Ukraine Power Grid Attack: 10 Years of OT Lessons | Dragos
Summary: NERC's proposed CIP-015-2 standard, which has passed only an initial industry ballot and may still be refined, would extend Internal Network Security Monitoring beyond the Electronic Security Perimeter to cover EACMS, PACS, and Shared Cyber Infrastructure. The standard requires utilities to collect east-west network activity and detect anomalous behavior in those systems, and any detection that triggers CIP-008 incident response brings a three-calendar-year evidence retention requirement.
What's compelling: Shared Cyber Infrastructure is a new classification from the still-pending Project 2016-02, so many utilities may not have those systems in their current asset inventories at all - meaning the scoping work starts from an incomplete map. And once a detection escalates to CIP-008, the evidence clock runs for three calendar years.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026