NFPA 72 code sections · Advanced Topics: Addressable, Wireless & IoT
Cybersecurity is now in the code: Chapter 11
The 2022 edition added Chapter 11, Cybersecurity. Where a fire alarm or signaling system is connected to a network, remotely accessible, or shares infrastructure with other systems, it must be protected against unauthorized access and tampering: access control with individual credentials and levels, change management and records for software/firmware, protection of remote access paths, and a documented cybersecurity assessment of the installed system. Remote programming is permitted only with the owner's authorization and with a qualified person able to respond on site. A panel on the internet with the default password is now a code violation, not just a bad idea.
NFPA 72 reference
Chapter 11 — Cybersecurity (new in the 2022 edition)
11.1 Application; 11.2 General (protection of network-connected and remotely accessible systems against unauthorized access); 11.3 access control and credentials; 11.4 software/firmware change management; 23.2.2 site-specific software records; remote access authorization
References use NFPA 72 2019/2022 numbering — section numbers can shift between editions, so confirm in the edition your AHJ has adopted.
On the job
A service company connects 300 customer panels to a cloud dashboard for remote diagnostics using one shared login. A former employee logs in and disables notification at a competitor's account. Under the new chapter the company issues individual credentials with per-site authorization, enables logging of every remote session, and gets written owner authorization for remote programming at each site.
Quick check
1. Chapter 11 of NFPA 72 (2022) covers:
2. Remote programming of a fire alarm panel requires:
3. A shared login for remote access to many customer panels is:
Listen to this section
AI-narrated, about a minute.
Ask about this section
Get a plain-language explanation of what this rule requires and what to check on the job.
3 free explanations left on this device.