NERC CIP Compliance
Summary: Dragos describes how its platform and services map to NERC CIP requirements, including passive device monitoring with custom asset tagging for EACMS, PACS, and BCS, active collection through an Extended Visibility Agent, and sensor deployment inside and outside the ESP for ingress and egress visibility. The text also covers CIP-010 vulnerability management dashboards, CIP-012 validation of communications between control centers, CIP-013 supply chain commitments documented in a NERC CIP-013 Addendum, and CIP-015 east-west traffic monitoring with RBAC, access controls, and MFA.
Why it matters: The pitch rests on continuous passive monitoring inside trusted zones and detection of external communications not routed through an Electronic Access Point - the gaps NERC CIP auditors probe, and the ones an adversary would use to reach control centers.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026