ot-vendor-risk-assessmentlisted

## When to Use - Onboarding a new OT vendor, integrator, or service provider. - Annual third-party risk refresh across the vendor estate. - Reviewing a vendor after a security advisory names their product. - Renewing a contract that lacks the required security clauses. ## Prerequisites - Vendor list with product, service, and deployment footprint per site. - Contract copies with clause numbering for vendors already engaged. - Advisory data: vendor PSIRT pages, ICS-CERT advisories, NVD entries per product. - Remote access design from `safe-remote-access-architecture` to score the access model against. - Credentials: none. This skill produces assessment documents. - Authorization: procurement and security manager accept the composite ratings and treatments. - Upstream skills: `safe-remote-access-architecture`, `it-ot-convergence-risk-assessment`. ### Safety This skill is passive. It produces assessment and governance documents only. ## Workflow 1. Complete `references/questionnaire.md` per vendor. Every score in the register must trace to an answer or an artifact. 2. Fix the dimension set and weights before scoring any vendor. Requirement: criteria are committed before results are known. Anchor: NIST SP 800-161 supply chain risk management. Dimensions: security program, incident history, patch cadence, SBOM availability, remote access model, contract clauses, long-term support. Default weights put remote access model and patch cadence highest because those two directly a