Question 1

What cyber-physical asset classes does the platform discover and protect — industrial OT/ICS, building management (BMS), medical devices (IoMT), fleet/transport, smart-facility IoT — and with what protocol depth per class?

Accepted Answer

CPS is broader than classic OT; look for named asset-class coverage with per-class protocol depth, not an OT product relabeled 'CPS.'

Question 2

Describe safe discovery in fragile environments — passive-first methodology, any active-query safety record on live production systems, and a customer reference from an environment comparable to ours.

Accepted Answer

Active scanning has crashed real controllers; strong answers lead passive-first with a documented safety record for any active techniques.

Question 3

How does the platform assess exploitability and consequence — does risk scoring incorporate physical-process impact (safety, downtime cost) or only IT-style CVSS severity?

Accepted Answer

In CPS, consequence is physical — look for process-impact-aware risk models, not raw CVSS lists that rank a lab thermostat above a safety controller.

Question 4

What network segmentation enforcement/validation is supported — Purdue-model zone validation, virtual segmentation via existing firewalls/NACs, and detection of unauthorized cross-zone flows?

Accepted Answer

Look for enforcement through your existing network stack plus continuous validation — recommendations without enforcement integration leave the gap open.

Question 5

Detail remote-access governance for third-party maintenance vendors — session brokering, per-session approval, recording, and credential vaulting for CPS assets.

Accepted Answer

Third-party remote maintenance is the top CPS intrusion path; strong answers offer brokered, recorded, per-session-approved access rather than shared VPN accounts.

Question 6

How are compensating controls handled for unpatchable assets (legacy controllers, FDA-constrained medical devices) — and does the platform track residual risk with the compensating control applied?

Accepted Answer

Much of a CPS fleet can't be patched; look for compensating-control workflows (segmentation, monitoring) with residual-risk tracking, not patch-centric workflows that dead-end.

Question 7

Explain threat detection for CPS-specific attack behaviors — unauthorized controller logic changes, protocol function-code anomalies, safety-system interference — with a named-framework mapping (MITRE ATT&CK for ICS).

Accepted Answer

Look for CPS-native detections mapped to ATT&CK for ICS, not IT NDR heuristics applied to industrial traffic.

Question 8

What compliance/reporting support exists for sector regulations relevant to us — IEC 62443 zones/conduits, NERC CIP, FDA postmarket, TSA directives — with evidence output per framework?

Accepted Answer

CPS buyers are usually regulation-driven; look for named-framework evidence reports, not a generic compliance dashboard.

Question 9

What is the pricing model — per asset, per site, or a flat enterprise tier — and how does cost scale for an organization with many geographically distributed facilities (hospitals, campuses, plants), each with its own CPS asset population?

Accepted Answer

Look for transparent, predictable per-site/per-facility scaling economics; CPS deployments often span many distributed sites with real budget-risk implications if pricing isn't clear upfront.

Question 10

Describe incident-response capability specific to safety-critical CPS incidents (e.g., a compromised building-management system or medical device) — is there a named responder team with genuine physical-safety-aware expertise, distinct from a generic IT incident-response team applying standard playbooks?

Accepted Answer

A compromised medical device or building safety system carries physical-safety risk that a generic IT IR team may not be equipped to handle safely — ask specifically about physical-safety-aware response expertise and a real engagement track record.

Question 11

Does the vendor have an established ecosystem of facility/sector integrators (healthcare-IT integrators, building-automation contractors) experienced in the customer's specific environment, or does deployment rely entirely on the vendor's own generalist field team?

Accepted Answer

CPS environments (a hospital, a smart building, a fleet depot) often require deep sector-specific operational knowledge — a mature integrator ecosystem indicates a more scalable, lower-risk deployment path.

Question 12

What is the platform's false-positive rate in a CPS context specifically, given that a false alarm affecting a medical device or building safety system carries a much higher real-world cost than a false alarm in a typical IT environment?

Accepted Answer

The cost asymmetry of false positives is far higher for CPS (a false alarm can disrupt patient care or building safety systems) than in IT — a vendor should have a CPS-context-aware answer, not a generic IT-derived accuracy figure.

Question 13

Explain deployment consistency for a large multi-site organization — can asset discovery and protection quality be maintained uniformly across many distributed facilities with varying levels of network maturity, or does coverage degrade at less-mature sites?

Accepted Answer

A vendor should give an honest answer about whether facilities with less-mature network infrastructure get materially weaker coverage — a common real-world gap for large multi-site organizations.

Question 14

Detail historical trend reporting on CPS security posture (asset coverage, unpatched/compensating-control-only asset count) over time, suitable for demonstrating program maturity to leadership and regulators.

Accepted Answer

Trend-over-time reporting is a distinct capability from a real-time dashboard — confirm this exists as a maintained, exportable report, particularly relevant given the regulatory reporting burden common in CPS-heavy sectors (healthcare, critical infrastructure).

Question 15

Where is CPS telemetry data processed and stored, and what data-residency guarantees exist for especially sensitive facilities (hospitals with patient-safety implications, critical infrastructure) that may have regulatory constraints on where this data can leave the facility?

Accepted Answer

Look for specific data-residency options; a vendor offering only a single-region SaaS with no on-prem/regional processing option may not meet regulatory requirements for the most sensitive CPS environments.

Question 16

How does the platform integrate with the customer's existing physical-security/building-access systems (badge readers, video surveillance) to correlate a cyber anomaly with a physical-security event, or is CPS cybersecurity treated as fully separate from physical security?

Accepted Answer

Correlating cyber and physical-security signals is an emerging, valuable capability for CPS environments where the two domains genuinely intersect — a vendor should clarify whether this integration is real or the two domains remain fully siloed.

CPS Protection evaluation questionnaire

Build your evaluation

Match on your requirements

1. Weight what matters

2. Pick vendors to compare

Platform baseline

From other buyers