Compliance & standards
VS Platform brings security, deployment and operational visibility into one control plane for distributed sites. Hardware-rooted identity, encrypted connectivity and centrally managed policies help teams address the security and operational requirements of regulated environments.
Compliance frameworks
From enterprise security to industrial operations, these frameworks provide a common language for evaluating VS Platform deployments. The platform’s security and management capabilities support the technical foundation; organizational processes, deployment configuration and customer responsibilities complete the picture.
Platform capabilities can support framework requirements; they do not by themselves establish full alignment or certification. Formal alignment requires a validated control mapping for the deployment. Certification and independent assurance require a current, scoped certificate or audit report. Contact Portal Robotics to confirm the evidence and status relevant to your environment.
Cybersecurity governance
A risk-based approach to cybersecurity through Govern, Identify, Protect, Detect, Respond and Recover. VS Platform’s centralized policy, node identity and fleet visibility help teams organize protection and monitoring across remote sites.
Current and target organizational profiles; risk register; control mapping; improvement roadmap.
Information security management
Information security management across people, processes and technology. VS Platform’s access policies, encrypted connectivity and managed deployment lifecycle provide technical capabilities to evaluate within your ISMS and Annex A control mapping.
ISMS scope; risk assessment and treatment plan; Statement of Applicability; internal audit and management review records.
Industrial & OT security
Industrial automation and control-system security. Hardware-rooted node trust and managed connectivity are relevant to protecting distributed industrial infrastructure. Assess secure development against 4-1, and system risk, zones and conduits against 3-2 and 3-3.
Secure development procedures; threat models; zone and conduit diagrams; security requirement and test traceability; supplier responsibilities.
Trust Services Criteria
Security, availability and confidentiality require defined controls and evidence of operation. VS Platform’s centralized management and operational visibility can contribute to the system boundary assessed by an independent SOC 2 examiner.
System description; control matrix; operating evidence for the review period; exceptions and remediation; independent report if issued.
Prioritized safeguards & hardening
Prioritized safeguards and secure configuration guidance for the infrastructure behind your edge workloads. Use VS Platform’s centralized deployment and lifecycle workflows to manage approved configurations; assess applicable CIS Controls v8.1 safeguards and Benchmark profiles with appropriate validation tools.
Safeguard assessment; selected Implementation Group; benchmark name, version and profile; dated scan results; approved exceptions; remediation and retest records.
Conditional · bulk electric systems
Cybersecurity requirements for applicable Bulk Electric System environments. Centrally managed access, node identity and encrypted connectivity are relevant technical capabilities; the responsible entity must establish applicability and demonstrate compliance with each in-scope requirement.
Applicability assessment; BES Cyber System categorization; access and perimeter records; incident response, recovery and change evidence required by applicable standards.
Post-quantum cryptography
NIST FIPS 203, 204 and 205 standardize post-quantum key encapsulation and digital signatures. VS Platform describes encrypted site connectivity; post-quantum algorithm support must be confirmed separately for the deployed components and configuration.
Cryptographic inventory; migration plan; implementation and interoperability tests; key lifecycle records; module validation evidence where required.
Quality management
Quality management through repeatable processes and continual improvement. VS Platform’s solution catalog and centralized deployment workflows support consistent rollout across sites; a QMS assessment also requires documented engineering, service and quality processes.
QMS scope; process procedures; quality objectives; release and acceptance records; nonconformities; corrective action and management review.
Conditional · utility interoperability
Communication models and interoperability for power utility automation. For utility deployments, assess the specific applications, gateways and devices managed through VS Platform against the applicable IEC 61850 parts and conformance requirements.
Integration scope; applicable editions and parts; SCL files and data models; interoperability and conformance test reports.
Business continuity management
Business continuity and operational resilience. VS Platform’s visibility and centrally managed lifecycle help teams oversee distributed operations. Continuity assurance also depends on scoped recovery plans, backups, dependencies and demonstrated restore and failover results.
Business impact analysis; continuity and disaster recovery plans; RTO/RPO approvals; recovery exercise results and corrective actions.
The platform behind the controls
VS Platform connects hardware trust, site networking and workload operations in one managed environment.
