Industrial Cybersecurity Services RFP Checklist: Scope, Deliverables and Vendor Questions

By Denrich Sananda 27-10-2026 6 min read

A badly scoped OT cybersecurity RFP produces responses you cannot compare. Each bidder interprets the gaps differently, prices a different piece of work, and the lowest number wins by having understood the least. The fix is not a longer document. It is being specific about four things: what environment, what question you want answered, what artifacts you will receive, and what constraints apply.

This checklist is what we would want to receive. It is also, deliberately, what makes bids comparable, which occasionally works against the incumbent. If you want to understand the discipline before scoping it, our guide to what OT security is is the background.

Define the environment, not the company

"Assess our OT security" is unbiddable. What a bidder needs:

Which sites, and how many. One plant or eleven changes the answer entirely.
Roughly what is there. Approximate controller count, vendors, Purdue levels in play. Approximate is fine, absent is not.
What is already known. Existing asset inventory, network diagrams, prior assessments. If none exist, say so, because establishing a baseline is itself scope.
Operational constraints. Outage windows, change freeze periods, whether active scanning is permitted. This drives both method and timeline.
Safety systems in scope or out. If safety instrumented systems are included, say so explicitly, because it changes who is qualified to bid.

The question that filters the field fastest

Ask every bidder: what will you do differently because this is an OT environment rather than an IT environment? Vendors with genuine industrial capability answer immediately and concretely: no active scanning on Level 1 and 2 without agreement, passive discovery first, change windows, a safety review for anything touching protective systems, and an understanding that availability outranks confidentiality. Vendors repackaging IT security give a general answer about understanding the sector. That one question separates the field better than any certification list.

Specify deliverables as artifacts

Name the documents. "A report" is not a deliverable, it is an expectation waiting to disappoint.

Artifact	What to require
Asset inventory	Format, fields, and whether it is handed over in a form you can maintain. A PDF appendix is not an inventory.
Network and zone diagram	Current state, in an editable format, mapped to zones and conduits if you work to IEC 62443.
Findings register	Each finding with evidence, affected assets, risk rating and the rating method stated.
Remediation plan	Sequenced, with effort estimates and an explicit note on which items need an outage window.
Executive summary	Written for someone who will not read the body. Usually the document that decides whether anything gets funded.
Evidence pack	Raw data, capture files, tool output. Yours to keep, so the next assessment can measure change.

That last row matters more than it looks. Without the evidence, your next assessment starts from zero and you cannot demonstrate improvement to anyone.

Twelve questions worth asking

What will you do differently because this is OT? (see above)
Who specifically will be on site, and what are their industrial credentials?
Have you worked in our sector, and can we speak to a reference?
What is your discovery method, and is any of it active?
How do you handle a finding on a safety instrumented system?
What happens if you find something actively exploited mid-assessment?
Which framework do you assess against, and why that one?
How is risk rated, and is the method documented?
What do we have to provide, in people and access?
What is excluded from scope?
Do you sell products you might recommend, and how is that managed?
What does the handover look like, and who maintains the artifacts afterwards?

Two answers that should concern you

A bidder who will not name the people doing the work. On industrial sites, individual competence is the deliverable. A proposal that names a methodology but not a consultant is selling you a process and resourcing it later.

And a bidder who claims no conflicts while selling products. Most credible firms, including ours, supply both services and products. That is normal and workable. What matters is disclosure and a stated method for keeping assessment findings independent of what the firm sells. A flat denial is less reassuring than a clear explanation.

Make the responses comparable

Require a fixed deliverable list. Same artifacts from everyone, so price differences mean something.
Ask for day rates and day counts separately. A single total hides whether you are buying senior time or junior time.
Specify the framework yourself. Otherwise each bidder picks the one flattering to their method. IEC 62443 is the usual choice for industrial environments.
Ask what they would descope to halve the price. The most revealing question in any RFP. It tells you what they consider essential.

Why Choose Arista Cyber

We respond to RFPs scoped this way and we prefer them, because comparable bids reward actual industrial capability. Our consultants hold functional safety credentials alongside OT security certification, we name the people on the engagement, and we disclose that we supply products as well as services. See our OT cybersecurity services, our OT risk assessments and our case studies.

Next Steps

Write the environment description and the deliverable list before you approach anyone. Those two sections do most of the work, and they are what turn a set of incomparable proposals into a decision you can defend.

Common Questions

What should an OT cybersecurity RFP include?

An environment description with sites and approximate asset counts, a clear question you want answered, a named artifact list, your operational constraints, and whether safety systems are in scope.

How do we tell real OT capability from repackaged IT security?

Ask what they will do differently because this is OT. Credible bidders answer immediately with specifics about passive discovery, change windows, safety review and availability priority. Vague sector familiarity is the warning sign.

Should we specify the assessment framework?

Yes. If you leave it open, each bidder selects the framework that suits their method and the responses stop being comparable. IEC 62443 is the usual choice for industrial environments.

Is it a problem if a vendor sells products as well as services?

Not inherently, and most credible firms do both. What matters is that they disclose it and can explain how assessment findings stay independent of what they sell.

What deliverables should we insist on?

A maintainable asset inventory, an editable network and zone diagram, a findings register with evidence and a stated risk method, a sequenced remediation plan, an executive summary, and the raw evidence pack so your next assessment can measure change.

Writing an OT cybersecurity RFP?

Arista Cyber helps industrial operators scope assessments so bids are comparable: environment definition, artifact specification, constraint documentation and the vendor questions that separate industrial capability from IT security in a hard hat.

Discuss your assessment scope