Cybersecurity contract clause review that checks every OT vendor redline against your CIP-013 contract language
Every OT contract signed with its cyber clauses, and redlines back the same day.
See one case, screen by screen ↓Every purchase of operational technology — substation RTUs, protection relays, treatment-works PLCs, SCADA software, a vendor's remote support — needs security terms in the contract: how fast the vendor tells you about an incident, how its people get remote access and lose it, how it discloses vulnerabilities, how its software and patches are proven genuine. For an electric utility under NERC CIP-013, these are the six procurement controls of R1.2. Today the procurement officer forwards each draft and each redline to contracts counsel, who reads it by hand against the EEI model language and the utility's own playbook.
Vendors answer on their own paper, often as a clean copy, so a clause deleted in round two leaves no marker. Incident notification is often weakened to “in accordance with Supplier's policies”, which has no time limit. Which fallback a vendor accepted last year sits in someone's inbox, so every negotiation starts again from the preferred wording. And when the CIP-013 auditor asks for proof that each control was sought, the record is an email thread.
Estimated split for one round of a 40–50-page OT supply agreement with a cyber exhibit, in working days, by hand and with the solution.
Six specialist agents read, check and redline every vendor draft; the procurement officer accepts and sends, security and counsel approve fallbacks.
Lumina Utilities is buying RTUs and gateways for 38 substations from Halvorsen Grid Automation AS, with five years of remote support: contract LU-OT-2026-114, $4,860,000, to be signed by 30 Oct to hold the Q1 2027 substation outage windows. On Tue 13 Oct at 07:40, Halvorsen's round-2 redline arrives. Here is what happens next, screen by screen, in the working solution.
Halvorsen sent back 46 pages on its own Supply and Support Agreement. Grace opens Exhibit C — Cybersecurity Requirements with Lumina's cyber clause standard v3.2 beside it: 16 clauses grouped by CIP-013 control, 9 meet, 4 weak, 3 missing. Halvorsen's changes are struck through, Lumina's redline is written in, and each clause has a margin note.
C.2 Incident notification — “Missing · Deleted by Halvorsen in round 2. Annex 4 sets no time limit.”
The contract reader reads the redline — Word with tracked changes, Exhibit C on pp. 31–36, cyber terms also in clauses 14.3 and 18.2 — and compares it with round 1: C.2 deleted; C.4, C.6, C.12 and 18.2 changed. The clause matcher checks the 16 clauses against standard v3.2. The precedent finder searches 212 OT negotiations, the fallback drafter writes 7 redlines, and the approvals router works out who must sign off.
“Fallback drafter · drafted 7 redlines — 3 at the preferred wording, 4 at fallback 1 · none below the line”
Halvorsen replaced the 24-hour notice with “Notification of Security Incidents shall follow Supplier's Global Incident Policy (Annex 4)”. The ladder shows the preferred 24-hour wording, accepted in 128 of 210 negotiations, and recommends fallback 1: written notice within 72 hours, an early alert by telephone within 24 hours when products in Lumina's operational systems may be affected. Halvorsen signed that wording in March 2024 for the meter data gateways, and 7 of the 9 vendors who refused 24 hours accepted it.
Never sign: “Notice under the vendor's own policy, or no time limit” — blocks signature, CISO exception only.
In C.12 Halvorsen added one sentence: “Supplier may maintain a persistent encrypted support connection to the Products for remote diagnostics.” The matcher marks it weak at 0.97 confidence. Fallback 1 deletes the sentence: any support connection ends at Lumina's jump host, is off by default, is switched on by the Lumina control room for each session, with multi-factor authentication, and is recorded. 5 of 6 automation vendors accepted it.
Halvorsen asks for the connection to meet its 4-hour response time; a jump host switched on by the control room meets that time.
The reader also finds clause 18.2 in the main agreement: total liability capped at the fees of the last 12 months, $312,000, including for any security incident. Halvorsen refused an uncapped clause in 2024 but signed a separate cap equal to the contract price, so the drafter proposes fallback 1: security-incident costs, including response, notification and restoration, under their own cap of $4,860,000.
“Liability is counsel's call at every rung: Daniel Reyes approves.”
