Practice Tender — test AI safely

You are helping a Mitsubishi Electric BMS salesperson respond to a building tender.

CONTEXT: We supply, install and maintain Building Management Systems — DDC/PLC
controllers, HVAC and chiller control, fire-system integration, and the head-end
software. We are the BMS vendor, not the building owner and not the network
integrator. This is a practice tender.

ALIGN: Before you answer, play back in 3-4 lines how you plan to work through the
clauses, and WAIT for me to say "go".

GOALS:
  1. Sort every cybersecurity clause into Must-have / Nice-to-have / Risky red-herring.
  2. For each clause set a posture: Comply / Not-comply (+ a better alternative) /
     Clarify / N/A — each with a one-line rationale.
  3. Flag any clause that is indefensible to "Comply" to, any that contradicts
     itself, and any drafting slip.
  You MUST NOT invent facts, standards or clause numbers. Mark anything uncertain
  as [UNVERIFIED].

EXAMPLE of the row format I want:
  9.x | Must-have | Comply | "Per-engineer MFA through a recorded jump host — we do
        this as standard." | Pillar: Applications

Reply with your ALIGN plan only. Then wait for the tender.

TENDER Ref: BMS-2026-014
Project: Supply, Installation, Testing & Commissioning of an Integrated Building Management System (BMS)
For: Meridian One — a mixed-use commercial tower with a co-located hospital wing and a tenant data hall
Client: Meridian Estates Pte Ltd (the "Employer")

SECTION 9 — CYBERSECURITY, SEGMENTATION & RESILIENCE REQUIREMENTS
The Contractor shall comply with the following. Where it cannot comply, it shall say so and propose an alternative. Respond against each clause number.

9.1  The Contractor shall provide and maintain a complete inventory of every delivered device — controller, gateway, sensor and server — including firmware version and support status, updated on each change.
9.2  The BMS and building-control network shall be segmented from the corporate, guest and tenant networks. Communication out of the control network shall be restricted to the minimum necessary, and one-way where only one-way is required.
9.3  Any remote access to the delivered system shall be disabled unless required, require multi-factor authentication, pass through a secured intermediary (jump/bastion host), be session-logged, and be granted on a time-boxed, per-engineer basis.
9.4  All factory-default credentials shall be changed before handover. Any device running end-of-life or unsupported firmware shall be identified, with a containment plan.
9.5  Critical control sequences and setpoints (including the fire and smoke-control matrix) shall be baselined, backed up in restorable form, and monitored for unauthorised change.
9.6  The Contractor shall support the Employer's incident-reporting obligations, providing logs and asset data in a form the Employer's monitoring team can ingest.
9.7  Accounts on the delivered system shall follow least privilege, with no shared operator logins, and shall automatically log out after a period of inactivity.
9.8  The Contractor should provide a mobile dashboard application allowing the facilities team to view plant status remotely.
9.9  The Contractor should provide energy-analytics reporting suitable for the building's Green Mark submission.
9.10 The Contractor shall warrant that the delivered system is 100% secure against all cyber threats for the full duration of the maintenance contract.
9.11 All products supplied under this contract shall be CCoP-certified.
9.12 Anti-virus software shall be installed, running and kept updated on every field controller and DDC in the building.
9.13 All data in transit and at rest within the BMS shall be protected using quantum-proof encryption.
9.14 Remote vendor access to the control network shall be permanently disabled at all times. The Contractor shall also provide 24/7 remote support with a guaranteed 2-hour remote response to critical faults.
9.15 User passwords for the head-end software shall be a minimum of eight (12) characters, changed every 90 days.
9.16 The Contractor shall be responsible for the cybersecurity of the entire building network, including all tenant and corporate systems connected to it.
9.17 The Contractor shall align the delivered system to recognised standards such as IEC 62443 (zones and conduits) and the CSA Cybersecurity Code of Practice for CII, where applicable to the Contractor's scope.
— End of Section 9 —