DEP Dependency, Concentration and External Reliance Management

The capability owner shall maintain a versioned asset-to-function map that links each Required Function to the InfrastructureSystems and AssetInstances (including redundant and standby units) that implement it, stated separately for each declared operating state. The facility operator shall reconcile the map against the as-built asset register and current configuration at least at the interval set in the capability profile and after every material change, and shall record every asset that cannot be mapped, or every function with no identified implementing asset, as an UNKNOWN Record.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state. Optional: E3, E4, E5. Operating states: NORMAL, MAINTENANCE, DEGRADED.

The capability owner shall maintain an upstream dependency graph for each Required Function that records, for every dependency, the provider, dependency type (electrical, thermal, hydraulic, network, control-system, timing/information, human/procedural, supplier/contractual, geographic, capacity), strength, applicable operating states and owner, following the AIDCF-003 dependency record schema. Tracing shall continue at least to the boundary exit point (for example the utility point of connection, carrier demarcation, facility-water flange, fuel delivery point, cloud or SaaS endpoint) and to the first known shared upstream node beyond it. The dependency owner shall record any trace that cannot be completed as an UNKNOWN Record.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state. Optional: E3, E4, E5. Operating states: NORMAL, MAINTENANCE, EMERGENCY, RECOVERY.

The capability owner shall maintain a downstream consequence analysis that states, for each material InfrastructureSystem and dependency, the Service Outcomes affected by its loss or degradation, the propagation path, and the time-to-impact under declared load (for example UPS autonomy, thermal ride-through of liquid-cooled racks, checkpoint interval loss for training, inference latency tolerance). A competent engineer independent of the author shall review the analysis before approval.

Evidence required: E1 Documentary and declarative; E7 Derived and analytical. Optional: E3, E4, E5. Operating states: NORMAL, MAINTENANCE, DEGRADED.

The recovery owner shall maintain a recovery dependency map for each Required Function covering recovery-only and recovery-critical dependencies (for example generator start batteries and fuel delivery, black-start sequence, BMS/EPMS server and network availability, out-of-band management network, DHCP/PXE and golden images, licence and entitlement servers, identity provider and break-glass credentials, OEM remote support, spares and specialist labour). The recovery owner shall analyse the map for circular dependencies and for recovery dependencies that share a fault domain with the failure they recover from, and shall record each such case with a resolution or an UNKNOWN Record.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state. Optional: E3, E4, E5. Operating states: RECOVERY, EMERGENCY, SHUTDOWN.

The facility owner shall analyse every redundant or diverse supply path that a resilience claim relies on (utility feeds, transformers, UPS paths, generator fuel, facility water, chilled-water plant, heat rejection, carrier circuits, cloud regions) for shared sources and record each pair as INDEPENDENT_OF only where as-built evidence supports independence for the stated hazard. Where a shared source exists, the facility owner shall record a SHARES_DEPENDENCY_WITH relationship, an owner and the residual exposure, and the capability owner shall reflect it in the resilience claim.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state. Optional: E3, E4, E5. Operating states: NORMAL, MAINTENANCE, EMERGENCY.

The control-system owner shall identify, for each redundant infrastructure pair or group, every shared control element (PLCs, BMS/EPMS servers, CDU controllers and their master/lead-lag logic, sequence-of-operation software, cluster managers and schedulers, fabric controllers, storage controllers, firmware and configuration sources, automation and AI agents) and record whether loss, malfunction or unsafe command of that element can affect more than one member of the group. The control-system owner shall either demonstrate independence, implement a safeguard (local autonomous control, fail-safe default, staggered firmware) or record the common controller as a declared common mode with owner.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state. Optional: E3, E4, E5. Operating states: NORMAL, MAINTENANCE, DEGRADED, FAILED.

The facility owner shall maintain route records for every path relied on for diversity (MV/LV cables, busways, fuel lines, chilled and facility water pipes, fibre between buildings and to carrier POPs, inter-hall fabric trunks) and shall identify every point where diverse routes converge or come within the separation distance set in the capability profile. The facility owner shall obtain route evidence from carriers and utilities for external routes, verify internal routes by inspection at least at the profile interval, and record each convergence point as a shared fault domain with owner.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state. Optional: E3, E4, E5. Operating states: NORMAL, MAINTENANCE, EMERGENCY.

The operations manager shall analyse human and organisational dependencies for each Required Function, including authorised persons for HV/LV switching, refrigerant and liquid-cooling work, on-call specialists, OEM field engineers and maintenance contractors, and shall record where the same person, team or contractor is required to restore or operate more than one redundant member, or where response depends on fewer people than the emergency task analysis requires. The operations manager shall implement deputies, cross-authorisation or contractual capacity for each case or record it as a declared concentration with owner.

