Operational technology programmes are vendor-dense almost by definition — integrators, equipment manufacturers, network providers and software vendors all sitting in the same delivery chain, often with interdependent timelines. That density is exactly why vendor risk in OT programmes deserves more structured attention than it typically gets.
A single weak link affects the whole chain. In a multi-vendor OT delivery, a delay or quality issue from one vendor frequently cascades into others' workstreams, even when those vendors have no contractual relationship with each other. Programme leadership needs visibility across the whole vendor ecosystem, not just bilateral oversight of each contract in isolation — otherwise cascading risk goes undetected until it's already caused a downstream delay.
Contractual posture should match the actual risk, not a generic template. It's common to see OT contracts built from a standard commercial template that was never designed for live operational environments — with remedies, SLAs and acceptance criteria that don't reflect the actual operational consequences of underperformance. Contracts should be built around the specific operational risk: what does a missed milestone actually cost in terms of continuity, safety or service, and does the contract's remedy structure reflect that?
Escalation paths need to exist before they're needed. Vendor issues that escalate well are usually following a path that was agreed before the issue arose — who's notified, what authority they have, what timeframe applies. Vendor issues that escalate badly are usually improvising a path in the moment, under pressure, with unclear authority on both sides. Defining escalation structure during contract negotiation, not after the first serious issue, makes a measurable difference to how fast problems get resolved.
Active oversight beats passive reporting. Vendor status reports tell you what the vendor wants you to know, when they want you to know it. Active oversight — site visits, independent technical reviews, direct engagement with the vendor's delivery team rather than just their account manager — surfaces issues earlier and with more context than passive report review ever will. This doesn't require distrust of the vendor; it requires the same diligence you'd apply to any critical dependency.
Commercial performance and delivery performance are not the same thing. A vendor can be commercially compliant — invoicing correctly, meeting contractual milestones on paper — while genuine delivery quality or readiness is quietly slipping. Programme governance that tracks commercial compliance as a proxy for delivery health will miss this gap until it's expensive to fix.
None of this is about adversarial vendor management. The strongest OT delivery relationships are genuinely collaborative — but collaboration works best when it's backed by structure: clear contracts, real visibility, and escalation paths that don't have to be invented under pressure.