NERC CIP-015-2: EACMS, PACS, SCI Monitoring Explained

Executive summary: This article explains that NERC’s CIP-015-2 proposal expands internal network security monitoring beyond the electronic security perimeter to include EACMS, PACS, and Shared Cyber Infrastructure (SCI), closing a security gap FERC identified where trusted systems outside the ESP can be abused. It describes why these systems are high‑value targets (legitimate connections to ESP, privileged functional authority, reconnaissance value), presents an adversary attack chain (initial compromise, persistence, lateral movement, achieving objectives), and signals a follow-up piece addressing practical implementation and scoping challenges for utilities.