1 · Executive Summary

This document specifies the data prerequisites, telemetry protocols, cybersecurity controls, and onboarding workflow required to bring an active utility-scale solar O&M site online with the Earthflow Physics AI™ engine. It is the companion document to the Reinsurance Cat-Modeling Methodology: that document explains what Earthflow computes; this document explains how the data gets in.

1.1 Table of Contents

2 · Data Prerequisites — Bring-Your-Own-Data

Earthflow's first-look risk map for a utility-scale solar site requires only a small set of Tier 1 (mandatory) data fields that any cedent will already have in their EPC or O&M submission packet. Tier 2 (recommended) adds live telemetry — SCADA, weather station, hail detector — for condition-monitoring-aware underwriting. Tier 3 (advanced) adds BMS streams, EL imaging, transformer DGA, and substation IEC 61850 telemetry for a full digital twin. Cedents move through the tiers at their own pace; no tier is a prerequisite for the prior one's outputs to be usable.

2.1 Tier 1 — Mandatory Pre-Binding Data

Required for the first-look risk map. Earthflow can produce a complete 12-peril decomposition, composite risk grade, and bind-ready verdict from this data alone — no live feeds required.

2.2 Tier 2 — Recommended Operational Monitoring

Adds live telemetry feeds that update vulnerability parameters in real time. With Tier 2 data, the composite risk grade refreshes daily; predictive-maintenance alerts and energy-shortfall signals become first-class outputs.

2.3 Tier 3 — Advanced (Full Digital Twin)

Adds cell-level BMS streams, EL imaging, transformer condition data, and substation IEC 61850 GOOSE messaging for sites that require continuous-monitoring underwriting (typically BESS-co-located or high-value coastal projects). Tier 3 enables parametric trigger structures that pay on objective sensor thresholds.

3 · SCADA / IoT / BMS Protocol Support

Earthflow is sensor-agnostic and vendor-agnostic by design — we ingest from whatever the cedent's existing fleet uses. The platform supports the eight major industrial protocols used in utility-scale solar today: Modbus TCP/RTU, OPC-UA, MQTT, DNP3, REST, SunSpec Alliance, IEC 61850, and BACnet. The vendor cards below show the integration patterns for the most common equipment in the field.

3.1 Protocol Reference

3.2 Inverter Vendors

3.3 BESS / BMS Vendors

3.4 Weather Stations & Hail Detectors

3.5 Substation / Grid-Side (IEC 61850)

4 · Cybersecurity Architecture

Solar O&M data flows out of operational-technology (OT) networks into Earthflow's information-technology (IT) cloud — a class of integration that cyber teams scrutinize heavily, with good reason. This chapter documents the seven cybersecurity pillars that govern Earthflow's ingest architecture and the industry standards they align to.

4.1 The Seven Cybersecurity Pillars

4.2 Alignment to Industry Standards

4.3 Threat Model Highlights

Earthflow's threat model documents the controls against the most common OT-integration attack vectors. The full Threat Model document is available under NDA; the high-level summary:

• Lateral movement from Earthflow into OT — eliminated by read-only architecture and unidirectional diode option (Pillar 1).
• Credential compromise — mitigated by MFA + SSO + service-account rotation + anomaly detection in audit logs (Pillars 4, 7).
• Man-in-the-middle on telemetry — mitigated by TLS 1.3 + certificate pinning at the gateway (Pillar 3).
• Data exfiltration via Earthflow — mitigated by least-privilege RBAC + customer-managed encryption keys + audit logging (Pillars 3, 4, 7).
• Supply-chain compromise (NERC CIP-013) — mitigated by vendor risk assessment + signed dependency chain + reproducible builds.
• Insider threat at Earthflow — mitigated by separation-of-duties, no single-person-can-deploy policy, customer-side audit visibility.

5 · Integration Patterns

Three reference architectures cover essentially every solar-site integration we have seen. The right pattern depends on the cedent's existing fleet age, cloud posture, and cyber appetite. None require greenfield infrastructure; all three can be deployed within 12 weeks.

5.1 Pattern A — Cloud-Direct (REST / MQTT)

For newer fleets where the inverter, BMS, and weather-station vendors already expose cloud-native REST APIs or MQTT brokers. Typical of post-2022 installations from Sungrow iSolarCloud, SMA ennexOS, Tesla Powerhub, and Huawei FusionSolar. Lowest integration effort; highest latency precision.

• Latency tier — Real-time (sub-minute end-to-end)
• Cyber posture — TLS 1.3 end-to-end · vendor cloud already audited (NIST CSF, SOC 2)
• Customer effort — API key provisioning · OAuth scope configuration · 2-4 days
• Best for — newer (2022+) Tier 1 vendor fleets · BESS-co-located sites · cedents with cloud-first IT posture

5.2 Pattern B — Gateway-Aggregated (Modbus / OPC-UA Bridge)

For mixed fleets with on-prem SCADA, legacy Modbus RTU equipment, or vendor-specific protocols requiring local translation. The on-site gateway aggregates multiple protocols, applies TLS encryption, and pushes outbound to Earthflow via IPSec or PrivateLink. The most common pattern in production.

