Run NERC CIP-015 Internal Network Security Monitoring Review — Free

Inspection Scope and Review Details

Review period and asset scope documented

Record the inspection period, sites, and BES Cyber Systems included in the review.

System impact level confirmed critical (required)

Confirm the scope includes high impact and/or medium impact BES Cyber Systems.

Applicable procedure or SOP referenced

Identify the governing monitoring, review, and escalation procedure used for this inspection.

Inspector qualified for cybersecurity compliance review critical (required)

Confirm the inspector is authorized and trained to perform the review.

Yes No N/A

Monitoring Coverage and Data Collection

Internal network monitoring sensors or controls deployed on required segments critical (required)

Verify monitoring coverage exists on in-scope internal communication paths supporting BES Cyber Systems.

Yes No N/A

Monitoring data is being collected continuously or at the required interval critical (required)

Confirm monitoring data collection is active and aligned to the documented review cadence.

Yes No N/A

Time synchronization verified across monitored systems critical (required)

Confirm logs and monitoring sources use consistent time settings to support event correlation and review.

Yes No N/A

Monitoring sources and data feeds are complete critical (required)

Verify there are no known gaps in telemetry, log forwarding, or sensor health affecting review completeness.

Yes No N/A

Data quality issues identified

Select any observed issues affecting monitoring data quality.

Note (optional)

Review of Alerts and Anomalous Activity

Alerts reviewed for the required period critical (required)

Confirm alerts and monitoring events were reviewed for the full inspection period.

Yes No N/A

Anomalous activity investigated and dispositioned critical (required)

Verify anomalous events were investigated, documented, and closed or escalated appropriately.

Yes No N/A

Unauthorized communication paths or unusual internal connections detected critical (required)

Check for unexpected internal connections, lateral movement indicators, or policy violations.

Yes No N/A

Alert triage timestamps captured

Record when the latest sample alert was detected and when it was reviewed.

Observed event severity

Classify the most significant observed event during the review.

Evidence of repeated or unresolved anomalies critical (required)

Determine whether the same anomalous condition has recurred without effective remediation.

Yes No N/A

Retention, Storage, and Access Controls

Monitoring records retained for the required retention period critical (required)

Verify monitoring data, alerts, and review records are retained per the applicable retention requirement and procedure.

Yes No N/A

Retention location is secure and access-controlled critical (required)

Confirm stored monitoring records are protected from unauthorized access, alteration, or deletion.

Yes No N/A

Backup or archive copies available

Verify backup or archive copies exist for the monitoring records reviewed.

Yes No N/A

Records retrieval time

Enter the approximate time required to retrieve a sampled monitoring record.

Retention or access control deficiencies observed

Select any deficiencies observed in retention, storage, or access control.

Note (optional)

Response, Escalation, and Corrective Action

Escalation path used for significant findings critical (required)

Confirm significant findings were escalated to the appropriate cybersecurity, operations, or compliance owner.

Yes No N/A

Corrective action owner assigned

Identify the person or team responsible for remediation of any deficiency or non-conformance.

Corrective action due date

Record the target completion date and time for remediation.

Open findings count critical (required)

Enter the number of open deficiencies or non-conformances identified during the review.

Follow-up inspection required

Indicate whether a follow-up review is needed after corrective actions are completed.

Yes No N/A

Inspector Sign-Off

Overall inspection result critical (required)

Select the final result of the inspection.

Inspector comments

Summarize key observations, deficiencies, and any compensating controls.

Inspector signature critical (required)

Inspector attestation for the completed review.

Get your results

Enter your email — we'll send you a PDF of your filled-out template, plus the occasional MangoScoop newsletter (templates, workflow tips, product updates). Unsubscribe anytime — link is in every email.

Email (required)

Your name (optional)

Run: NERC CIP-015 Internal Network Security Monitoring Review

Inspection Scope and Review Details

Monitoring Coverage and Data Collection

Review of Alerts and Anomalous Activity

Retention, Storage, and Access Controls

Response, Escalation, and Corrective Action

Inspector Sign-Off

Get your results