This document, titled “Pocket Guide: Questions to Ask Your Industrial Technology and Service Providers About Their Cybersecurity Capabilities,” developed by the Industrial Cybersecurity Center (CCI), provides a structured set of questions designed to help organizations assess the level of maturity and commitment to cybersecurity among their industrial suppliers.
The guide is divided into three sections:
-
Common questions, applicable to any industrial provider, focusing on aspects such as knowledge of the OT environment, risk management, operational resilience, staff competencies, and incident response capabilities.
-
Specific questions for industrial technology providers, aimed at technological robustness, integration with OT security systems, and secure product design.
-
Specific questions for service providers, focused on secure remote access management, maintenance, security testing, and operational continuity.
Overall, the document seeks to promote a common language between clients and suppliers, aligned with frameworks such as IEC 62443 and NIS2, to strengthen resilience and trust within connected industrial ecosystems.
