SUP Supply Chain, OEM and Ecosystem Assurance

The procurement lead shall perform and record a capability assessment for each supplier of a critical asset class or service before award and at renewal, covering engineering competence, manufacturing and test capacity (including factory acceptance testing), rack-scale or skid integration capability where applicable, installation and commissioning resources, field-service coverage and response at the site, and references for comparable deployments. A competent engineer shall approve the technical part of the assessment.

Evidence required: E1 Documentary and declarative; E7 Derived and analytical. Optional: E3, E4, E5. Operating states: NORMAL.

The supplier manager shall monitor each critical supplier at the profile interval for financial distress indicators, manufacturing and logistics concentration (single plant or region), allocation or quota exposure (for example accelerator allocations), sanctions and export-control exposure, and business-continuity arrangements, and shall escalate adverse changes to the capability owner with a proposed treatment.

Evidence required: E2 Configuration and technical state; E3 Operational and observational. Optional: E4, E5, E6. Operating states: NORMAL.

The procurement lead shall obtain and evaluate evidence of each critical supplier's quality management system, product security development lifecycle for firmware and control software, product security incident response (PSIRT) and vulnerability disclosure process, and factory test and outgoing quality controls. The procurement lead shall record identified gaps with contract conditions and shall track incoming quality (defects on receipt, early-life failures) for each supplier.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state. Optional: E3, E4, E5. Operating states: NORMAL.

The procurement lead shall obtain, for each critical asset class, disclosure of material sub-tier suppliers and manufacturing locations from first-tier suppliers, record them in the dependency graph, and identify sub-tier sources shared across nominally diverse first-tier suppliers. Where a supplier declines disclosure, the procurement lead shall record an UNKNOWN Record and the capability owner shall decide on treatment.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state. Optional: E3, E4, E5. Operating states: NORMAL, RECOVERY.

The supplier manager shall ensure each critical support or maintenance contract states measurable service levels with units, measurement points, exclusions and escalation, and shall document that each service level is consistent with the time-to-impact and recovery tolerances in DEP-003 and CAP-02. Where contracted levels are inconsistent, the capability owner shall record the gap and its treatment (on-site spares, resident engineers, alternative supplier).

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state. Optional: E3, E4, E5. Operating states: NORMAL, EMERGENCY, RECOVERY.

The supplier manager shall ensure that each critical supplier and provider contract grants rights to the evidence listed in the AIDCF-008 control evidence profiles relevant to the supplied function, within stated timescales and formats, including rights to witness tests and to audit or receive independent assurance reports, and shall record any evidence the supplier will not provide as an UNKNOWN Record against the affected controls.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state. Optional: E3, E4, E5. Operating states: NORMAL.

The supplier manager shall ensure critical supplier and provider contracts define notification obligations and timescales for incidents, security vulnerabilities, field notices and recalls, planned maintenance and changes, and allocation or end-of-life changes, and shall operate a monitored intake (shared mailbox, portal subscription, ticket integration) that routes notifications to the responsible owner. The supplier manager shall test the intake path at the profile interval.

Evidence required: E2 Configuration and technical state; E3 Operational and observational. Optional: E4, E5, E6. Operating states: NORMAL, DEGRADED.

The supplier manager shall ensure each critical contract provides exit and transition rights proportionate to the dependency, including export of configuration and operational data in usable formats, ownership or escrow of control logic and configuration for programmable controllers, perpetual or transition licences for software required to operate installed equipment, option to purchase spares and tools, documentation hand-over, and transition assistance for a stated period. The capability owner shall maintain an exit plan for each sole-source or high-concentration supplier.

Evidence required: E1 Documentary and declarative; E7 Derived and analytical. Optional: E3, E4, E5. Operating states: NORMAL, TRANSITION.

The procurement lead shall maintain an approved source list for each critical component class naming the OEM and authorised distributors, shall configure purchasing controls so that orders for critical classes can be placed only with approved sources, and shall require documented engineering approval and enhanced inspection (MCF-SUP-010) for any exception, such as broker purchase of obsolete parts.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state. Optional: E3, E4, E5. Operating states: NORMAL, RECOVERY.

