Security Sales & Integration March 2022 - 26

SMARTS & PARTS
Fire Side Chat by Shane Clary
Making Sense
of NFPA 72's
Cybersecurity
Section
While in most
jurisdictions
the 2022
edition will not
be adopted
for a while, I
recommend all
who install fi re
alarm systems
take a look at
Annex J.
Shane Clary, Ph.D., has
more than 45 years of
security and fi re alarm
industry experience. He
serves on a number of
NFPA technical committees,
and is Vice President of
Codes and Standards
Compliance for Concord,
Calif.-headquartered Bay
Alarm Co.
26
▶ AT THE AUGUST 2021 NFPA Standards
Council meeting, the 2022 edition of NFPA 72
was approved for publication. Copies may now
be obtained through the association. Th ere are
several changes I will be reviewing in the next
couple of columns. Th is month I shall cover one
of the more controversial additions to the standard:
cybersecurity.
Th is is a hot topic within a number of technical
committees, not only for NFPA 72, but others
as well. Depending on some possible decisions by
the Standards Council, there may be a project and
technical committee that is dedicated to cybersecurity
that other technical committees could then
reference. At the time of this writing, I am aware
of no decision being made.
Th ere also may be a new technical committee
formed within the 72 project that is dedicated to
this subject that will be responsible for the new
Chapter 11 that is in the 2022 edition, Cybersecurity.
For the 2022 edition, two primary technical
committees took on the bulk of this topic. Th ey
were Fundamentals of Fire Alarm and Signaling
Systems (SIG-FUN) and Single- and Multiple-Station
Alarms and Household Signaling Systems
(SIG-HOU). Th e two committees went in
diff erent directions.
SIG-FUN took a more conservative approach
for the fi rst reference of cybersecurity and placed
all the requirements within the Annex to a new
Chapter 11, Cybersecurity. Th ere is a single paragraph
within this chapter:
11.1* Cybersecurity. Where required by governing
laws, codes, or standards, or other parts
of this Code, cybersecurity shall be provided for
equipment, software, fi rmware, tools, installation
methods, physical security of and access to equipment,
data pathways, testing, and maintenance.
Th ere is however an indication that there is annex
material to paragraph.
Security Sales & Integration MARCH 2022
smclary@bayalarm.com
A.11.1 Cybersecurity is not required for every
system or application; it is only required when
other sections of this Code, authorities, or regulations
mandate that cybersecurity be incorporated
into the system(s). Generally, there are greater cybersecurity
concerns when systems are connected
to external networks.
Cybersecurity recommendations are contained
in Annex J.
Th e annex is clear that not every system may
require cybersecurity measures to be taken. Th e
requirements may come into play where an AHJ
may require such measures, or when the system is
connected to an outside network. It is the latter
that is of the greatest concern.
Most if not all fi re alarm systems that are being
installed today do have some sort of connection to
the outside world. While this is typically through
either the public switched telephone network or
cellular transmitters, it may also be through the
Internet. Th is is the most troubling source of a
possible attack.
Within this paragraph, there is reference to a
new Annex J, Guidelines for Cybersecurity. Th is
was originally to be within the main body of the
standard, with the " should " being " shall. " Th e
committee, after discussions and task group work
between the First Draft Meetings and Second
Draft Meetings, made the decision to place the
requirements into an annex for at least one cycle
of the standard.
Th e reason for this is found within Section J.1:
Th e Technical Committee has determined that, in
lieu of establishing requirements in Chapter 11 on
cybersecurity at this time, it is appropriate to provide
such guidance and framework in this annex. Th is allows
the industry and the public the ability to gain
experience with cybersecurity measures and provide
constructive feedback for future editions of this Code.
While in most jurisdictions the 2022 edition
will not be adopted for a while, I would recommend
that all who install fi re alarm systems take a
look at Annex J, that can be found at no cost on
the NFPA website (www.nfpa.org) and then go to
the Codes and Standards tab.
While the fundamentals committee went the
route just described, the household committee
made a determination to place cybersecurity requirements
within the main body of the standard.
To view the requirements, check out the full version
of this column online at securitysales.com/
nfpa-cyber.
securitysales.com
http://www.nfpa.org http://www.securitysales.com/ http://www.securitysales.com
Security Sales & Integration March 2022

Table of Contents for the Digital Edition of Security Sales & Integration March 2022
