Third-party cyber risk management that checks every supplier answer against its own evidence before you sign
Every supplier answer checked against its evidence before you sign.
See one case, screen by screen ↓A utility buys RTUs, protection relays, PLCs, smart meters, historians and cloud software from hundreds of suppliers, and NERC CIP-013 holds the utility accountable for the security of what it buys. The supply chain security analyst sends a questionnaire and gets back 140-odd answers with a folder of SOC 2 reports, ISO 27001 and IEC 62443 certificates, policies and an SBOM. Reading 286 pages to find out whether “Yes” means yes takes weeks, so most answers are taken at their word while procurement holds a purchase order.
The gaps are in the supplier's own documents. “MFA enforced” sits next to a remote-access policy that makes MFA optional. “Notify within 24 hours” sits next to an incident plan that says 72. An ISO certificate leaves out the site that writes the firmware, and the SBOM lists an end-of-life library under an answer that says there are none. Found after the contract is signed, the leverage to fix them is gone; found at audit, the CIP-013 evidence does not show the plan was followed. Meanwhile reassessments, certificate expiries and the 15-month plan review keep coming due.
Estimated split for one Tier 1 supplier assessment, in elapsed working days, by hand (about 3–4 weeks elapsed) and with the solution.
Six specialist agents read every answer and every attached page; the Director of Cyber Risk decides and signs.
Lumina Utilities is buying 46 RTU-9 remote terminal units from Kestrel Grid Controls for the Harrow Ridge, Calder Bend, Ashby Cross and Winmoor substations — a $3.84M purchase order, with contract signature on Friday, Oct 17. Kestrel returned 142 answers and 14 documents. Here is what happens next, screen by screen, in the working solution.
Every supplier that needs attention is a row; the 12 control areas are columns, with the CIP-013 R1.2 items under the headers that carry them. Today 12 suppliers need attention and 7 answers are contradicted by the suppliers' own evidence. Kestrel Grid Controls scores 58 of 100, with struck red cells in incident notice, vulnerability notice, remote access & MFA and the SBOM. The rail shows Kestrel's remote access: 13 questions, 10 supported, 1 partly, 2 contradicted.
“Contradicted. Optional is not enforced. MFA depends on the customer asking for it, and nothing shows it was ever turned on for Lumina.”
Vantor Cloud Analytics, which supplies outage analytics as a service, returned its questionnaire this morning: 131 answers and 11 documents, 204 pages. Its row is grey until Tomás presses Check. The run log streams in the rail and the row colours in, cell by cell: Tier 2, because it is hosted analytics with no access to OT, and a score of 79. Its incident plan only partly supports answer 4.1.
“Customers are informed as soon as practicable.” — Partly supported. The plan has no customer notification time.
Tomás clicks the Remote access & MFA column and the heatmap sorts by it, riskiest first. Kestrel and Marrow & Pike Engineering are contradicted: Marrow & Pike answers MFA on all remote access, but its procedure gives each site team one shared token. Corvel SCADA Services and Pellam Battery Systems are partly supported, with MFA only from outside their support jump host.
Brightwater Metering's reply this week fixed its own gap — its Remote access cell turned from amber to green.
On Oct 9 the agents read Kestrel's 142 answers against 286 pages, from 16:40 to 16:51. The answer map shows every answer by control area: 118 supported, 15 partly, 5 contradicted, 4 with no evidence. Answer 7.3 asks whether MFA is enforced for all remote access to customer systems; Kestrel answered “Yes.” Remote Access Policy RA-03 v2.1, §4.2, page 4, says otherwise — and the passage opens on the page itself.
RA-03 v2.1 §4.2: “Multi-factor authentication is recommended and may be enabled at the customer's request.”
The SOC 2 Type II report covers Apr 1, 2025 to Mar 31, 2026, with one exception in change management (CC8.1). The ISO/IEC 27001:2022 certificate's scope is corporate IT and cloud services in Leeds, and leaves out the Varden firmware site. Incident Response Plan IR-01 v5 contradicts answer 4.2: 72 hours from confirmation, not 24. The PSIRT policy contradicts 5.1: coordinated disclosure in 90 days, not 30.
“A certificate counts only for sites and products inside its scope.” — Lumina's evidence rule
The SBOM for RTU-9 firmware 4.2.1 lists 318 components. OpenSSL 1.1.1w has been end of life since Sep 11, 2023, so answer 8.5 — “no end-of-life components” — is contradicted. Four more carry published vulnerabilities: zlib 1.2.11 and libexpat 2.4.1 (critical, 9.8), BusyBox 1.33.1 (high, 8.8) and lighttpd 1.4.59 (medium, 5.9). Kestrel's own advisory KGC-SA-2026-03 says firmware 4.3.0 fixes three of the four and replaces OpenSSL with 3.0.
lighttpd: “Not fixed in 4.3.0 — web interface off by default.”
