covered monitoring only inside that perimeter. NERC's petition, filed June 18, 2026, argued that attackers could compromise electronic access control or monitoring systems and physical access control systems located outside the perimeter, then use them to reach operational technology inside. The Commission agreed. Order RD26-6-000, issued August 10, 2026, approved the revised standard.
Order 907 closed a blind spot.
What CIP-015-2 adds to the existing rules
The new version requires entities to monitor EACMS and PACS that reside outside the electronic security perimeter but remain part of the CIP-networked environment, closing the gap identified in the Commission's directives and extending coverage to all systems in an entity's CIP-networked environment as directed by Order No. 907 and clarified in Order No. 907-A. The standard also includes an implementation plan, violation risk factors, and violation severity levels
The sources this article was written from
- "Federal Register, 91 FR 64921, October 13, 2026
https://www.federalregister.gov/documents/2026/10/13/2026-20880/commission-information-collection-activities-ferc-725b-comment-request-extension"