Topic starter
25/10/2026 11:08 am
TL;DR: Boundary systems tied to High and Medium Impact BES Cyber Systems with External Routable Connectivity now sit inside INSM scope, according to Dragos. Utilities have to align monitoring with the access paths that cross IT and OT ownership lines.
Editorial analysis by NHI Mgmt Group, based on content published by Dragos: “FERC Approves NERC CIP-015-2: What It Means for Your INSM Program”.
By the numbers:
- Only 46 percent of environments had adequate network monitoring deployed, according to Dragos OT assessments.
- CIP-015-1 becomes enforceable on October 1, 2028, before CIP-015-2 takes effect a year later.
- October 2029 is 37 months away, giving utilities a limited runway to inventory EACMS and PACS.
Key questions
Q: Why does CIP-015-2 make utility inventory reconciliation a security issue?
A: Because compliance now depends on knowing which IT-managed and OT-adjacent assets participate in the access chain, not just which systems are labeled as BES Cyber Systems.
Q: How should utilities prioritise INSM rollout before the 2029 and 2030 deadlines?
A: Start with the highest-risk control centers and the boundary systems that directly support them, then extend the architecture to distributed medium-impact environments.
Q: What breaks when INSM stops at the ESP and ignores boundary systems?
A: The programme loses sight of the systems where access control, authentication and virtualisation decisions are actually mediated, which creates a blind spot between IT and OT ownership.
Practitioner guidance
- Inventory EACMS, PACS and SCI as compliance assets Reconcile CIP-002 inventories with IT-owned systems and verify which boundary systems participate in access, authentication or virtualisation workflows.
- Map sensor placement to access pathways Design monitoring coverage around remote connectivity, authentication gateways and supporting infrastructure so visibility follows the control path into OT-adjacent systems.
- Engage IT owners before enforcement dates Pull the teams that operate firewalls, access control servers, patch systems and virtualisation platforms into the compliance plan now, before phase deadlines create rework.
Bottom line: CIP-015-2 expands utility monitoring obligations into boundary systems that often sit outside traditional OT visibility.
Glossary terms: Boundary Systems, Internal network security monitoring, External Routable Connectivity, Visibility Debt
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:15 pm
Boundary-system monitoring is now an identity and access governance problem, not just a network telemetry problem. EACMS, PACS and SCI are the systems where access decisions are enforced, relayed or concentrated, so they inherit the same governance risk as privileged credentials and service accounts. If those systems sit outside the organisation's primary identity inventory, the monitoring programme will miss the assets most likely to mediate attacker movement. Practitioners should govern them as privileged access surfaces, not as miscellaneous infrastructure.
A question worth separating out:
Q: When do monitoring and access governance need to be planned together in OT programmes?
A: They need to be planned together whenever privileged administration, remote connectivity or shared infrastructure sits between enterprise IT and operational systems. In those cases, access ownership determines what can be observed, and monitoring coverage determines whether access can be proven and investigated after the fact.
👉 Read our full editorial: CIP-015-2 expands INSM scope across utility boundary systems
This post was modified 7 days ago by NHI Mgmt Group