Evidence required: E1 Documentary and declarative; E7 Derived and analytical. Optional: E3, E4, E5. Operating states: NORMAL, MAINTENANCE, EMERGENCY, RECOVERY.

The facility owner shall maintain, for each utility dependency, the contractual and technical basis of supply: for grid electricity the connection agreement, firm and non-firm capacity, capacity reservation and energisation schedule, curtailment or flexible-connection terms, demand-response obligations, supply-point power quality characteristics and protection interface; for water the supply and discharge permits, contracted volume and restriction triggers; for fuel the supply contracts, priority status and delivery commitments. The facility owner shall reconcile contracted firm capacity against declared demand (including growth commitments from CAP-04) for each operating state and record any shortfall, non-firm reliance or undisclosed term as a Finding or UNKNOWN Record.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state. Optional: E3, E4, E5. Operating states: NORMAL, MAINTENANCE, EMERGENCY, TRANSITION.

The network owner shall maintain a register of every external telecommunications circuit in scope, recording carrier, service type, A/Z ends, building entry, meet-me room and cross-connect identifiers, route diversity evidence, upstream carrier (where a reseller is used), service levels and fault escalation. The network owner shall verify that the circuits relied on for each connectivity outcome and for out-of-band management satisfy the declared diversity (carrier, route, entry, POP) and shall record shared elements and reseller dependencies as Findings or UNKNOWN Records.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state. Optional: E3, E4, E5. Operating states: NORMAL, MAINTENANCE, EMERGENCY, RECOVERY.

The capability owner shall maintain an OEM dependency register that records, for each critical asset class, the OEM and integrator, support entitlement and its expiry, RMA and advance-replacement terms, licence or entitlement mechanisms required for operation (including licence servers and online activation), telemetry or phone-home requirements, field-engineer coverage for the site, proprietary tools or software needed for diagnosis or recovery, and the functions that would be lost or degraded if OEM support were unavailable. The capability owner shall record each operating dependency on OEM-hosted services as an external dependency in the upstream graph (MCF-DEP-002).

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state. Optional: E3, E4, E5. Operating states: NORMAL, MAINTENANCE, RECOVERY.

The capability owner shall maintain a register of every cloud or SaaS service on which an in-scope Required Function, management path or recovery path depends, recording the provider, region/zone, control-plane and data-plane dependencies, authentication path, the effect on each function if the service is unavailable or degraded, and the local fallback mode. The control-system owner shall ensure that no facility safety or continuity function (power, cooling, fire, leak detection and their alarming) requires a cloud or SaaS service to operate, and shall record any exception with accountable acceptance.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state. Optional: E3, E4, E5. Operating states: NORMAL, DEGRADED, EMERGENCY, RECOVERY.

The capability owner shall calculate, for each declared fault domain, the proportion of the Capability Instance's usable capacity (for example accelerators, storage throughput, network bandwidth) that would be lost on its failure, and shall compare it with the concentration limit derived from the Service Outcome impact tolerance (CAP-03). Where a fault domain exceeds the limit, the capability owner shall record it as a CONCENTRATES relationship and either reduce the concentration, provide alternative capacity (RES-03) or obtain risk acceptance from the accountable owner.

Evidence required: E1 Documentary and declarative; E7 Derived and analytical. Optional: E3, E4, E5. Operating states: NORMAL, MAINTENANCE, DEGRADED.

The procurement lead shall maintain a supplier concentration analysis covering critical asset classes and services (accelerators and rack-scale systems, high-speed optics, switch silicon, storage media, transformers, MV/LV switchgear, UPS, generators, CDUs and pumps, chillers, BMS/EPMS platforms, maintenance contractors, specialist labour). For each, the procurement lead shall record whether supply is single-source (one qualified supplier available) or sole-source (only one supplier exists), the qualification time for an alternative, and known sub-tier concentration, and shall agree a treatment with the capability owner.

Evidence required: E1 Documentary and declarative; E7 Derived and analytical. Optional: E3, E4, E5. Operating states: NORMAL, RECOVERY.

The operations manager shall identify knowledge items essential to each Required Function and record their holders, documentation status and accessibility. For each item held by fewer people than the profile minimum or held only by an external party, the operations manager shall implement documentation, cross-training or contractual access (including escrow of control logic and configuration where proprietary) and shall verify transfer by a practical demonstration.

Evidence required: E1 Documentary and declarative; E7 Derived and analytical. Optional: E3, E4, E5. Operating states: NORMAL, EMERGENCY, RECOVERY.

