What the Fire Alarm Code Now Requires for Cybersecurity

Why a fire code mentions passwords

A fire alarm system is the set of devices that watches a building for fire. Smoke detectors and pull stations report to a control panel, the cabinet that decides when the horns sound. For most of a century that panel was a box on the wall, wired to its own devices and to nothing else.

That box is mostly gone from the catalog. A modern panel is a computer. Panels tie together across campuses, and they tie into the systems that run the building around them. Management workstations watch hundreds of panels at once and show the whole thing on web pages. A technician programs a panel from a laptop, and some service departments log in from across town.

NFPA 72 is the national fire alarm code, the rulebook for how these systems get designed, installed, tested, and maintained. Committees of engineers, installers, and manufacturers rewrite it on a three year cycle. The book is not law by itself. It becomes law when a state or a city adopts an edition, and then the AHJ, the local official who approves the work, enforces it. Most of the country runs an edition a cycle or two behind the newest one.

The 2025 edition carries something the trade has never had before, an enforceable chapter on cybersecurity. This piece walks through it part by part. For each part, what it says in plain words, and whose job it becomes.

How the chapter got here

The change came in three editions.

In 2016 the code added Class N, a pathway class for fire alarm equipment that communicates over a network. A pathway class is the code's way of grading the wiring that carries alarm signals. Class N recognized that alarm signals now travel on networks.

In 2022 the code added Chapter 11, titled Cybersecurity. The whole chapter was one paragraph.

Where required by governing laws, codes, or standards, or other parts of this Code, cybersecurity shall be provided for equipment, software, firmware, tools, installation methods, physical security of and access to equipment, data pathways, testing, and maintenance.

One sentence, and it only applied where some other law already required cybersecurity. The real material sat in Annex J at the back of the book as recommendations. Code language uses shall for requirements and should for advice, and an annex is advice. The committee had requirements drafted and chose the annex for that cycle.

In the 2025 edition the annex material moved into the chapter body, the shoulds became shalls, and Annex J was deleted. Where a jurisdiction adopts the 2025 edition, Chapter 11 is law.

Who the chapter talks to

The parts of the chapter sort by who carries them. Some belong to the manufacturer, in its own factory. Most belong to the company that designs, installs, and tests the system. A few belong to the building owner. Those may be the biggest surprise in the chapter, because owners have never had fire alarm cybersecurity duties before.

The chapter, part by part

The scope and the standalone exemption

The chapter opens with its one exemption, at 11.1.2, and it runs narrow. No minimum cybersecurity level is required only for systems that meet both of two conditions, no network connectable equipment and no uploadable software configuration. Read the second condition slowly. A panel that gets its program uploaded from a laptop has uploadable software configuration, network cable or no network cable. The code's annex gives its own example of an exempt system, "a dip-switch configurable control unit with no network connection." A dip switch is a row of tiny physical switches set by hand. That describes gear that barely ships anymore. Under this chapter, almost nothing sold today counts as standalone.

Whose job: the designer, when the system is first laid out.

The definitions

The chapter's key term is network connectable equipment, defined as system components that connect to "the internet or external systems" through wired or wireless pathways. The annex gives examples of external systems: building controls, and elevator controls. The definition does not ask whether the connection reaches the internet. A fire panel tied to the building automation front end is network connectable equipment. So is one tied into the elevator controller, with no internet anywhere in the building.

Whose job: everyone reading the rest of the chapter, because this definition decides what the chapter touches.

The manufacturer's own shop

Section 11.2 covers something no fire code has covered before, the vendor's own development and production environment. The factory that builds network connectable equipment must run its own operation under recognized security standards, with several named frameworks accepted. The committee's reasoning is on the record: a well designed system still fails if the factory or the update pipeline behind it is compromised. An attacker who corrupts the software update never needs to visit the building.

Whose job: the manufacturer. And the spec writer who asks for proof.

The security levels

Section 11.3 assigns a minimum security level to every interface used to communicate with network connectable equipment. An interface is any port or connection the equipment talks through. The levels come from two published industrial security standards, one from the automation world and one from UL.

The assignment follows the interface. Wired connections that carry no internet protocol get Level 1, the lowest. Anything wireless gets Level 2, and it gets Level 2 whether or not the internet is anywhere nearby. The top level goes to interfaces that face the internet or sit on a network the public can reach. The code never asks whether the owner considers the system isolated. It grades each connection by what it is, and a system with no internet still gets graded at Level 1.

Whose job: the designer picking equipment, and the installer landing the pathways the design calls for.

The physical pathways

Section 11.4 covers the wiring itself. Pathways serving Security Level 2 or higher get metal raceways or metal armored cables wherever the public can reach them. The annex recommends the same protection even at Level 1. It also suggests tamper switches on enclosures outside restricted areas, so opening the box sends a signal. Whose job: the designer who calls it out, and the installer who runs it.

