# Collaboration Practices for the Cybersecurity of Supply Chains to Critical Infrastructure
## 4 Results
### Supplier Engagement Model
#### 4.1.2 Contracts  
It became apparent, due to the differences between IT and OT, that OT needs have not been addressed well in contractual arrangements. Because of the different risk profiles, specific contracts/sets of requirements are required for network infrastructure interacting with OT along with OT-specific security policies.  
Contractual clauses can be used for the transfer of risk management responsibilities to suppliers, but such commitments are potentially ineffective in actual implementation if not supported by an exchange of technical information and clarifications relevant to the service provision. High-level contract clauses do not provide the necessary level of detail that ensures implementation at the required security level. The expert group suggested that a discovery and definitions phase could aid this process and assist more synergy between commercial and technical requirements. However, contracts are tools used to focus on unambiguous responsibilities and assign liability rather than encourage collaboration. If cybersecurity is inadequately specified to suppliers, then all aspects of managing the risk remain fully with the customer.  
The delivery of the management of risk could be more effective as a conversation and a process. It was proposed that a collaborative discovery process of emerging security risks should be facilitated. The actual definition of cybersecurity requirements for delivery requires a risk assessment to indicate security levels with different resulting requirements. Communicating operational risks, describing threats, and capturing risk tolerance would help suppliers to propose appropriately secure solutions. However, discussing and refining requirements is heavy on customer and supplier resources and increases the overhead of  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Activity/ Tool** & **Purpose** & **Issue Identified** & **Results and Actions** \\ \hline \multirow{3}{*}{RFI} & Selection of a supplier & Multiple questionnaires & UK Energy sector has produced a common RFI. \\  & with good cybersecurity & and duplicated & More work is needed on how to promote adoption. \\  & practices. & processes. & & \\ \hline \multirow{3}{*}{RFP} & To define cybersecurity & Diverse number of & UK Energy Sector has produced guidance on RFP \\  & requirements for the & requirements, & key topics. \\  & specific product or service. & insufficient detail. & More guidance is needed on how to define current \\  & & & and target state. \\ \hline \multirow{3}{*}{Standards} & To simplify defining & Under which standards & Simplified guidance (in Section 4.2) has been \\  & security requirements and & to choose from a very & produced to declare key standards, particularly \\  & solutions. & long list. & cross-sector and internationally accepted. \\  & & & long list. & More detailed guidance for individual sectors will \\ \hline \multirow{3}{*}{Certification} & To provide pre-worked & Lack of cybersecurity & Currently testing to see if a common attestation \\  & assurance of cybersecurity & service certification for & scheme can be adjusted to address OT. \\ \cline{1-1}  & status. & OT systems. & Also, the SCEG is currently creating a framework for \\ \hline \hline \end{tabular}
\end{table}
Table 4: OT actions arising in selection phase.  
contract negotiation. Therefore, having defined standard requirements for different security levels would be helpful.