The follow-up writer drafts 9 questions for Imogen Hale, Kestrel's product security lead: four where nothing was attached (background checks for firmware engineers, quarterly privileged-access reviews, patch testing on a customer-equivalent testbed, an annual continuity test) and five that quote the answer and the page that contradicts it. Tomás edits, removes or sends them through the supplier portal; replies are checked on arrival.
“Agents draft; only Tomás sends. Nothing reaches a supplier without a named sender, and every message is kept on the assessment.”
Tier 1, because the RTUs sit in medium impact BES Cyber Systems with routable connectivity at 4 substations. Remote access & MFA scores 28, incident notification 44, vulnerability disclosure 48. Four conditions go into Schedule 4 of the agreement, each mapped to CIP-013: MFA on every session through Kestrel Connect (R1.2.6), access revoked within 4 hours (R1.2.3), incident notice within 24 hours of detection (R1.2.1), disclosure within 30 days (R1.2.4). A delivery condition adds firmware 4.3.0 before energisation at Harrow Ridge.
Risk scorer: never sets a tier below the tier rule, and never approves.
Tomás has accepted the five contradicted answers and routed the decision. Priyanka sees the supplier, the purchase, the score with its 5 contradicted answers and 4 without evidence, and the decision: approve with 4 conditions plus firmware 4.3.0 before energisation. She confirms the statement and signs as herself.
“I have reviewed the contradicted answers and the conditions, and accept the remaining risk.”
The decision is signed and procurement is released: the conditions are in Schedule 4 of the Kestrel agreement, ahead of signature on Oct 17. The reassessment keeper sets the next reassessment for Jan 2028 and the SOC 2 refresh for Apr 2027, and the decision record exports with every citation.
“Signed by Priyanka Desai, Director of Cyber Risk — “Approve with 4 conditions”. Procurement released.”
The same supplier, seen by the five people who touch its assessment — what their week looked like, and what it looks like now.
Six specialist agents read every answer and every attached page; the Director of Cyber Risk decides and signs.
Reads a supplier's questionnaire in any format — supplier portal, spreadsheet or PDF — and maps each answer to Lumina's 12 control areas and the CIP-013 R1.2 items.
Reads every page of the evidence and tests each answer — supported, partly supported, contradicted or no evidence — quoting the document, section and page.
Matches the SBOM (CycloneDX or SPDX) to published vulnerabilities, known-exploited lists, end-of-life dates and the supplier's own advisories, and reports end-of-life and critical or high findings first.
Sets the tier from what is bought and the score from the verdicts, by area weight, and proposes the decision band.
Drafts one precise question for each answer the evidence does not support, and contract conditions in the security schedule's wording, each tied to its answer and page.
Every day at 06:00, checks each supplier's next due date, certificate and report expiries and new advisories; opens a reassessment 36 days before it is due and reminds the CIP Senior Manager before the plan review.
Signs every Tier 1 decision. The agents propose; a named person decides.
Ask about any supplier, answer or piece of evidence — or say what to change. Every answer points to its page.
Why is Kestrel's MFA answer flagged?
Because Kestrel's own policy makes MFA optional. Kestrel answered “Yes” to 7.3, MFA enforced for all remote access. Its Remote Access Policy RA-03 v2.1 §4.2 says MFA is “recommended and may be enabled at the customer's request”. Optional is not enforced, so the evidence checker marked the answer contradicted. It is now condition C1 for the security schedule.
Who else says MFA but doesn't back it up?
Three more in the Remote access & MFA column. Marrow & Pike Engineering is contradicted: it answers “MFA on all remote access”, but its procedure gives each site team one shared token. Corvel SCADA Services and Pellam Battery Systems are partly supported: MFA only from outside their support jump host. Brightwater's reply this week fixed its own gap.
Draft the contract conditions for Kestrel
Four for the security schedule and one for delivery, each from an answer the evidence contradicts: C1 MFA enforced on every session (7.3), C2 access revoked within 4 hours (7.6), C3 incident notice within 24 hours of detection (4.2), C4 disclosure within 30 days (5.1), and D1 firmware 4.3.0 before energisation (8.5). They are on the decision page, ready for Priyanka.
What is due before the plan review on Oct 22?
Gideon Walsh must approve the supply chain plan by Oct 22 — 15 calendar months after Jul 22, 2025. Before then: the Kestrel decision (contract Oct 17), Brightwater's decision (Oct 21), Halden's IEC 62443-4-1 renewal (Oct 20) and Silvan's SOC 2 bridge letter (Oct 21). 23 reassessments fall due in the next 90 days, 10 of them Tier 1.
