TL;DR: FERC’s approval of NERC CIP-015-2 expands internal network security monitoring beyond the ESP to EACMS, PACS and SCI tied to High and Medium Impact BES Cyber Systems with External Routable Connectivity, according to Dragos, forcing utilities to monitor boundary systems that often sit in IT-owned environments. Monitoring scope now has to match the places adversaries actually move between IT and OT.
At a glance
What this is: This is an analysis of FERC-approved NERC CIP-015-2 and its expansion of internal network security monitoring into EACMS, PACS and SCI environments.
Why it matters: It matters because utility IAM, PAM and monitoring teams now have to govern visibility and access at IT-OT boundary systems, not only within the ESP.
By the numbers:
- Only 46 percent of environments had adequate network monitoring deployed, according to Dragos OT assessments.
- CIP-015-1 becomes enforceable on October 1, 2028, before CIP-015-2 takes effect a year later.
- October 2029 is 37 months away, giving utilities a limited runway to inventory EACMS and PACS.
Context
INSM is the practice of watching internal network traffic for signs that an attacker has already crossed the perimeter and is operating inside a trusted zone. For electric utilities, the governance problem is not just where monitoring exists, but which systems are formally in scope and who owns them across OT and IT. This article focuses on the compliance and architecture gap CIP-015-2 creates around boundary systems, not on a product implementation story.
CIP-015-2 extends monitoring expectations into EACMS, PACS and SCI because adversary activity often starts in adjacent IT-controlled systems before moving toward operational environments. That matters for identity governance too, because these systems frequently rely on privileged service access, shared administration and inconsistent inventory practices across teams.
Key questions
Q: What breaks when INSM stops at the ESP and ignores boundary systems?
A: The programme loses sight of the systems where access control, authentication and virtualisation decisions are actually mediated, which creates a blind spot between IT and OT ownership. That blind spot undermines detection, scoping evidence and audit readiness because an attacker can move through boundary systems without triggering the monitoring model the standard assumes.
Q: Why does CIP-015-2 make utility inventory reconciliation a security issue?
A: Because compliance now depends on knowing which IT-managed and OT-adjacent assets participate in the access chain, not just which systems are labeled as BES Cyber Systems. If inventories are split across teams or tools, the organisation cannot prove monitoring scope, and it may miss the systems most likely to mediate adversary movement.
Q: How should utilities prioritise INSM rollout before the 2029 and 2030 deadlines?
A: Start with the highest-risk control centers and the boundary systems that directly support them, then extend the architecture to distributed medium-impact environments. The practical priority is not just buying sensors, but proving that the monitoring design can expand across ownership boundaries, protocols and site types without redesign.
Q: When do monitoring and access governance need to be planned together in OT programmes?
A: They need to be planned together whenever privileged administration, remote connectivity or shared infrastructure sits between enterprise IT and operational systems. In those cases, access ownership determines what can be observed, and monitoring coverage determines whether access can be proven and investigated after the fact.
Technical breakdown
How CIP-015-2 changes internal network security monitoring scope
CIP-015-2 changes INSM from a boundary-only control into a broader visibility requirement across systems that mediate access between enterprise and operational environments. EACMS and PACS are important because they sit in the control path for remote connectivity, authentication and physical or logical access enforcement. SCI matters because virtualisation and shared storage can concentrate impact and hide lateral movement if monitoring stops at traditional OT network edges. The operational effect is that sensor placement, retention and analysis have to follow the control plane as well as the process network. Practical implication: design monitoring coverage around access pathways, not only network zones. See the Privileged Access Management Guide.
Practical implication: Place sensors where control and identity decisions are made, not only where traffic crosses the ESP.
Why boundary systems create a governance blind spot for utilities
Boundary systems are often owned by IT teams, maintained outside OT tooling and documented in separate inventories, which makes them easy to omit from compliance scoping. That is a governance problem as much as a technical one, because a system can be operationally critical even if it is not classed as a BES Cyber System in the oldest inventory. When monitoring obligations expand, the organisation must reconcile asset ownership, network diagrams and access responsibility across departments. Practical implication: treat inventory reconciliation as part of INSM design, not as a separate paperwork task. Read the Ultimate Guide to NHIs: Key Challenges and Risks.
Practical implication: Reconcile IT and OT inventories before sensor design so monitoring scope matches operational ownership.
How the new timeline drives phased deployment decisions
The phased enforcement schedule creates a sequencing problem. Control Centers and backup Control Centers come first, then EACMS, PACS and SCI associated with Medium Impact systems, with broader coverage later. That sequence reflects operational risk, but it also means utilities must avoid building a narrow architecture that cannot extend to distributed sites or IT-managed environments later. A monitoring design that works only inside a single enclave will create rework when the later phases arrive. Practical implication: choose collection and evaluation tooling that can expand across sites, protocols and ownership boundaries without redesign.
Practical implication: Select a monitoring architecture that scales from control centers to distributed assets without a second implementation cycle.
Threat narrative
Attacker objective: The objective is to gain enough internal visibility and pathway access to support future disruption of utility operations without being detected early.
- Entry occurs when adversaries move through adjacent IT-side systems or external routable connectivity rather than attacking the control network directly.
- Credential access and reconnaissance target authentication gateways, access control servers and supporting infrastructure to learn how the environment is segmented and managed.
- Escalation follows when an attacker uses that boundary visibility to map control loops, operational configuration and pathways toward OT systems.
