Placeholder content

These 47 requirements are invented. This is written to demonstrate the flow end to end. It is not sourced from NVIDIA's published corpus and must be replaced before anyone outside the company sees it.

Free self audit

The 47 Requirements Your NCP Bid Must Answer

Score yourself honestly. You get back the hard gates you cannot currently evidence, which are the ones that disqualify a bid rather than merely weaken it.

It takes about ten minutes. Nothing is stored until you ask for the report at the end.

01

Firmware attestation

  1. R01Every GPU baseboard ships with a signed firmware manifest that can be produced on demand.hard gate
  2. R02Firmware versions across a scaling unit are identical and the drift is detectable within one hour.hard gate
  3. R03A measured boot chain exists from the platform root of trust up to the host operating system.hard gate
  4. R04Firmware rollback to a previous signed version is possible without a physical visit to the rack.
  5. R05BMC and NIC firmware are inventoried in the same system as the GPU firmware, not separately.

02

Security

  1. R06Tenant workloads cannot read another tenant's GPU memory after a workload ends.hard gate
  2. R07All management plane access requires multi factor authentication with no shared accounts.hard gate
  3. R08Secrets used by the control plane are stored in a managed store and rotated on a stated schedule.hard gate
  4. R09A documented incident response process exists with named owners and a stated time to first response.
  5. R10Penetration testing has been performed against the customer facing control plane within twelve months.
  6. R11Physical access to the data hall is logged, and the log is retained for the contracted period.

03

Networking

  1. R12The compute fabric topology matches a supported NVIDIA reference architecture without modification.hard gate
  2. R13Rail optimised placement is enforced by the scheduler, not left to operator convention.hard gate
  3. R14Port counts and cable lengths in the bill of materials reconcile with the topology diagram.hard gate
  4. R15The storage fabric is separated from the compute fabric, and the separation is demonstrable.hard gate
  5. R16Out of band management reaches every device on an isolated network with its own failure domain.
  6. R17North south capacity is sized against the stated ingest rate rather than a rule of thumb.
  7. R18Congestion control settings are documented per fabric and match the reference architecture defaults.

04

Kubernetes conformance

  1. R19The cluster passes upstream Kubernetes conformance for the version offered to customers.hard gate
  2. R20The GPU operator version is pinned and its upgrade path to the next platform generation is stated.hard gate
  3. R21Node feature discovery reports accelerator topology correctly on every node type offered.
  4. R22Multi instance GPU profiles offered to customers are enumerated and each is schedulable.
  5. R23A tested procedure exists for draining a node without evicting another tenant's workload.

05

Telemetry

  1. R24Per GPU utilisation, temperature and power are exported at a stated interval to a durable store.hard gate
  2. R25Fabric error counters are collected and alert thresholds are documented.hard gate
  3. R26Telemetry retention meets the contracted period and survives a control plane rebuild.
  4. R27A customer can retrieve their own utilisation data through an interface, not a support ticket.
  5. R28Job level accounting can attribute consumption to a tenant for billing purposes.

06

Capacity isolation

  1. R29A tenant cannot observe another tenant's job placement, names or resource identifiers.hard gate
  2. R30Reserved capacity is enforced by the scheduler and cannot be consumed by burst workloads.hard gate
  3. R31Network isolation between tenants is enforced in the fabric, not only in software overlays.hard gate
  4. R32Storage namespaces are separated per tenant with independent credentials.
  5. R33A noisy neighbour on shared storage cannot degrade a reserved tenant beyond a stated bound.

07

Stable resource IDs

  1. R34Every physical and logical resource carries an identifier that survives a reboot and a re-image.hard gate
  2. R35Resource identifiers are stable across a control plane upgrade.hard gate
  3. R36The mapping from a customer facing identifier to a physical asset is queryable by operations.
  4. R37Decommissioned identifiers are never reused.

08

SOC 2 minimum

  1. R38A SOC 2 Type II report covering the in scope services is available to customers under NDA.hard gate
  2. R39The audit period is current, and the gap since the last report is stated.hard gate
  3. R40Any exceptions in the most recent report have a documented remediation and a date.
  4. R41Subservice organisations are listed and their reports are obtainable.

09

Financially backed uptime

  1. R42The availability commitment is financially backed and the remedy is stated in the contract.hard gate
  2. R43The measurement method for availability is defined, including what counts as an outage.hard gate
  3. R44Planned maintenance windows are excluded or included explicitly, with notice periods stated.
  4. R45Historical availability for the preceding twelve months can be produced on request.

10

Delivery gates

  1. R46At T minus 12 weeks the design is frozen, and the change control process after freeze is defined.hard gate
  2. R47At T minus 8 weeks long lead items are ordered with confirmed delivery dates from named suppliers.hard gate

Score it

Unanswered items are counted as unknown, which on a live bid is the same as a gap.