The OT Cybersecurity Procurement Memo
12 disqualifying questions every cement and mining operator should ask before selecting an OT cybersecurity provider.
Get the Procurement Memo
Enter your work email to download the memo.
What’s inside the memo
The memo organizes 12 questions across four categories.
I
Structural Independence
- Platform Resale
- Compensation & Quotas
- The Decommission Test
II
Deliverable Quality
- Topology of Record
- Portability of Findings
- Zone & Conduit Documentation
III
Operational Model
- OT Service Ownership
- Vendor Continuity
- Change Management
IV
Framework Alignment
- ISA/IEC 62443 Mapping
- NIST SP 800-82 Incorporation
- ITIL 4 Service Management
- The question
- Would your assessment findings survive a recommendation to decommission a product sold by your parent company, a strategic partner, or a vendor with whom you maintain a commercial relationship?
- Why it matters
- This is the stress test for structural independence. A provider who cannot recommend decommissioning a partner's product, when the evidence warrants it, is not independent.
- Red-flag answer
- "We work closely with our partners to find the best solution for every client." Deflects from the scenario. The question asks whether findings would survive.
- Green-flag answer
- "Yes. Our findings are documented independently. If the evidence supports decommissioning, we document that recommendation regardless of any commercial relationship."
- How Potenza answers
- Potenza has no parent company, strategic partnership, or commercial relationship that would prevent any finding or recommendation.
- Framework reference
- ISA/IEC 62443-3-3 SR 7.6, network and system integrity. NIST SP 800-82 Rev. 3, assessment independence requirements.
Every question follows this structure. The memo ends with a side-by-side table for recording each vendor's responses.
Who this memo is designed for
- CISOs and VPs of Cybersecurity /
- VPs and Directors of Plant Operations /
- Procurement teams /
- Audit and insurance renewal leads /
- Plant managers
The memo is built for the people who own OT cybersecurity vendor decisions inside cement and mining operations.
The principle behind the twelve questions
The OT Service Owner cannot be the OT Vendor.
The OT Service Owner cannot be the OT Vendor. Operators who own their OT topology independently from the OEM that built the equipment and the platform vendor that sells the monitoring software negotiate from parity, not dependency. This memo is the working tool procurement teams use to verify, in writing, which providers can demonstrate that structural independence — and which cannot.
Structural independence is not a marketing claim. It is a documented fact about how a firm is built — whether it resells platforms, whether its engineers carry quotas, whether its findings would survive a recommendation to decommission a product its parent company sells.
Potenza Services, Inc. is a Veteran-Owned OT cybersecurity firm built specifically around this principle. We do not resell platforms, carry product quotas, or answer to an OEM parent — so our findings survive a recommendation to decommission anything. We are the Assessment and Topology Authority for cement and mining OT environments — and we operate as the OT Service Owner for operators who need the discipline of a maintained topology of record.
The twelve questions in the memo are how procurement teams can verify that — for any provider, including Potenza.
Get the memo
Download the full memo. Forward freely inside your organization.
17 pages · PDF · Version 1.2 · May 2026
Get notified when we publish new resources
Frequently asked questions about the memo
No. The memo is structured so any cement or mining operator can use it to evaluate any OT cybersecurity provider — including Potenza. The questions are designed to be answered in writing by every vendor in your RFP.
A provider who cannot give a clear written answer to one of these twelve questions is signaling a structural limitation in their methodology or operating model. That is the disqualification — not the answer itself, but the absence of one.
Structural independence means a provider does not resell the OT cybersecurity platforms they recommend, does not carry quotas tied to specific platforms, and is organizationally independent from any OEM that supplies industrial automation equipment. The OT Service Owner cannot be the OT Vendor.
The OT Service Owner is the operational entity accountable for OT service ownership on behalf of the plant operator — independent of the OEM that supplied the equipment and the platform vendor that sells the monitoring software. Potenza Services operates as the OT Service Owner for the cement and mining operators we serve.
The memo is structured for procurement utility. Every question includes red-flag and green-flag answer patterns, framework references, and a side-by-side summary table. It is designed to be printed, annotated, and used during vendor evaluation calls — not to be read once and discarded.
Yes. The memo is distributed without licensing restrictions. Forward it to your CISO, procurement counterparts, plant operations leadership, and audit and insurance renewal leads. The questions affect all of those functions.