Upload-only transformer assessment and a cloud-connected substation gateway introduce different access paths and responsibilities. Establish what leaves the site, what can return, and who can change either end before evaluating security assurances. Laboratory files contain valuable asset information even when the software has no operational connection.
Use the questions below as a technical buying brief for your security and asset teams. They are proposed due-diligence tests, not an assertion that a particular supplier holds a certification or meets a regulatory obligation.
Draw the Boundary Before Discussing Controls
Ask the supplier to draw the actual deployment: laboratory, user workstation, cloud service, storage, support access and any interfaces to historians or gateways. Mark each connection's direction, authentication method, data content and owner. Identify whether the service can write configuration or commands anywhere.
For an upload-only assessment, demonstrate that no substation credentials are requested or stored. For a connected installation, have the owner's OT security team review network paths and remote access. The broader transformer monitoring workflow should make these deployment differences explicit.
A gateway that initiates an outbound connection can still receive application responses. Ask what those responses can do, including updates and configuration changes; "outbound-only" is not proof of one-way isolation. NIST SP 800-82 Rev. 3 distinguishes outbound firewall policy from a unidirectional gateway in Section 5.2.3.1. Record the actual mechanism rather than inferring it from a cloud diagram.
NIST SP 800-82 Rev. 3, published in 2023, addresses OT security with its reliability and safety constraints. As of 30 September 2026, NIST also lists Revision 4 as a draft dated 21 September 2026. A draft should not be presented as a final baseline. NIST guidance; NIST publication status.
Record the agreed boundary in the pilot scope. If the supplier later adds an integration, reopen that review rather than assuming the original approval covers it.
Ask for Demonstrations That Match Transformer Data
Asset serial numbers, site names, condition reports and outage notes may reveal sensitive operational information. Even a simple health index report can expose the owner's maintenance priorities. Classify the intended dataset before sharing it.
| Question for the supplier | Concrete evidence to request | Why it matters here |
|---|---|---|
| Can one customer reach another's records? | Authorized tenant-isolation test results | Fleets from different owners may share infrastructure |
| Who can export or alter an assessment? | Role demonstration using test accounts | A contractor's access should match its assignment |
| How is support access approved? | Time-limited access procedure and audit example | Troubleshooting may expose reports and site identities |
| What happens when a user leaves? | Revoke a test user and check active sessions | Shared engineering accounts weaken accountability |
| Can evidence be restored? | Dated recovery test and recovered sample package | A dashboard alone is insufficient after data loss |
| Can customers leave cleanly? | Export and deletion procedure with retention limits | Historical reports must remain usable after contract end |
Ask where production data, backups and support logs reside. Clarify whether uploaded reports or model inputs can be used for training and how that permission is controlled. Avoid treating a hosting-region label as the answer to every data-handling question.
For cloud user and administrator accounts, request a demonstration of multifactor authentication, recovery procedures and role restrictions. Include service accounts and API credentials in the access review: removing a person's login need not revoke every token they created. Ask who controls encryption keys and which roles can read decrypted records, rather than accepting "encrypted" as a complete access-control answer.
If an LLM processes reports, extend the drawing to its provider, retrieval index, embeddings, caches and execution traces. Ask which retain source text or derived information, which users can retrieve it, and how deletion is verified. A no-training promise does not answer retention, access or disclosure questions. Include retrieved attachments in the threat model: OWASP's prompt-injection guidance explains why they cannot be treated as trusted instructions.
For vulnerability management, ask who receives reports, how fixes are prioritized, how customers are informed, and what happens at end of support. IEC 62443-4-1:2018 addresses secure product-development processes in the industrial automation context. Its public scope concerns developers and maintainers, not integrators or users. A supplier's claim of alignment does not establish either certification or the security of your deployed configuration.
Run a Short Incident Exercise
In a hypothetical pilot, an external laboratory contractor uploads results for Site West. The contractor's account is later suspected of compromise. Before using real records, rehearse the response with synthetic files and authorized test accounts.
In the agreed exercise, disable the test account and verify revocation of its active sessions and associated credentials. Check uploads, downloads and exports, not just the next login. Retain the exercise logs and affected record versions under the incident team's evidence procedure; do not erase them during cleanup. Next, reconstruct the records accessed or changed in the test window, explicitly recording any gaps in logging. Ask the supplier to distinguish original observations from later corrections and identify assessments that depend on the changed records.
After preserving the evidence, restore a known-good test dataset in an isolated recovery environment. Confirm that asset identities, qualifiers, sample dates and report versions survive. A successful file restore that loses the relationship between a report and its inputs does not restore the engineering evidence. Reconcile legitimate changes since the backup and record any remaining data loss before accepting the recovery.
Finally, exercise communications: who contacts the asset owner, who determines whether issued reports need withdrawal, and who authorizes renewed access? Measure the exercise against the response and recovery objectives agreed for this service. Do not invent a universal transformer-cloud recovery time.
These tests concern accounts and data in an approved environment. They do not require scanning a live substation or testing production protection equipment.
Turn Answers Into Contract Evidence
Keep a short unresolved-issues register. Assign each issue to the supplier, the asset owner or a shared responsibility, with an acceptance record. A vague promise to be secure should become an observable behaviour or a documented limitation.
Confirm which safeguards survive contract termination and which depend on a paid service tier. Include the cost and format of export, the treatment of backups, and the notice period for material service changes in the procurement discussion.
A questionnaire cannot establish that a system is secure in every deployment. It can expose a mismatch between the proposed workflow and the evidence supplied. Start with the data-flow drawing, then involve the people responsible for your actual IT and OT environment.
Talk to an engineer about the evidence and deployment questions in your assessment workflow.
Sources and Scope
- NIST SP 800-82 Rev. 3: targeted reading of network boundaries and logging (Sections 5.2.3.1-2), identity and access (6.2.1), and response/recovery (6.4-6.5). Publication register checked for final/draft status; Revision 4's draft text was not reviewed.
- IEC 62443-4-1:2018: edition and development-lifecycle scope verified; full-text requirements and supplier certification not assessed.
- OWASP LLM01:2025: untrusted-content risks where an LLM is part of the service.
Evidence checked through 30 September 2026. The questionnaire and incident exercise are original buyer-side proposals, not an executed penetration test, a supplier assessment or a finding about Ronin AI.
Cover photograph: Physical server racks with mounted equipment and network cables. Photo: Abigor / Wikimedia Commons, CC BY-SA 3.0. Commons download, resized where applicable; no editorial retouching. Illustrative photograph, not a Seetalabs customer case or evidence of the results discussed.
