Key takeaways
- Tender questionnaires and cyber insurance forms for renewable, utility and critical infrastructure projects now routinely run to dozens of questions on remote access, segmentation, authentication, logging, supply chain and data residency.
- The shift is structural, not cosmetic. Underwriters and procurement teams are asking for evidence, not assurances, and the bidders who can supply it cleanly are winning more often.
- Most of these questions have a small number of underlying themes. Once you understand the themes, the same Netcelero deployment answers a high proportion of them in a consistent and documented way.
Every bid manager working in critical infrastructure, utilities or renewable energy has noticed the same shift. The cyber security section of the tender used to be five lines. Now it is five pages. The cyber insurance proposal used to ask whether you had antivirus and a firewall. Now it asks who can authenticate to your remote sites, how they are authorised, how long the access logs are retained, and which jurisdiction holds the data.
This piece is written for the people at the receiving end of those questionnaires. It walks through the categories of question that show up most often, what good answers look like, and how a Netcelero deployment helps you answer a lot of them in a way that holds up under scrutiny.
Who Is Asking, and Why It Matters
Two groups have raised the bar in parallel. Procurement teams in critical infrastructure, particularly in renewables, utilities and government adjacent sectors, are operating under tighter regulatory regimes. NIS2 in the EU, the Cyber Resilience Act from September 2026, EPA expectations on water in the US, and equivalent frameworks elsewhere have all pushed cyber security from a back office concern to a front office bid criterion.
Cyber insurance underwriters have moved in the same direction. Loss ratios on critical infrastructure cyber claims have tightened cover and sharpened the underwriting process. The questions are no longer screening questions. They directly shape premiums, exclusions and, increasingly, whether cover is offered at all.
For the bidder, this changes the dynamic. A vague answer used to be acceptable. A specific, evidenced answer is now the differentiator.
The Five Categories of Question You Will See Most Often
The detail varies, but the categories are remarkably consistent across the questionnaires we see our customers responding to.
One: remote access controls. Who can access remote sites, by what method, with what authentication, and from where? Typical question: “Describe the authentication, authorisation and logging applied to all remote access into operational technology environments.” The answer needs to cover the access path, the MFA position, the role separation, and the audit trail.
Two: network segmentation. How are operational systems separated from corporate, guest and third party traffic? Typical question: “Confirm that SCADA, CCTV and any other operational systems are logically segmented from each other and from corporate IT.” The answer needs to show segmentation in practice, not just policy.
Three: logging, monitoring and audit. What is logged, where, for how long, and who can access it? Typical question: “Provide the retention period, storage location and access controls for all remote access and configuration change logs.” The answer needs concrete retention periods and a defensible chain of custody.
Four: supply chain and provenance. Where does the equipment come from, who operates the platform, and what jurisdiction governs the data? Typical question: “Identify all third party suppliers in the path of operational data and confirm none originate from sanctioned or restricted jurisdictions.” The answer needs supplier statements, equipment lists and clear jurisdictional positioning.
Five: incident response and resilience. What happens when something goes wrong, and how quickly does the site recover? Typical question: “Describe the failover capability for connectivity at remote sites and the maximum tolerable downtime under your design.” The answer needs both the architectural answer and the measured behaviour.
What a Good Answer Looks Like
The bidders who do well on these sections share a small number of habits. They answer the question that was asked, in the words it was asked in. They provide evidence, not adjectives. They reference the underlying frameworks (IEC 62443, NIS2, ISO 27001 of relevant partners) where those genuinely apply, rather than as decoration.
They also resist the temptation to over claim. An underwriter or procurement assessor reading dozens of responses can spot generic boilerplate immediately. A short, specific answer that points to a documented capability scores higher than a long answer full of marketing language.
How Netcelero Helps You Answer These
A Netcelero deployment makes a number of the most common questions easier to answer in evidenced terms. We are not the only piece of the cyber picture, but we cover the connectivity layer cleanly.
On remote access, the i-ctrl public IP address can either be bridged to the client’s firewall or port forwards set up from the public IP to devices on site as per the client’s requirements. The management of the device is done over a VPN tunnel; the CPE on boot connects out from the site to our core network to create the private Tunnel. All our access and mgmt. is done over this private mgmt VPN tunnel.
On device management, Netcelero’s own access to the i-ctrl is separate from that data path entirely. The CPE initiates an outbound management VPN tunnel from the site to Netcelero’s core network on boot, and all Netcelero administration and support access to the device happens over that private management tunnel, not via the public IP.
On segmentation, the dual static IP feature on the i-ctrl gives you two independent public IPs on the same physical device, supporting cleanly separated networks for, for example, SCADA and CCTV. This is a concrete, demonstrable segmentation point.
On logging, the Netcelero customer portal retains access and configuration change logs for six months in our core network, with role based access control. That is a specific retention period and a specific custodian, which is what these questionnaires are looking for.
On supply chain and provenance, our hardware is assembled in Dublin and our data centres are in Dublin and Amsterdam, and software developed in house. We can provide a written statement to that effect for inclusion in your bid response.
On resilience, the i-ctrl supports multiple WAN paths with automatic failover and failback, and a fixed public IP that does not change regardless of which underlying connection is active. That is an architectural answer plus a measurable behaviour. If either of our data centres experiences an issue, all sites can fail over between Dublin and Amsterdam, keeping disruption to a minimum.
What to Do This Week
If you write or contribute to tender responses or cyber insurance applications, three small steps will sharpen your next round.
First, pull together your last three completed questionnaires and identify the questions where your answer was generic or where you had to leave detail vague. Those are the gaps to close before the next bid.
Second, build a small internal answer bank organised by the five categories above. Most bidders end up answering the same questions repeatedly, in slightly different words, and a pre approved answer bank cuts hours off every response.
Third, ask your connectivity supplier for written statements on the points that come up most often. Equipment provenance, jurisdiction of operation, log retention and incident response posture are the four that show up almost everywhere.
The bidders who treat the cyber security section of the tender as a strategic differentiator rather than a paperwork exercise are the ones winning the work. A small amount of preparation now makes the next response noticeably stronger.
Contact us today if you would like a copy of our standard responses to the most common RFP and cyber insurance questions on connectivity, ready to drop into your next bid response.
