Detection to Due Diligence: Strengthening NERC CIP Compliance
Summary: Dragos describes how its Platform's detections can support NERC CIP compliance, including identifying unauthorized Transient Cyber Assets through new IP addresses, new MAC addresses, RDP connections over non-standard ports, port scanning, and attempted logins against protected OT systems. It also cites brute-force detections triggered by password mismatches between relays, IEDs, or centralized asset management platforms after CIP-mandated password changes, which CIP-007 R5 requires every 15 calendar months for High Impact BCS and certain Medium Impact BCS.
Bottom line: In the cases Dragos describes, the activity was not malicious - personnel accidentally used a corporate laptop instead of an approved TCA - yet it still carried CIP-003 and CIP-010 compliance implications, and password mismatches after mandated changes could go unnoticed without substation visibility.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026