Grace accepts the seven proposals — 3 at the preferred wording, which are hers to accept, and 4 at fallback 1. The approvals router asks the right people: Hannah Brandt, supply chain security, approves the fallbacks for C.2, C.6 and C.12 at 10:02, 10:09 and 10:15; Daniel Reyes, contracts counsel, approves the 18.2 liability cap at 10:19. Send stays locked until every approval is in.
C.2 · “Approved · Hannah 10:02”
Grace sends round 3 to Mats Lindgren at Halvorsen, copying Daniel and Hannah, with Exhibit C in tracked changes, clause notes for the seven clauses and the 18.2 redline. Her cover note offers the 72-hour notice with the 24-hour early alert Halvorsen agreed in 2024, the same jump-host arrangement, and explains that the software bill of materials and operating-system clauses are new in Lumina's standard since round 1.
“Round 3 sent to Mats Lindgren at 10:24 · same day as the redline · logged as CIP-013 evidence”
The negotiation log shows the timeline — round 1 on standard v3.1 on 22 Sep, standard v3.2 on 1 Oct, Halvorsen's round 2 on 13 Oct, round 3 sent at 10:24, sign by 30 Oct — and a clause-by-round grid: C.2 from “24 h written notice” to “Deleted · Global Incident Policy” to fallback 1, sent. Round 3 went out with 4 approvals in 38 minutes.
“This log is also the CIP-013 record that each control was sought.”
Across 16 in-scope contracts, the six R1.2 controls are obtained in 57 places, at an approved fallback in 13, being sought in 25, and excepted once — Tessaro's remote access, where the CISO had remote access disabled at the plant instead. The Halvorsen row now reads “Round 3 sent” on five controls, each cell opening its evidence record with the round, the wording and who decided.
Supply chain cyber security risk management plan v5 · approved by Omar Siddiqui, CISO, 4 Aug 2026
Twelve OT contracts worth $19,323,000 are in negotiation, seven with a required clause missing. While the approvals were coming in, Northline Pump Controls' draft for 64 pumping-station telemetry outstations arrived at 10:12; by 10:31 it is checked — 10 meet, 4 weak, 2 missing — with proposals ready for Grace.
“0.4 days · median time to send a redline back · target 1 day”
The same redline, seen by the four people who decide it — what their week looked like, and what it looks like now.
Six specialist agents read, check and redline every vendor draft; the procurement officer accepts and sends, security and counsel approve fallbacks.
Reads every vendor draft and redline — Word with tracked changes, PDF or scan — splits it into clauses, finds cyber terms outside the exhibit, in data protection, liability and support clauses, and compares each round with the last.
Checks each of the 16 clauses of the standard against the draft — meets, weak (present but below the preferred wording) or missing — quoting the sentence it relied on.
Searches 212 past OT negotiations for what this vendor and others accepted on each clause, and keeps the acceptance rates on the ladder current.
Drafts the redline from the approved ladder and recommends the highest rung the precedents say this vendor will sign, with its reasons and sources.
Works out who must approve each accepted rung, asks them, and holds the send until they have.
Records every round, vendor position, approval and outcome, and writes the CIP-013 evidence record for each control.
Accepts and sends; security and counsel approve. The agents propose; a named person decides.
Ask about any clause, vendor, precedent or CIP-013 control — or say which rung to propose. Nothing goes to a vendor until a person sends it.
Why propose 72 hours and not 24 for Halvorsen?
Halvorsen deleted the 24-hour clause and pointed to its Global Incident Policy, which has no time limit. Halvorsen signed the same fallback with Lumina for the meter data gateways in March 2024; its own clause 14.3 already commits to 72 hours for personal data; and 7 of 9 vendors who refused 24 hours accepted it. The 24-hour early alert keeps OT incidents inside a day. Hannah Brandt approves this rung.
Which clauses still need an approver?
Four of the seven proposals sit below the preferred wording: C.2 incident notification, C.6 vulnerability disclosure and C.12 remote access need Hannah Brandt; 18.2 liability (standard C.16) needs Daniel Reyes. C.4, C.9 and C.11 are at the preferred wording, so they are yours to accept.
Is the gateway operating system supported for the whole term?
No. The gateways run GridOS 4, which leaves standard support on 31 Dec 2027 — two years into a five-year support term ending in 2031. The draft has no clause on it, because C.11 joined the standard on 1 Oct, after round 1. GridOS 5 ships in Q2 2027, so Halvorsen can meet the preferred wording.
