Supplier operating model — synthetic demonstration data. BMW's contractual incident obligations are real; the supplier, orders, parts, inventory, capacities and projections below are illustrative and unvalidated.
Meridian Precision Systems (fictional tier 1) · Modeled plant Ehingen and Modeled plant Kosice · SAP ECC (modeled) · incident SUP-INC-2026-014
Customer has isolated this supplier
Can the supplier preserve the next customer delivery without creating additional cyber, quality or traceability risk?
Ransomware disabled the supplier's ERP and EDI services. The customer isolated all system connections pending evidence. Physical production capability is partially available.
Customer orders due in 48 h
14
[M]Modeled
Part families affected
3
[M]Modeled
Cells dependent on unavailable ERP
2
[M]Modeled
Manual shipping processes available
1
[M]Modeled
EDI
Unavailable
[M]Modeled
Inventory confirmation
Incomplete
[M]Modeled
Reconnection
Prohibited pending evidence
[M]Modeled
Delivery confidence
Moderate
[M]Modeled
Answer
12 of 14 customer commitments can be preserved under the approved offline process. 2 require a customer decision. Reconnection stays prohibited until the gating evidence is complete.
preserved = count(orders where confirmed finished goods + offline-releasable WIP ≥ quantity AND quality release AND lot traceability), capped at manual shipping capacity
Customer commitments — ordered by time remaining
Manual capacity 12 shipments per 48 hours (PROC-OFFLINE-SHIP-02, approved by Modeled logistics and quality management). One modeled site counted; the second site's positions are unconfirmed and excluded from commitments.
ORD-4401 · Bracket assembly · 480 units
due in 9 h
Preserved by the supplier — Covered by 480 physically confirmed finished goods.
ORD-4402 · Bracket assembly · 360 units
due in 14 h
Preserved by the supplier — Covered by 360 physically confirmed finished goods.
ORD-4403 · Sensor housing · 240 units
due in 16 h
Preserved by the supplier — Covered by 240 physically confirmed finished goods.
ORD-4404 · Sensor housing · 300 units
due in 20 h
Preserved by the supplier — Covered by 180 confirmed finished goods plus 120 units released offline from Modeled cell 2 — machining.
ORD-4405 · Cooling duct · 200 units
due in 22 h
Preserved by the supplier — Covered by 200 physically confirmed finished goods.
ORD-4406 · Bracket assembly · 150 units
due in 25 h
Preserved by the supplier — Covered by 150 physically confirmed finished goods.
ORD-4413 · Sensor housing · 340 units
due in 26 h
Customer decision required — Confirmed stock and releasable work in progress cover 90 of 340; 250 units require a customer decision.
Blockers: Shortfall of 250 units
ORD-4407 · Sensor housing · 260 units
due in 28 h
Preserved by the supplier — Covered by 120 confirmed finished goods plus 140 units released offline from Modeled cell 2 — machining.
ORD-4408 · Cooling duct · 180 units
due in 30 h
Preserved by the supplier — Covered by 180 physically confirmed finished goods.
ORD-4414 · Cooling duct · 220 units
due in 31 h
Customer decision required — Shipping would create quality or traceability risk; customer concession or inspection required.
Blockers: No offline quality release record; No offline lot traceability
ORD-4409 · Bracket assembly · 420 units
due in 33 h
Preserved by the supplier — Covered by 420 physically confirmed finished goods.
ORD-4410 · Sensor housing · 210 units
due in 36 h
Preserved by the supplier — Covered by 210 physically confirmed finished goods.
ORD-4411 · Cooling duct · 260 units
due in 39 h
Preserved by the supplier — Covered by 260 physically confirmed finished goods.
ORD-4412 · Bracket assembly · 300 units
due in 42 h
Preserved by the supplier — Covered by 300 physically confirmed finished goods.
Confidence basis
· Only physically confirmed finished goods are counted; unconfirmed positions are excluded.
· Work in progress counts only where an approved offline release procedure exists.
· Manual shipping capacity of 12 shipments per 48 hours applied as a hard limit.
· One modeled site counted; the second site's positions are unconfirmed and excluded from commitments.
Defensible position
BMW knows the risk and has built detection and governance. The remaining exposure is whether individual suppliers can continue delivering while isolated and prove they are safe to reconnect. P3 and Athena make that supplier response executable, measurable and verifiable.
First buyer: a BMW-connected tier 1 or critical tier 2 supplier dependent on SAP and EDI, with contractual incident obligations and limited internal cyber-recovery capacity — not BMW.
If P3 cannot provide access to BMW-connected suppliers, BMW should not be treated as the target use case: the design would rest on public documents and assumptions.