The capability owner shall define a substitution plan for each concentration or single dependency recorded under DEP-02 to DEP-04, stating the substitute, prerequisites (connection points, permits, contracts, qualification), activation authority and time-to-substitute. The capability owner shall validate each plan by test, exercise or documented precedent at the profile interval, and shall record the demonstrated time-to-substitute against tolerance.

Evidence required: E2 Configuration and technical state; E3 Operational and observational; E4 Validation and test. Optional: E5, E6, E7. Operating states: DEGRADED, EMERGENCY, RECOVERY.

The assurance lead shall define the assessment boundary for each Capability Instance by reference to the dependency graph (DEP-01), listing included systems, external dependencies crossing the boundary (with boundary interface, provider and evidence obtained), and exclusions with rationale and approver. The assurance lead shall reconcile the boundary with the asset-to-function map and upstream graph before fieldwork and after any material change, and shall treat any material dependency found outside the boundary and not recorded as a boundary defect.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state. Optional: E3, E4, E5. Operating states: NORMAL, MAINTENANCE, EMERGENCY, RECOVERY.

The capability owner shall maintain, for each provider interface, a demarcation record identifying the physical or logical demarcation point (for example HV metering point, tenant breaker in provider switchboard, facility-water flange or CDU primary connection, meet-me room patch panel, cloud API boundary) and a shared-responsibility record conforming to AIDCF-003 (IOT-REQ-051) for each function across lifecycle stages and operating states, including who may operate, who responds to alarms, who approves changes and who holds evidence. The capability owner shall obtain the provider's acceptance of each record and shall treat any function without a responsible and an accountable party as a responsibility gap.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state. Optional: E3, E4, E5. Operating states: NORMAL, MAINTENANCE, EMERGENCY, RECOVERY.

The platform or facility operator shall define for each shared resource (power path and UPS capacity, cooling loop and CDU capacity, coolant chemistry, fabric and storage, management plane) the per-tenant allocation, the enforcement mechanism (for example breaker sizing, power capping, flow limiting, QoS, quota) and the tenant obligations (load-step limits, coolant compatibility, change notification). The operator shall monitor tenant consumption against allocation and record exceedances as incidents.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state. Optional: E3, E4, E5. Operating states: NORMAL, MAINTENANCE, DEGRADED.

The capability owner shall instrument each material boundary interface so that the agreed interface properties (per AIDCF-013 interface contracts) are measured at or near the demarcation point, shall set alarm thresholds for deviation, and shall route deviations to the responsible party under MCF-DEP-018 with escalation timelines. The capability owner shall review deviations and their resolution at the interval set in the capability profile.

Evidence required: E2 Configuration and technical state; E3 Operational and observational. Optional: E4, E5, E6. Operating states: NORMAL, MAINTENANCE, DEGRADED.

The operations manager shall define health indicators for each material dependency (for example utility voltage events and frequency deviations, fuel stock and delivery status, facility water pressure and quality, carrier circuit errors and availability, cloud/SaaS service status, OEM case backlog and RMA turnaround, spares stock against minimum) with thresholds and alarm routing into the NOC/BMS, and shall review indicator trends at the profile interval.

Evidence required: E2 Configuration and technical state; E3 Operational and observational. Optional: E4, E5, E6. Operating states: NORMAL, DEGRADED, MAINTENANCE.

The supplier manager shall measure each material provider's performance against contracted service levels (availability, response and restore times, RMA turnaround, notification timeliness, RCA quality) from owner-side records, review it with the provider at the profile interval, and escalate persistent or material shortfall to the capability owner for treatment.

Evidence required: E2 Configuration and technical state; E3 Operational and observational. Optional: E4, E5, E6. Operating states: NORMAL, DEGRADED.

The dependency owner shall operate a change-detection process that combines internal change records (OPS-05), provider notifications, contract events and technical discovery (for example route and configuration diffs) to identify changes to material dependencies, and shall update the dependency graph and raise reassessment triggers within the time set in the capability profile.

Evidence required: E2 Configuration and technical state; E3 Operational and observational. Optional: E4, E5, E6. Operating states: NORMAL, TRANSITION.

The dependency owner shall revalidate every material dependency record at the interval set in the capability profile by obtaining current evidence (walk-down, configuration export, provider statement or contract), shall mark records not revalidated within the interval as STALE, and shall treat stale records as UNKNOWN for assessment purposes.

Evidence required: E2 Configuration and technical state; E3 Operational and observational. Optional: E4, E5, E6. Operating states: NORMAL.