NFPA Journal - Summer 2021 - 71

NFPA 72

CHANGES INCLUDE GUIDANCE
ON CYBERSECURITY, REMOTE ACCESS,
SURVIVABILITY, AND MORE
nfpa.org/72next

Y

OU'LL NEVER BUILD a
garden fence that's completely
impenetrable-but as long as yours is
better than your neighbors', the rabbits
are likely to go elsewhere for a meal.
It's a good rule of thumb for gardeners, and also for cybersecurity, an area
where the proverbial rabbits are getting
more creative and more aggressive all
the time.
In recognition of the increasingly
frequent malicious attacks on buildings and systems, NFPA 72®, National
Fire Alarm and Signaling Code®, will
include cybersecurity guidance for fire
alarms in its next edition, which will
be released in the fall. It's the first time
in its long history that the code has
addressed the issue.
While the concept of an alarm needing cybersecurity might have been a
headscratcher just a decade ago, as
detailed in the Spring 2021 NFPA Journal cover story, " Weak Spots, " alarms
and other connected building systems
have become popular targets for cybercriminals in recent years. Hackers are
increasingly breaching security and
other systems to gain access to servers
and other sensitive targets, where they
can install ransomware or simply steal
data and sell it. Global losses from such
attacks are in the billions of dollars
annually.
Instead of including a comprehensive list of cybersecurity requirements
in the main code, the NFPA 72 committee opted to take a more flexible
approach and put the information in
new annex material. That means that
rather than being required to follow a
minimum standard, users can select
the level of security they think they
need and use the annex to learn how
to get there. " It's like a risk assessment
and roadmap of what needs to be done
if somebody wants to pursue a certain
reasonable level of cybersecurity, " said

Richard Roux, principal specialist at
NFPA and the NFPA 72 staff liaison.
This approach was necessary because
there are so many unique factors that
make cybersecurity nuanced and situational, Roux said. Like a vegetable
garden fence, how high or how robust
to build your defenses can depend on
many factors, including what you're
protecting, how big a target you are,
and what industry you're in. All of that
" makes it hard to know where to draw
the line " when crafting a standard,
Roux said. " It's very difficult to say,
'This requirement will make the system
impervious to cyberattack or make the
system less likely to be attacked.' "
In addition to the annex, the committee also included a brief new chapter
on cybersecurity. It consists of a single
sentence, one that informs users that
cybersecurity " shall be provided for
equipment, software, firmware, tools, "
etc., where required by governing laws,
codes, or standards.
The effort to provide cybersecurity
guidance grew out of public feedback
that the NFPA 72 committee received
last cycle. When the committee convened this cycle, it formed a task group
to look at the issue, and the topic
quickly grew legs. " Users of the code
and some of our committee members
work for companies that have been
hacked, so this topic was on the tips of
their tongues, " Roux said of the interest. " It's become important to people,
particularly to those who've experienced a hack. They know it can happen
and can have significant consequences. "

REMOTE ACCESS
Related to but separate from the
cybersecurity issue, the committee
added language that specifically allows
fire alarm and signaling systems to be
accessed remotely in order to perform
tasks, including resetting, silencing,
N F PA . O R G / J O U R N A L * NFPA JOURNAL

Codes Update_Summer 2021 DCS to ADA for PDF to LP.indd 71

| 71

5/1/21 8:39 AM
http://www.nfpa.org/72next http://nfpa.org/journal
NFPA Journal - Summer 2021

Table of Contents for the Digital Edition of NFPA Journal - Summer 2021