- Impact is created when the organisation lacks internal visibility into those movements and cannot connect the activity to response before disruption is possible.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
- Meta AI Instagram Account Takeover: 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Boundary-system monitoring is now an identity and access governance problem, not just a network telemetry problem. EACMS, PACS and SCI are the systems where access decisions are enforced, relayed or concentrated, so they inherit the same governance risk as privileged credentials and service accounts. If those systems sit outside the organisation's primary identity inventory, the monitoring programme will miss the assets most likely to mediate attacker movement. Practitioners should govern them as privileged access surfaces, not as miscellaneous infrastructure.
INSM scope expansion exposes a familiar failure mode: the organisation knows the control zone but not the control plane. The article shows that many utilities have monitored the ESP while leaving boundary systems in separate inventories, separate ownership models or separate tooling. That is exactly where privileged access management becomes operationally relevant, because access paths and monitoring scope have to be aligned before compliance can be credible. Practitioners should reconcile access ownership and monitoring ownership together.
The real compliance gap is visibility debt. Dragos cites only 46 percent of environments with adequate monitoring, which means the standard is being written against a field reality where most organisations still lack the baseline capability. In that environment, regulatory deadlines do not simply add work; they expose the difference between theoretical monitoring and evidence-grade monitoring. Practitioners should assume audit pressure will fall first on scoping, inventory and detection evidence.
CIP-015-2 signals that the market is moving toward boundary-aware operational governance. The standard assumes adversaries will traverse IT-managed systems to reach OT-adjacent functions, so utilities must stop treating IT and OT monitoring as separate programmes with separate risk models. The relevant programme question is whether the organisation can observe the whole access chain, not just the final control network. Practitioners should align monitoring, IAM and asset governance around that access chain.
What this signals
Boundary visibility debt: utilities now have to treat unmonitored EACMS, PACS and SCI as a governance deficiency, not a tooling gap. The standard's phased rollout will force programmes to prove that they can see across IT-owned and OT-adjacent systems before they can claim compliance.
The practical signal for IAM and PAM teams is that enforcement is moving toward access-path governance. If a boundary system can change authentication, routing or physical access decisions, it belongs in the same control conversation as the systems it protects.
For practitioners
- Inventory EACMS, PACS and SCI as compliance assets Reconcile CIP-002 inventories with IT-owned systems and verify which boundary systems participate in access, authentication or virtualisation workflows.
- Map sensor placement to access pathways Design monitoring coverage around remote connectivity, authentication gateways and supporting infrastructure so visibility follows the control path into OT-adjacent systems.
- Engage IT owners before enforcement dates Pull the teams that operate firewalls, access control servers, patch systems and virtualisation platforms into the compliance plan now, before phase deadlines create rework.
- Baseline monitoring evidence against the 46 percent gap Use current detection coverage and retention capability to identify where the programme lacks the ability to collect, evaluate and respond to internal activity. See the NERC CIP Guide.
Key takeaways
- CIP-015-2 expands utility monitoring obligations into boundary systems that often sit outside traditional OT visibility.
- The article pairs this scope change with evidence that only 46 percent of environments currently have adequate network monitoring.
- Utilities that reconcile inventories and align monitoring with access pathways will be better positioned for the phased enforcement dates.
Related NHI Mgmt Group resources: Privileged Access Management Guide · Ultimate Guide to NHIs: Key Challenges and Risks · NERC CIP Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0007;TA0006;TA0008 — Discovery; Credential Access; Lateral Movement | The article centers on adversary reconnaissance and movement through boundary systems. |
| Recommendation — Map boundary-system monitoring to discovery, credential access and lateral movement techniques in your detection content. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and system monitoring | CIP-015-2 is fundamentally about continuous internal monitoring coverage. |
| Recommendation — Use DE.CM-01 to verify that monitoring covers internal traffic and produces actionable evidence. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | The compliance case depends on collecting and retaining evidence from internal monitoring. |
| Recommendation — Apply CIS-8 to ensure boundary-system events are collected, retained and reviewable. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Utilities need reviewable monitoring data to detect internal adversary activity and prove compliance. |
| CA-7 — Continuous Monitoring | The article is about establishing and sustaining continuous monitoring across changing asset scopes. | |
| Recommendation — Use AU-6 to review internal monitoring output for suspicious activity and compliance evidence. Apply CA-7 to maintain continuous monitoring across EACMS, PACS and SCI as scope expands. | ||
Key terms
- Internal network security monitoring: Internal network security monitoring is the practice of observing traffic and activity inside trusted environments to detect anomalies, evidence misuse, and support investigations. In OT settings, it is most useful when paired with access controls that reduce exposure before suspicious activity can spread.
- External Routable Connectivity: External Routable Connectivity describes an environment where systems can be reached through routable paths from outside a restricted zone. In operational settings, it raises the importance of segmentation, access control and monitoring because attackers can move through those paths into adjacent systems if the organisation has not bound them to strict governance.
- Boundary Systems: Boundary systems are the technologies that sit between enterprise IT and operational environments, such as authentication gateways, access control servers and supporting infrastructure. They are security-relevant because they often decide, relay or concentrate access, which means failures in inventory or monitoring there can hide attacker movement across domains.
- Visibility Debt: Visibility debt is the accumulated gap between what an organisation thinks it can see and what it can actually govern. In identity and data security, it grows when cloud resources, non-human identities, and data locations outpace discovery, making remediation slower and less accurate.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps practitioners connect identity controls to the broader security and compliance programmes their environments depend on.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org