TPM-backed identity and measured-boot attestation help establish trust when an edge node joins the fleet.
Encrypted connectivity connects remote locations and the control plane within a centrally managed operating model.
Deploy solutions, manage updates and apply policy across sites from the same portal.
Review infrastructure health, application performance and security posture across distributed locations.
Audit documentation checklist
Discuss your audit requirements with Portal Robotics and identify the control mappings, technical records and assurance materials relevant to your deployment. The following list outlines the documentation to prepare or request; availability and scope must be confirmed for each engagement.
Suggested owner · Security / leadership
Audit scope, system boundaries and review period; service and data-flow diagrams; organizational roles and RACI; approved security policies; framework applicability assessment; obligations register; master control-to-evidence matrix.
Suggested owner · Security / risk
Risk assessment methodology; current risk register; threat models; treatment plans; documented risk acceptance; control exceptions; internal assessments; management review minutes and corrective action tracking.
Suggested owner · IT / platform engineering
Hardware, software, cloud and edge-node inventories with owners; supported versions; approved build images; configuration baselines; deployment records; configuration drift reports; node retirement and disposal records.
Suggested owner · Security / infrastructure
CIS Controls v8.1 safeguard mapping and selected IG1, IG2 or IG3 scope; applicable Benchmark versions and Level 1 or Level 2 profiles; dated assessment exports; coverage and exclusions; exception approvals; remediation tickets and retest evidence. Validate changes against OT safety and availability needs.
Suggested owner · IT / security
Access control policy; joiner, mover and leaver records; role and privilege matrix; MFA configuration evidence; periodic access reviews; privileged and service account inventory; remote support approvals and access logs.
Suggested owner · Platform / OT engineering
Network and trust-boundary diagrams; segmentation and firewall rules; remote access design; customer versus supplier responsibility matrix; physical security records; where applicable, TPM enrollment, attestation results, failed-attestation handling and node revocation evidence.
Suggested owner · Security / privacy
Data classification and flow inventory; retention and deletion schedules; encryption configuration; certificate, key and secrets lifecycle records; privacy assessments and processing agreements where applicable; cryptographic inventory and post-quantum migration assessment.
Suggested owner · Engineering / quality
Secure SDLC policy; security requirements; code reviews and approvals; SAST, DAST and dependency scans; SBOMs; build provenance and artifact signing records where used; release approvals; rollback and update tests; vulnerability disclosure and support lifecycle procedures.
Suggested owner · Security / engineering
Scan scope and authenticated results; independent penetration test reports where required; patch policy and service targets; remediation tickets; approved exceptions; retest results; tracked advisories and dependency updates.
Suggested owner · Security operations
Logging standards, sources and retention; sample audit events and integrity controls; alert rules; triage tickets; incident response plan; escalation and notification procedures; tabletop exercises; incident reports and lessons learned.
Suggested owner · Operations / service owners
Business impact analysis; approved recovery objectives; backup schedules and access controls; successful restore tests; disaster recovery and continuity plans; failover exercises; availability records and follow-up actions.
Suggested owner · Procurement / HR / security
Supplier inventory and risk reviews; contracts and security obligations; subprocessor register where applicable; security training and attendance; role-specific engineering training; confidentiality agreements; personnel screening records where lawful and required.
Suggested owner · Quality / engineering
Quality manual and process records; change approvals; acceptance test results; calibration records where applicable; nonconformity and corrective action logs; customer issue tracking; internal audit reports and management reviews.
Suggested owner · Compliance / external assessor
Issued certificates and audit reports with scope, issuer and validity; SOC 2 reporting period and exceptions; applicable NERC CIP evidence; IEC 61850 conformance results; contractual requirements; robotics or machinery safety assessments when included in the audit scope.
Record an evidence ID, mapped requirement, accountable owner, system or site scope, version, approval, collection date, review period, test outcome and next review date. Protect confidential evidence in an access-controlled repository; share sensitive reports through an approved process and NDA where appropriate.
Compliance documentation & audit support
Discuss the frameworks that matter to your organization, request relevant compliance documentation and review how VS Platform fits your environment.
A 30-minute walkthrough of VS Platform on your use case: onboarding a node, standing up a secure network, deploying from the catalog, and seeing it all in one portal.