• Latency tier — Near-real-time (1–5 minutes end-to-end)
• Cyber posture — Gateway sits in customer DMZ (Purdue L3) · unidirectional diode option · NIST CSF + IEC 62443-3-3 aligned
• Customer effort — Gateway install + VPN provisioning + protocol-map configuration · 2-4 weeks
• Best for — operational fleets with mix of Modbus / DNP3 / proprietary protocols · utility-grade integrations · NERC-CIP-aware deployments

5.3 Pattern C — Batch-ETL (SFTP / Historian Dump)

For first-look pilots, legacy fleets, or cedents whose cyber policy prohibits any live tunnel during pre-binding. Earthflow ingests daily or weekly historian extracts via SFTP, S3, or signed Cloud Storage URL. No live connection; lowest cyber footprint; highest latency.

• Latency tier — Daily batch (24-hour update)
• Cyber posture — No live connection · file-based · signed URLs · the lowest-friction onboarding option
• Customer effort — Cron-scheduled historian export + SFTP credentials · 2-5 days
• Best for — first-look pilots · pre-binding evaluations · legacy fleets with proprietary historians · cedents in cyber-conservative jurisdictions

5.4 Choosing a Pattern

6 · Roadmap — 7-Day Quick-Start + 12-Week Full Pilot

Earthflow's onboarding is engineered to deliver visible value in under a week using only data the cedent already has on hand, then layer live telemetry on top over the following 11 weeks. This chapter is the cedent's operational playbook: who does what, on which day, with which prerequisites.

6.1 Days 1–7 — First-Look Quick-Start (Pattern C · Batch ETL)

6.2 Weeks 2–12 — Full Pilot (Live Telemetry Integration)

6.3 Resource Plan Summary

7 · Cedent & Reinsurer-Specific Considerations

A reinsurer integrating Earthflow into its book has to navigate four categories of governance issues beyond the technical onboarding: data ownership, bordereau aggregation, cross-border data flows, and liability allocation. This chapter walks each in turn.

7.1 Data Ownership & Processing Agreements

Earthflow's default contracting model:

• The cedent owns the operational data (telemetry, fault logs, BMS streams, weather data). Earthflow processes under a Data Processing Agreement (DPA) as a processor, not a controller.
• The reinsurer receives ceded-only insights — composite risk grades, EP curves, bordereau rows for sites in their treaty. Site-by-site operational telemetry stays with the cedent / processor unless explicit consent is granted.
• Earthflow's derived outputs (peril scores, vulnerability factors, methodology improvements) feed back into the platform for all customers but are aggregated and de-identified — no single cedent's data influences another cedent's score.
• Audit rights — both cedent and reinsurer have the right to audit Earthflow's data handling annually. Reports + raw audit-log exports available on request.

7.2 Bordereau Aggregation Across the Cedent Book

When a reinsurer's treaty covers multiple sites for the same cedent, Earthflow re-runs the Monte Carlo aggregation across the entire portfolio in a single simulation, preserving peril correlations. Outputs include:

• Per-site row — composite grade, AAL, PML, recommended subjectivities (ACORD-aligned schema)
• Cedent aggregate — total book PML, top-5 concentration, diversification benefit, correlation matrix
• Treaty fit metrics — site-by-site attachment-band fit, layer-utilization curve
• Climate-creep aggregate — book-level RCP 8.5 trajectory through 2055

The aggregate output contains no PII. Site identifiers are anonymized references; no operational personnel or proprietary contract terms appear in bordereau outputs.

7.3 Cross-Border Data Transfer

7.4 NERC CIP Applicability

NERC Critical Infrastructure Protection (CIP) standards apply when Earthflow integrates directly into a Bulk Electric System (BES) Reliability Coordinator or Balancing Authority's control envelope. For most solar O&M integrations, this is not the case:

• NERC CIP applicable — Integration into a utility-owned substation IEC 61850 stack at the BES level, with two-way (read/write) control. Earthflow's standard read-only architecture can operate inside a utility's CIP-conformant Electronic Security Perimeter (ESP), but full CIP-013 supply-chain vendor onboarding is required (3–6 month process).
• NERC CIP not applicable — Ingesting from a cedent's O&M vendor's SCADA, the inverter manufacturer's cloud, or a weather station. These sit outside BES control and are not CIP-scoped.

7.5 Liability & Breach Allocation

• Cyber E&O — Earthflow maintains cyber-liability insurance with a $10M aggregate, available under contract on request.
• Breach-notification SLA — Confirmed material breach reported to customer within 24 hours of discovery, including impact assessment and remediation timeline.
• Customer breach — If the cedent or reinsurer's environment is breached, Earthflow assists with audit-log forensics within 24 hours of request.
• Right to disconnect — Cedent can pause data ingest at any time via portal control; tunnel can be terminated immediately by customer-side network policy without Earthflow involvement.

8 · Compliance & Certifications

This chapter is an honest accounting of current vs. roadmap compliance posture. Black-box vendors that won't publish their compliance status deserve more scrutiny, not less. Below is the full Earthflow position as of this methodology version.

8.1 Active Today

8.2 In Progress

8.3 Roadmap

8.4 What Is NOT Engaged (and Why)

• HIPAA / HITECH — not engaged because no protected health information enters the system.
• PCI-DSS — not engaged because no payment card data enters the system.
• GDPR data-subject rights workflows — not normally engaged because solar telemetry contains no personal data. Available on request for the small subset of cedent personnel-account data (names, emails of underwriters).
• FERPA / GLBA — out of scope.