BMW-targeted concept demonstration. Operational entities, suppliers, parts, inventory, production, financial values and incident conditions are synthetic and do not represent BMW systems, performance or current exposure.
Evidence & assurance center
A second reviewer should be able to reproduce every conclusion from this page alone.
Evidence records
8
Not current
1
Unapproved
2
Unresolved part–line pairs
1
Evidence register
| ID | Statement supported | Who provided it | Record | Validated | Approved by | Current | Decisions relying on it |
|---|---|---|---|---|---|---|---|
| EV-1 | Meridian incident notification letter supplier statement | Meridian Stamping — VP Operations | Email 2026-03-17 08:12Z, ref MS-IR-4471 | 2026-03-17 | A. Fournier, CISO Office | current | Incident scope Affected systems GATE-01 Affected environment identified |
| EV-2 | EDI 997 acknowledgement gap report system record | OEM EDI Broker | B2Bi monitor export 2026-03-17 09:40Z | 2026-03-17 | J. Lindqvist, ERP | current | Interface status Confirmed inbound supply ACT-12 Rebuild EDI queue backlog handling |
| EV-3 | SC Assembly on-hand count — critical stampings system record | SC Assembly WMS | Cycle count batch 2026-03-17 06:00Z | 2026-03-17 | K. Ruiz, Materials | current | Runout for LN-1 Runout for LN-2 ACT-04 Confirm affected part numbers at SC Assembly and Saltillo |
| EV-4 | Saltillo on-hand count system record | Synthetic Saltillo WMS | Extract 2026-03-16 22:00Z | 2026-03-16 | not approved | current | Runout for LN-4 Runout for LN-5 |
| EV-5 | Northbend alternate-source qualification document | T. Nakamura, Procurement | PPAP file NB-2231, level 3 | 2026-01-12 | D. Whitcomb, Quality | current | Alternate source ALT-1 ACT-08 Contact Northbend Castings for alternate supply |
| EV-6 | Belmont alternate-source qualification document | T. Nakamura, Procurement | PPAP file BM-1180, level 2 (partial) | 2025-05-10 | not approved | not current | Alternate source ALT-2 |
| EV-7 | Manual EDI workaround test record test result | S. Bhatt, Continuity | BCP-1 tabletop + live keying, 2026-10-26 | 2025-10-26 | S. Bhatt, Continuity | current | Continuity plan BCP-1 capacity ACT-10 Activate manual EDI processing (BCP-1) |
| EV-8 | Supplier tunnel isolation confirmation system record | A. Fournier, CISO Office | Firewall change CHG-88214, 2026-03-17 09:05Z | 2026-03-17 | A. Fournier, CISO Office | current | Containment status ACT-01 Isolate Meridian B2B tunnel GATE-02 Containment completed |
Open evidence gaps
- ▲Meridian has not confirmed whether shipment and release data was altered before encryption.
- ▲6 part–line pairs in the traced set have no current inventory record.
- ▲Belmont Die Casting qualification (ALT-2) is 311 days old and unapproved.
- ▲SC Assembly build-ahead bank plan (BCP-3) has never been tested.
- ■Gate 3 “Credentials rotated” has no evidence attached — All shared service accounts, keys and portal identities rotated on both sides.
- ■Gate 4 “Malicious persistence addressed” has no evidence attached — Evidence that persistence mechanisms were removed and the estate rebuilt or cleaned.
- ■Gate 5 “Data integrity validated” has no evidence attached — Supplier proves order, release and shipment data is complete and unaltered.
- ■Gate 6 “Critical interface tested” has no evidence attached — 830, 862 and 856 exchanged successfully in a controlled test window.
- ■Gate 7 “Business transaction completed” has no evidence attached — One real purchase order, release and receipt processed end to end.
- ■Gate 8 “Production or service test passed” has no evidence attached — Received material consumed on line without sequencing or quality exception.
- ■Gate 9 “Cybersecurity approval recorded” has no evidence attached — Named security approver signs off with evidence references.
- ■Gate 10 “Operational approval recorded” has no evidence attached — Named operations approver signs off on continuity exit.
- ■Gate 11 “Reconnection authorised” has no evidence attached — Executive authorisation recorded; tunnel re-enabled under monitoring.