13 screens from the working solution, on its sample data. Pick one to see it large.
The weights, the tiers, what counts as evidence, the decision bands and who signs are settings, chosen by the utility.
| Setting | Default | Choose from |
|---|---|---|
| Control area weights | Identity & access 12 %, Remote access & MFA 12 %, Incident notification 10 %, Software integrity 10 % | A slider for each of the 12 control areas; the weights total 100 % |
| Tier 1 | In a BES Cyber System, its access monitoring or physical access control; controls water treatment or pumping; or has remote access to OT | Tier 2 — holds customer or employee data at scale, or connects to the corporate network · Tier 3 — everything else · the risk scorer may raise a tier, never lower one |
| An audit report counts for | 12 months after its period ends | On · Off — with a second switch, on: a bridge letter extends it by up to 3 months |
| A certificate counts only inside its scope | On | On · Off — sites and products outside the scope get no credit |
| “Should” or “recommended” does not support “enforced” | On | On · Off |
| A contradicted answer in remote access, identity or incident notification always needs a condition | On | On · Off |
| Decision bands | 75 and above approve · 55–74 approve with conditions · below 55 remediate first | Kestrel with these weights: 58, approve with conditions |
| Approvers and clocks | Tier 1 — Priyanka Desai, Director of Cyber Risk | Tier 2 — Cyber risk lead · Tier 3 — the analyst · supply chain plan — Gideon Walsh, every 15 months · reassessment opens 36 days before it is due |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample supplier data · “target” = the design goal, measured in the live solution · “estimated” = our estimate of where a Tier 1 assessment's days go, against a 3–4 week baseline by hand · “typical” = published figures (Verizon Data Breach Investigations Report 2025 — third parties involved in 30 % of breaches, up from 15 %; IBM Cost of a Data Breach 2025 — energy-sector average $4.83M, shown as exposure, never as a saving). Regulatory context: NERC CIP-013-2 (R1.2 vendor items; plan review at least every 15 calendar months). Lumina Utilities, its suppliers, people, products and records named on this page are fictional — characters and sample data in the working solution.
Software that assesses the cyber security of the suppliers a utility buys from — OT equipment, IT and cloud services — before purchase and again on a schedule. Third-Party Cyber Risk Management reads each supplier's questionnaire and every page of evidence it attached, flags the answers that evidence does not support, scores the supplier and drafts the follow-ups and contract conditions. The Director of Cyber Risk signs the decision.
The evidence checker searches the supplier's own documents for the passage that proves or disproves each answer, after checking the document's period and scope. It marks each answer supported, partly supported, contradicted or no evidence, and quotes the document, section and page. A policy that says “recommended” does not support an answer that says “enforced”.
Answers are mapped to the CIP-013 R1.2 items — incident notification, coordinated response, ending vendor access, vulnerability disclosure, software integrity and vendor remote access — and each contract condition names the item it addresses. The activity trail records every assessment step and signature, and the calendar tracks the 15-month plan review for the CIP Senior Manager.
Yes. The component scanner matches the SBOM to published vulnerabilities, known-exploited lists, end-of-life dates and the supplier's own advisories. In the sample case it found an end-of-life OpenSSL and four components with published vulnerabilities in RTU firmware 4.2.1, and Kestrel's advisory showing which ones firmware 4.3.0 fixes. It never scans or contacts the supplier's systems.
The cell turns red on the heatmap with the page quoted beside it. The follow-up writer drafts a precise question for the supplier and, where the answer falls in an R1.2 area, a contract condition in the security schedule's wording. A contradicted answer in remote access, identity or incident notification always needs a condition before signature.
Yes. The agents read, check, score and draft, but never send anything to a supplier, never lower a tier and never approve. The analyst accepts or changes each verdict, with a reason for any change, and a Tier 1 decision needs the Director of Cyber Risk's signature before procurement can release the order.
Yes. Control area weights, tier rules, how long an audit report counts, certificate scope, the decision bands, approvers by tier and the reassessment clocks are all settings. Changes are saved as a draft and take effect when the Director of Cyber Risk approves them.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your supplier questionnaire, tier rules, security schedule and a sample of past assessments — and it goes live once every quality gate has passed. We will walk you through it on your own suppliers first.
Audit binders built continuously, not in a 30-day scramble.
1-min demoOT Patch ManagementEvery OT patch evaluated inside the 35-day window, with a dated plan if it must wait.
1-min demoICS Vulnerability ManagementWhich advisories affect our substations? Answered today.
1-min demoWe'll run Third-Party Cyber Risk Management on a sample of your own supplier questionnaires and evidence.