NFPA 72 cybersecurity requirements moved from annex guidance into enforceable code in the 2025 edition. Chapter 11 applies to network connectable equipment and calls for documented cybersecurity protocols, records of who has access, procedures for removing credentials and regular security updates. Adoption varies by jurisdiction, so confirm which edition your AHJ enforces.
For years, cybersecurity on fire alarm systems lived in the gray zone. Everyone agreed it mattered, but nobody could point to a requirement. Meanwhile, panels went on the network, communicators moved to IP and cellular paths and owners started asking for remote access. You were left making judgment calls without a code section to back you up.
That’s changed. Here’s what the current edition asks for and how to put it into practice on your next job.
What changed with NFPA 72 cybersecurity requirements?
In earlier editions, cybersecurity guidance sat in an annex. It was helpful, but not enforceable. The 2025 edition moved that content into Chapter 11 as enforceable requirements for network-connected fire alarm equipment.
While NFPA 72 2025 is the current edition, it’s important to remember that many jurisdictions still enforce an older edition. If your AHJ hasn’t adopted the 2025 edition, these rules may not be mandatory on your project yet,
What counts as network connectable equipment?
The summary describes network connectable equipment as any system component that connects to the internet or external systems. On a typical job, that can include:
- IP and cellular communicators. Any path that carries signals off the premises over a network.
- Networked control units. Panels and nodes connected over an IP network, especially where that network is shared with other building systems.
- Gateways and integrations. Interfaces to building management systems, mass notification or other platforms.
- Remote access tools. Software or devices that let you or the owner reach the panel from off site.
If the equipment “talks” to anything beyond the fire alarm system’s own wiring, treat it as in scope until your AHJ tells you otherwise.
What does Chapter 11 ask you to document?
- Cybersecurity protocols: Systems need documented cybersecurity protocols. These include security levels based on equipment access and configuration controls that prevent tampering. In plain terms, you should be able to show who can change what, and how unauthorized changes are blocked.
- Access records and credential removal: Each system needs a record of the people who have access rights. It also needs a procedure for removing credentials when staff changes happen. That applies to your techs and to the owner’s people. When a tech leaves your company, their panel logins should leave with them.
- Security updates: The requirements call for regular security updates, with references to ANSI/ISA standards. Work with manufacturers to understand how firmware and software security updates are released, tested, and applied. Then document when each update was installed.
- Inspection records: According to the summary, technicians are expected to document that cybersecurity measures are in place during inspections. That means security records become part of your inspection work, not a separate IT project.
What about cloud signal forwarding and auxiliary service providers?
The 2025 edition also defines auxiliary service providers, which are cloud-based services that receive signals and forward them to supervising stations. As more alarm traffic moves through cloud platforms, that definition closes a gap that had been growing for years.
The summary lists supervision of communication paths, UL 827 compliance and retention of signal records for at least one year among the requirements. If your monitoring arrangement routes signals through a cloud platform, ask your provider how they meet those requirements and get the answer in writing.
Putting NFPA 72 cybersecurity requirements into practice
Kill the default passwords
Default credentials on panels, communicators and gateways are the easiest unsecure door to close. Change the default passwords at commissioning, use unique credentials per site, and record them in a secure place. Never leave the credentials on a sticker inside the panel door.
Control remote access
Remote access may save truck rolls, but it’s also the biggest exposure to nefarious actors hiding behind their keyboards. Decide who needs access, how they connect and how sessions are logged. Turn it off when it isn’t needed and document the setup so the next tech and the AHJ can follow it.
Map your communicator and IP paths
Know exactly how network signals leave the building. Document each path, the network it rides on, and who manages that network. If a firewall change by the owner’s IT team can suddenly break your primary communication path, you need to know before it happens.
Build documentation the AHJ can review
Put your cybersecurity protocols, access list, credential removal procedure, and update history in one package. Keep it with the system records. When an AHJ asks how the system is protected, hand them an organized and well thought out document instead of an extemporaneous verbal explanation.
Coordinate with the owner’s IT team
Fire alarm equipment on a shared network is now partly an IT conversation. Meet with the owner’s IT staff early. Agree on who manages switches, firewalls, VLANs and updates. Put responsibilities in writing so nothing falls between the two teams.
Get this wrong and the consequences are serious. A compromised or misconfigured panel can lose its signal path, accept unauthorized changes, or fail an AHJ review. Get it right, and you deliver a system that’s secure, documented, and easy to defend.
Strengthen your fire alarm skills with Fire Tech
Cybersecurity is now part of the job, and it’s one more thing to keep up with. You don’t have to figure it out alone. Fire Tech is a NICET Recognized Training Provider and ICC Preferred Education Provider, and we build training around the work you do in the field.
Explore our online fire alarm courses to build your design, installation and ITM knowledge at your own pace. Not sure where to start? Our fire alarm learning paths lay out a clear route for every stage of your career. For us, #NeverStopLearning isn’t just a hashtag. It’s how we help you stay ready for what’s next.
If keeping up with edition changes feels like a moving target, our post on staying current with NFPA 72 and your CPDs offers a plan. Pairing that with learning paths and bundles for your CEUs keeps renewal simple.
Frequently asked questions
Which NFPA 72 edition includes the cybersecurity requirements?
The 2025 edition moved cybersecurity from annex guidance into enforceable requirements in Chapter 11. Whether they apply to your project depends on the edition your jurisdiction has adopted. Many areas still enforce older editions. Check with your AHJ and consider following the 2025 requirements as a best practice, even where they aren’t mandatory yet.
Do the requirements apply to every fire alarm system?
They apply to network connectable equipment, meaning components that connect to the internet or external systems. A stand-alone system with no network connections has far less exposure. Most modern systems include at least one connected component, though, such as an IP or cellular communicator, so review each job rather than assuming it’s exempt.
Who is responsible for fire alarm cybersecurity, the contractor or the owner?
Usually both. The contractor configures, documents, and maintains the fire alarm equipment. The owner often controls the network it rides on. Spell out responsibilities for credentials, network changes, and security updates in your contract or system documentation. Clear roles prevent gaps that neither side notices until something fails.
What should I document during inspections?
According to secondary summaries of the 2025 edition, inspection records should show that cybersecurity measures are in place. Confirm that credentials are current, former staff access has been removed, updates are recorded, and remote access matches the documented setup. Note findings on the report the same way you’d note any other deficiency.