Shared pathways

Section 11.5 covers fire alarm data that rides wiring shared with other building traffic. The code grades sharing in four levels. At the bottom, life safety data mixes freely with everything else. In the middle, it gets priority, then full separation. At the top, the pathway equipment is dedicated to the life safety system. Any connection to an outside network passes through a gateway or firewall that admits trusted traffic only. Section 11.5 ties those pathway rules to the documentation rules. The cyber requirements and the wiring requirements point at each other instead of living in separate chapters.

Whose job: the designer who picks the pathway level, and the installer who wires to it.

Unused ports

Section 11.6 covers unused data ports, connection points on the equipment with nothing plugged into them. Every one on the system must be dealt with. The code accepts a physical barrier over the port. Turning it off in software works too, and so does a login in front of it. Open ports inside panel cabinets have been common in this industry forever. They are a code item now.

Whose job: the installer at trim out, and the technician on every service call after, because ports get reopened and forgotten.

Updates and remote access

Sections 11.7 and 11.8 make security patching recognized work with a schedule attached. The manufacturer must evaluate cybersecurity threats at least quarterly for as long as it supports the equipment. Updates the manufacturer deems necessary get installed at least annually. The installer hands the manufacturer the owner's contact information at acceptance testing, so the update notices reach the right person. A firewall or gateway patch that does not touch the panel's operating software skips the formal retest that normally follows software changes. Cybersecurity changes are allowed over remote access, under the remote access rules the code already carries elsewhere. The retest requirement was a common reason these systems stayed unpatched. For these patches the code removed it.

Whose job: the service department, on a schedule.

The end-of-support notice

Section 11.9 is short and new. The manufacturer must notify the system owner when cybersecurity update support for any part of the system ends. A fire alarm system now has a declared support lifespan, and the owner is entitled to the notice. When that notice arrives, the equipment will never be patched again, and the owner has a decision to make.

Whose job: the manufacturer sends it. The owner has to act on it.

Keeping it verified

The chapter's last sections add cybersecurity to routine maintenance. Certification of the equipment gets checked. Once a year, the person testing the system verifies that the manufacturer's contact information for the owner is still valid. That second item exists so the end-of-support notice from 11.9 can actually arrive. A cybersecurity task now sits on the inspection and testing schedule next to the smoke detector sensitivity checks.

Whose job: the person testing the system, annually.

The credential rules, filed under documentation

The committee put the credential requirements in Chapter 7, the documentation chapter. That chapter governs the system's records, and the committee treated credentials as one more record to keep.

Section 7.6.7 puts one sentence at the center of the maintenance plan. The plan must identify, in the code's words, the following.

all accounts, personnel, and organizations with electronic access credentials that could be used by a cybersecurity threat actor.

Those credentials get reviewed every year, trimmed to the least access each person needs, and removed when no longer required. The owner must keep access logs for any equipment that supports remote access. Once a year he reviews those logs against the maintenance records to confirm every login was supposed to happen.

The committee gave its reason in one line: a significant number of cybersecurity incidents come through credentials. The annex behind the section describes the field as it actually stands. Equipment ships with account names like admin and password, and logins get shared because the gear cannot manage individual users. Access outlives the employee. The annex names that case plainly, the terminated worker whose credentials nobody revoked.

Whose job: the shop writes the plan. The owner keeps the logs.

One live example

On 20 Aug 26 the Cybersecurity and Infrastructure Security Agency (CISA) published an advisory for Simplex Incident Manager. CISA is the federal office that warns the country about computer threats. The product is a fire alarm management workstation that can watch up to 687 panels from a web page. The flaw: it held user passwords unencrypted in memory while running. It was medium severity, reported by the manufacturer itself, and patched. The chapter described above asks the trade for credential discipline. The advisory describes the management workstation failing at exactly that. The full story is in our report on that advisory.

My thoughts on standalone

My thing with standalone is, most project managers and facility managers use it as an easy pass, just to clear the requirements. But even if it's "standalone" now, the chances are high it's going to connect to a network at some point, likely sooner than later. Therefore, people should take this seriously. Treat every "standalone" system as an attack vector that can sit dormant until it's connected, holding a malicious payload until the time is right. Don't skirt cyber requirements because you don't understand them or they don't seem important now. And if you're designing, installing, or maintaining, don't set your client up for disaster.

Key Takeaways

• Since the 2025 edition, NFPA 72 carries an enforceable cybersecurity chapter, binding wherever that edition is adopted.
• The standalone exemption requires two things at once, no network connectable equipment and no uploadable software configuration. A panel programmed from a laptop fails the second test.
• Security levels follow the interface, and staying off the internet earns the lowest level instead of an exemption.
• Credential documentation is mandatory. The maintenance plan names every account, and the owner keeps and reviews access logs.
• A fire alarm system now has a declared security patch lifespan, and the manufacturer must tell the owner when it ends.
• Most systems labeled standalone will connect to a network eventually. Treat the label as temporary.