Show CIP-013 coverage across our OT contracts
Across 16 in-scope contracts, the six R1.2 controls are obtained in 57 places, at an approved fallback in 13, being sought in 25, and excepted once — Tessaro's remote access, where the CISO had remote access disabled at the plant instead.
13 screens from the working solution, on its sample data. Pick one to see it large.
What is checked, against which standard, who approves each rung of the ladder, and what blocks a signature. Changes are saved as a new version and logged.
| Setting | Default | Choose from |
|---|---|---|
| Purchases in scope | Grid cyber systems, water and wastewater control, OT cloud services, vendor remote support | On or off for each: medium- and high-impact grid cyber systems · water and wastewater control systems · OT services hosted in the cloud · vendor remote support agreements · low-impact assets (off — checked on request only) |
| Clause standard | v3.2 | Lumina Cyber Clause Standard v3.2 · 16 clauses · from 1 Oct 2026; changes are proposed from the playbook as v3.3 |
| Check every draft on arrival | On | On · Off — from the vendor portal, the procurement inbox and the contract system |
| Who approves each rung | Preferred: contract owner · Fallback 1: Hannah Brandt · Fallback 2: Omar Siddiqui + Daniel Reyes | A named approver per rung; liability and indemnity at any rung: Daniel Reyes |
| Below the “never sign” line | Omar Siddiqui | Blocks signature · CISO exception with a mitigation |
| Redline turnaround target | 1 business day | From a vendor draft to Lumina's redline |
| Clause matcher confidence | 0.85 | Below this, contracts counsel reviews the clause |
| Block signature until | On | Every CIP-013 clause meets the standard, sits at an approved rung, or has a CISO exception |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample contracts · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (IBM Cost of a Data Breach 2025, via CyberScoop: $4.83M average energy-sector breach; NERC CIP settlement, 127 violations, $10M, 2019). Context: NERC CIP-013-2 R1.2.1–R1.2.6; EEI Model Procurement Contract Language v4.0 (June 2026). Lumina Utilities, its vendors, contracts and negotiations and the people named on this page are fictional — characters and sample data in the working solution.
It is the check that every OT vendor contract carries the security terms a utility needs — incident notification, response coordination, access revocation, vulnerability disclosure, software integrity and remote access — before it is signed. Cybersecurity Contract Clause Review does that check on every draft and redline against your own clause standard, proposes the redline, and logs every round as CIP-013 evidence.
In the working solution, the standard has 16 clauses grouped by the six CIP-013 R1.2 controls (R1.2.1 to R1.2.6) plus supporting terms such as country of origin, subcontractor flow-down and liability for security incidents. It is aligned to the EEI Model Procurement Contract Language v4.0, and you set your own standard and versions.
For each clause the ladder shows the preferred wording, the fallbacks you have pre-approved and the never-sign line, with how often each rung was accepted in past negotiations and whether this vendor signed it before. Clicking a rung rewrites the redline in the document and changes who must approve it.
Yes. The contract reader compares each round with the last and never treats a clean copy as unchanged. In the sample case it found that Halvorsen had deleted the 24-hour incident notice and pointed to a policy annex with no time limit, and that the liability cap in clause 18.2, outside the cyber exhibit, now included security incidents.
Yes. Water and wastewater control systems — treatment works, pumping stations, desalination — are in scope alongside grid cyber systems, OT services hosted in the cloud and vendor remote support agreements. Each purchase type is a setting.
The negotiation log keeper records every round, vendor position and approval, and writes an evidence record per contract and control: obtained, obtained at a fallback, being sought, or not obtained with a documented CISO exception. The evidence view shows the plan version and its review date, and exports for the auditor.
Yes. The agents read, check and propose; they never approve and never send. The procurement officer accepts and sends, the security lead approves fallbacks, counsel approves liability terms, and nothing below the never-sign line goes out without a CISO exception.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your cyber clause standard and fallback positions, your CIP-013 plan and a sample of past OT contracts and redlines — and it goes live once every quality gate has passed. We will walk you through it on your own contracts first.
Audit binders built continuously, not in a 30-day scramble.
1-min demoThird-Party Cyber Risk ManagementEvery supplier answer checked against its evidence before you sign.
1-min demoOT Patch ManagementEvery OT patch evaluated inside the 35-day window, with a dated plan if it must wait.
1-min demoWe'll run Cybersecurity Contract Clause Review on a sample of your own OT contracts and redlines.