The receiving and engineering leads shall operate a risk-based incoming inspection for critical component classes, including label, serial and packaging verification against OEM records, physical inspection, and where risk warrants electrical or functional testing (for example protection device trip testing, optics DOM/EEPROM checks, firmware identity checks on boards). Suspect items shall be quarantined, reported to the OEM and, where required, to the relevant authority, and shall not be installed until cleared.

Evidence required: E2 Configuration and technical state; E3 Operational and observational. Optional: E4, E5, E6. Operating states: NORMAL, RECOVERY.

The logistics lead shall require tamper-evident packaging and seals for critical shipments, recorded hand-offs between factory, freight forwarder, carrier and site, secure staging areas with access control, and receipt verification of seals and serials against the advance shipping notice. Breaks in custody or seal anomalies shall be recorded as security events and the affected items quarantined pending inspection.

Evidence required: E2 Configuration and technical state; E3 Operational and observational. Optional: E4, E5, E6. Operating states: NORMAL.

The asset manager shall record serial, part number, hardware revision and firmware version for critical components (accelerators and boards, NICs/DPUs, optics, switch line cards, storage media, breaker trip units, relays, UPS modules, batteries, CDU pumps and controllers) in the asset register linked to location and Required Function, and shall demonstrate at the profile interval, by exercise, that all units affected by a given notice can be identified within the target time.

Evidence required: E2 Configuration and technical state; E3 Operational and observational; E4 Validation and test. Optional: E5, E6, E7. Operating states: NORMAL.

The platform and control-system owners shall obtain releases only from authenticated OEM channels, record for each release its origin, version, hash, release notes and software bill of materials where available, store it in a controlled repository with access control and integrity protection, and deploy only from that repository. Releases for programmable facility controllers shall be held with the same controls as IT firmware.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state. Optional: E3, E4, E5. Operating states: NORMAL, MAINTENANCE, RECOVERY.

The platform and control-system owners shall verify OEM signatures (or, where signing is unavailable, OEM-published hashes obtained over an authenticated channel) before staging any release to the repository and before deployment, shall enable platform secure-boot and firmware-signature enforcement where supported (for example on BMCs, accelerators, NICs/DPUs, switches), and shall record device classes that cannot enforce signatures with compensating controls. The owners shall demonstrate rejection of an unsigned or altered image on a non-production device for each enforcing device class.

Evidence required: E2 Configuration and technical state; E3 Operational and observational; E4 Validation and test. Optional: E5, E6, E7. Operating states: NORMAL, MAINTENANCE, RECOVERY.

The platform owner shall maintain a compatibility matrix for interdependent components (for example accelerator firmware, driver and runtime libraries, NIC/DPU firmware, switch OS, BMC/BIOS, storage client; and for facility systems UPS firmware and EPMS, CDU controller and BMS integration), shall test each new combination on a representative non-production environment, and shall deploy through staged waves where each wave is confined to one fault domain and passes defined health criteria before the next begins. Redundant members of a group shall not be updated in the same wave.

Evidence required: E2 Configuration and technical state; E3 Operational and observational; E4 Validation and test. Optional: E5, E6, E7. Operating states: MAINTENANCE, TRANSITION, NORMAL.

The security owner shall track supplier advisories for in-scope products, triage each against the asset register and exposure (network reachability, privilege required), assign a remediation target based on severity and consequence, and record either patch deployment through change control or a compensating control with approved exception. The security owner shall report remediation performance to the accountable owner.

Evidence required: E2 Configuration and technical state; E3 Operational and observational. Optional: E4, E5, E6. Operating states: NORMAL, MAINTENANCE.

