A robotics company runs two networks and most proposals price for one. The corporate side looks like any other business. The engineering side holds the test rigs, the controllers and the firmware that ships inside the product. That is the side a general proposal goes quiet about.
The questions below are the ones worth asking before signing anything, whether you are choosing between two firms or deciding whether the arrangement you already have covers the part of the building where the work happens.
Who can read your technical data, including your provider?
If your work touches defense, aerospace or anything on the US Munitions List, moving or storing your technical data is normally an export. The regulation at 22 CFR 120.54 carves out an exception. Sending, taking or storing technical data is not an export when the data is unclassified, is secured using end-to-end encryption or cryptographic modules compliant with FIPS 140-2 or its successors, and is not intentionally sent to a person in, or stored in, a country proscribed in section 126.1.
Most firms stop reading at the word encryption. The condition that decides the question sits in the definition. Under 22 CFR 120.54(b)(1), end-to-end encryption means the data is never in an unencrypted form between originator and intended recipient, and that “the means of decryption are not provided to any third party.”
Your provider is a third party. Managed backup, file sync and endpoint management are usually built so that an administrator holding the right credentials can decrypt what is stored, because for most businesses that is the point of administrative access. Ask about data at rest specifically, since that is where those credentials reach. Data in transit is a separate question with its own answer, and it varies by tool, so ask about both.
The useful version is narrow. Ask which of your systems your provider can decrypt. Ask where the keys live and who can use them. Ask what changes if you tell them some of that data is export controlled.
For Munitions List work the bar sits above all of this. A provider handling that data needs to be registered with the State Department’s Directorate of Defense Trade Controls and running the controls that registration carries. That is a status a firm either holds or does not. Ask for it directly, and read a general answer about following best practices as a no.
None of this applies to every robotics company. Plenty hold nothing controlled, and for them the same question is about protecting a design, not meeting a regulation. Either way your provider should know which of you they are working with, and should have asked.
Is the lab network in scope, or quietly out of it?
Engineering environments tend to grow outside the IT plan. A controller gets a static address so a test can run overnight. A simulation box gets built for one project and stays for four years. A bench machine runs an old operating system because the instrument driver will not work on anything newer. None of this is bad practice. It is what building a physical product looks like.
The problem is that it is frequently outside the agreement. The joint advisory AA22-131A, published by the US Cybersecurity and Infrastructure Security Agency with the NSA, the FBI and their counterparts in the UK, Australia and Canada, tells customers of managed providers to manage internal architecture risks and segregate internal networks. Segregation only means something if somebody is responsible for both sides of the boundary.
Ask for the asset list the provider is working from and look for the lab. If the test rigs are missing, you have found the edge of the agreement. Then ask what the plan is for the machine nobody can patch, because every robotics firm has one and the honest answer names compensating controls instead of promising an upgrade.
How many provider accounts reach the engineering network?
AA22-131A asks customers to restrict provider accounts to the systems the provider actually manages, grant permissions on a need-to-know basis, audit how those accounts are used, and disable inactive ones promptly. On the corporate side that is routine. On the engineering side it rarely gets asked.
Turn it into a count. How many accounts will the provider hold that can reach source control or a controller. Are they named individuals or shared logins. Is each one behind multi-factor authentication. Who reviews the list and how often. What happens to those accounts on the first day after the relationship ends, and who verifies it was done.
What happens to a test rig when the corporate network is encrypted?
Sophos surveyed 2,158 IT and cybersecurity leaders across 17 countries for its State of Ransomware 2026 report and found that 56% of attacks succeeded in encrypting data, with only one in three smaller organizations stopping an attack before encryption. Planning to be in the majority is realism.
For a robotics firm the interesting part is not the file server. It is the run that was three days into a six day test, the calibration data that exists in one place, and the build artifacts for a firmware version already in a customer’s hands. Ask what the recovery order is and who sets it. Ask whether anyone has timed a restore of the engineering environment specifically, rather than a restore of the file server that everyone tests because it is easy.
If you build for patients, does your provider know which rules bite?
A firm building anything that reaches a patient carries obligations that look like engineering work and are judged as regulatory work, which is why they tend to surface late and with somebody else holding them. The robotics page sets out which ones apply and what each asks for.
The question for a provider is narrower. Very little of that work is theirs, and that is exactly why it needs saying out loud. The boundary between the product security your engineers own and the corporate security a provider owns is one of the few places where both sides can reasonably assume the other has it covered. Write down who holds each piece before an auditor or a customer asks.
What baseline can you hold two proposals against?
Every provider describes its tiers in its own vocabulary, which makes two proposals look different when they are the same and identical when they are not. The Center for Internet Security publishes the CIS Critical Security Controls, currently version 8.1, whose first implementation group is a foundational set of 56 cyber defense Safeguards that CIS describes as essential cyber hygiene.
Send both firms the same 56 Safeguards and ask each to mark every one as included in the price, available at extra cost, or your responsibility. Ask them to answer twice, once for the corporate network and once for engineering. The second column is where the proposals stop matching.
Nobody is certified against the CIS Controls, because CIS publishes controls and does not audit anyone, so the exercise is about mapping. There is no badge at the end of it.
Where Renascence stands
We work with product and engineering companies where technology is the thing being built, not the thing keeping the lights on, and the questions above are the ones we ask on the way in.
Our answers to these are on the robotics page and in the managed IT services agreement. If you would rather have them answered about your own environment first, that is what the assessment is for.