CIP-015-2: what expanded INSM scope means for utilities

TL;DR: FERC’s approval of NERC CIP-015-2 expands internal network security monitoring beyond the ESP to EACMS, PACS and SCI tied to High and Medium Impact BES Cyber Systems with External Routable Connectivity, according to Dragos, forcing utilities to monitor boundary systems that often sit in IT-owned environments. Monitoring scope now has to match the places adversaries actually move between IT and OT.

Editorial analysis by NHI Mgmt Group, based on content published by Dragos: “FERC Approves NERC CIP-015-2: What It Means for Your INSM Program”.

By the numbers:

• Only 46 percent of environments had adequate network monitoring deployed, according to Dragos OT assessments.
• CIP-015-1 becomes enforceable on October 1, 2028, before CIP-015-2 takes effect a year later.
• October 2029 is 37 months away, giving utilities a limited runway to inventory EACMS and PACS.

Key questions

Q: What breaks when INSM stops at the ESP and ignores boundary systems?

A: The programme loses sight of the systems where access control, authentication and virtualisation decisions are actually mediated, which creates a blind spot between IT and OT ownership.

Q: Why does CIP-015-2 make utility inventory reconciliation a security issue?

A: Because compliance now depends on knowing which IT-managed and OT-adjacent assets participate in the access chain, not just which systems are labeled as BES Cyber Systems.

Q: How should utilities prioritise INSM rollout before the 2029 and 2030 deadlines?

A: Start with the highest-risk control centers and the boundary systems that directly support them, then extend the architecture to distributed medium-impact environments.

Practitioner guidance

• Inventory EACMS, PACS and SCI as compliance assets Reconcile CIP-002 inventories with IT-owned systems and verify which boundary systems participate in access, authentication or virtualisation workflows.
• Map sensor placement to access pathways Design monitoring coverage around remote connectivity, authentication gateways and supporting infrastructure so visibility follows the control path into OT-adjacent systems.
• Engage IT owners before enforcement dates Pull the teams that operate firewalls, access control servers, patch systems and virtualisation platforms into the compliance plan now, before phase deadlines create rework.

Bottom line: CIP-015-2 expands utility monitoring obligations into boundary systems that often sit outside traditional OT visibility.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →