A look at NFPA 72’s cybersecurity requirements for network-connected fire alarm and signaling systems
The 2025 edition of NFPA 72 introduces comprehensive cybersecurity requirements aimed at safeguarding fire alarm and signaling systems with network-connectable equipment and uploadable software configurations. These requirements are designed to protect against unauthorized access, cyber threats, and ensure the integrity and reliability of critical life safety systems.
To begin with, development and production environments used to design and manufacture network-connectable fire alarm and signaling equipment must employ robust cybersecurity safeguards. The Code explains, “it does not matter how well a system is designed or deployed from a cybersecurity perspective if the manufacturer does not adequately secure its own development, manufacturing, and patch/update distribution systems” and adding the serious potential consequence that may result: “Threat actors can compromise products by installing covert back doors during initial development, or during the development and distribution of software updates.”
These safeguards should adhere to standards acceptable to a Nationally Recognized Testing Laboratory (NRTL). This foundational requirement ensures that the equipment is secure from the outset, minimizing vulnerabilities that could be exploited during its lifecycle. A popular global standard which meets these development and production environment requirements comprehensively is the ISA/IEC 62443-4-1 standard. This standard focuses on the secure product development lifecycle, integrating security measures such as threat modeling, secure coding practices, and security testing throughout the development process. By adhering to the ISA/IEC 62443-4-1 standard, manufacturers can ensure that security is built into their products from the ground up, enhancing overall system resilience, while meeting this requirement.
The Code goes on to mandate that all interfaces used to communicate with the network-connectable fire alarm and signaling equipment must be protected according to specific security levels. In other words, possess certain known security controls. For non-internet-protocol wired interfaces, the protection must meet Security Level 1 (SL1) standards as defined by either 62443-4-2, 62443-3-3, or UL 2900-2-3. For non-internet-protocol wireless interfaces or internet protocol wired and wireless interfaces that do not connect to publicly accessible networks, Security Level 2 (SL2) standards must be applied. These standards ensure a higher level of protection due to the increased risk associated with wireless and internet protocol interfaces. For interfaces that connect to publicly accessible networks, the highest level of protection, Security Level 3 (SL3), is required. This tiered approach ensures that the level of cybersecurity is commensurate with the potential risk exposure of the interface.
Examples of systems with the applicable security levels are provided. SL1 system is a fire alarm system with notification appliances and initiating devices connected via a proprietary two-wire interface, which is not connected to the internet. In contrast, a SL2 system consists of a signaling system with devices connected to a control unit using internet protocol communications on a dedicated network, also not connected to the internet. For SL3, the system includes an internet gateway module for off-premises signal transmission from a fire alarm system with notification appliances and initiating devices connected via a proprietary two-wire interface. In this case, the gateway is classified as SL3, while the remainder of the system is SL1.
Unused physical data ports must be protected to prevent unauthorized access. Additionally, external data connections from a system must be safeguarded by a gateway or firewall, adding another layer of defense against cyber threats.
Manufacturers of network-connectable fire alarm and signaling equipment are required to evaluate cybersecurity threats and issue updates on a quarterly basis. This proactive approach ensures that systems remain secure against emerging threats. System installers must provide the name and contact information of the system owner to the equipment manufacturer, facilitating direct communication regarding necessary security updates. The system owner is responsible for installing all security updates as required by the manufacturer, at least annually. This ensures that the system remains up-to-date and protected against known vulnerabilities. Furthermore, manufacturers must notify system owners when security update support is terminated, allowing owners to take necessary actions to maintain system security.
The system support tool and its interfaces are also within the scope of these requirements, ensuring comprehensive protection across all aspects of the system. An example of such a tool may be a custom designed tool that an installer would use to set up the site configuration software.
Evidence of cybersecurity compliance must include certification by a NRTL, manufacturer certification for the specific type and brand of system, or an assessment or certification program acceptable to the Authority Having Jurisdiction (AHJ). Standards used and security levels employed shall be identified in system documentation. And finally, cybersecurity certificates must be verified annually to ensure ongoing compliance.
In conclusion, the cybersecurity requirements outlined in the 2025 edition of NFPA 72 provide a robust framework for protecting fire alarm and signaling systems. By adhering to these standards, manufacturers, installers, and system owners can ensure the security and reliability of these critical life-safety systems, safeguarding them against the ever-evolving landscape of cyber threats.
A structured and comprehensive way for manufacturers to meet these NFPA 72 cybersecurity requirements is to get their development processes certified to the ISA/IEC 62443-4-1 (SDLA) standard, as well as their products to the ISA/IEC 62443-3-3 and ISA/IEC 62443-4-2 standards as applicable. This approach ensures that security is integrated throughout the product’s lifecycle, providing a holistic and effective means of achieving compliance and enhancing overall system security. Please reach out to FM Approvals at [email protected] to learn how we can support you on this journey.