The maintenance manager shall define a spares strategy for each critical asset class (for example UPS modules and capacitors, battery strings, breakers and trip units, protection relays, generator starter motors and controllers, CDU pumps and controllers, chiller compressors and VFDs, transformer bushings or, where justified, a strategic spare transformer, accelerator trays or boards, NICs, optics, switch line cards, storage drives), stating stock level, location (on site, regional, OEM-held), basis (population, failure rate, MTTR target, lead time) and condition-maintenance requirements for stored spares. The maintenance manager shall reconcile stock to records at the profile interval and replenish below-minimum stock as a tracked action.

Evidence required: E2 Configuration and technical state; E3 Operational and observational. Optional: E4, E5, E6. Operating states: NORMAL, RECOVERY, DEGRADED.

The procurement lead shall maintain current quoted and observed lead times for each long-lead equipment class, including manufacturing slot reservations and logistics time, and the capability owner shall compare each with (a) the recovery tolerance for loss of an installed unit and (b) the capacity growth schedule, recording each case where lead time exceeds tolerance or schedule with a treatment (strategic spare, slot reservation, framework order, design change) or acceptance.

Evidence required: E1 Documentary and declarative; E7 Derived and analytical. Optional: E3, E4, E5. Operating states: NORMAL, RECOVERY.

The recovery owner shall identify the logistics and specialist-labour prerequisites for each recovery scenario involving replacement of long-lead equipment or emergency resupply, shall secure them through contracts or pre-arrangements (heavy-haul contractors, route surveys, customs brokers, export licences, fuel priority, labour call-off agreements), and shall validate them by exercise or documented precedent at the profile interval, including under at least one regional-disruption assumption.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state; E3 Operational and observational; E4 Validation and test. Optional: E5, E6, E7. Operating states: EMERGENCY, RECOVERY.

The asset manager shall maintain a lifecycle register recording vendor end-of-sale and end-of-support dates for critical assets, shall review it at the profile interval, and shall ensure each asset reaching end-of-support within the planning horizon has an approved treatment (refresh, last-time buy, extended support, third-party support with compensating controls) recorded before the date.

Evidence required: E2 Configuration and technical state; E3 Operational and observational. Optional: E4, E5, E6. Operating states: NORMAL.

The security owner shall require that all third-party support access to BMS/EPMS, CDU and PLC systems, UPS and switchgear management interfaces, BMCs, cluster managers, fabric and storage controllers uses named individual identities, verified by the supplier and registered by the owner, with multi-factor authentication for remote access. Shared, generic and default vendor accounts shall be disabled or, where technically unavoidable, vaulted with per-use checkout bound to a named person and recorded as an exception.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state. Optional: E3, E4, E5. Operating states: NORMAL, MAINTENANCE, EMERGENCY.

The facility operator shall ensure that third-party remote access paths are disabled by default and are activated only on approval by an authorised owner representative, for a stated duration and set of target assets, referencing an approved ticket or change, through a brokered access gateway. Access shall be deactivated automatically at expiry. Emergency activation shall follow a defined path with retrospective review within the profile time.

Evidence required: E2 Configuration and technical state; E3 Operational and observational. Optional: E4, E5, E6. Operating states: NORMAL, MAINTENANCE, EMERGENCY.

The security owner shall record all third-party sessions to in-scope control-plane and OT systems (keystroke or screen recording through the access broker where feasible), shall require live monitoring by a competent owner representative for sessions to systems designated high-consequence (for example EPMS switching, BMS/CDU control, protection relay configuration), and shall retain recordings for the profile period. The owner representative shall have and use the means to terminate a session.

Evidence required: E2 Configuration and technical state; E3 Operational and observational. Optional: E4, E5, E6. Operating states: NORMAL, MAINTENANCE, EMERGENCY.

The security owner shall revoke third-party logical access, credentials, tokens and physical badges within the profile time of contract end, personnel departure notified by the supplier, or task completion, and shall recertify all third-party access with the owning system owner at the profile interval, removing any access not positively confirmed.

Evidence required: E2 Configuration and technical state; E3 Operational and observational. Optional: E4, E5, E6. Operating states: NORMAL.