Track farm machinery software the way you track equipment: a register of machines, controller and firmware versions, and the maker or dealer who supplies updates. Ask manufacturers for component lists per firmware release, and schedule updates in the quiet season, not in the middle of planting or harvest.
This is general guidance for equipment owners, dealers and manufacturers. It cites no incident and no specific brand.
Why does this sector have its own timing problem?
CISA describes the US Food and Agriculture Sector as almost entirely privately owned, with an estimated 1.9 million farms. It also notes the sector depends on energy to power equipment, on transportation to move product and on chemicals for fertilizers. A machine that cannot start in the work window has a cost no spreadsheet shows.
CISA's Critical Manufacturing page lists earth moving, mining, agricultural and construction equipment manufacturing within the machinery manufacturing industries. So the makers of this equipment sit in a sector CISA treats as nationally significant.
The timing issue is simple. Software changes are cheap in January and costly in May. An update that fails in the field during planting can idle a machine at the worst moment, so updates and testing belong in the off season.
What is in a modern machine?
Typically several controllers: engine, transmission, implement control, guidance and a telematics unit that connects to the maker's cloud. Each has firmware, usually supplied by a different vendor, with open source and commercial libraries inside. Dealers may apply updates with service tools. Owners may use mobile apps.
An SBOM, in CISA's words a nested inventory of the ingredients in software components, is the way to see inside those layers. The maker holds the list. You hold the machine.
What should each party do?
Owners and farm managers. Keep a register: model, serial, controller versions, telematics subscription, dealer contact. Ask the dealer which updates are pending and when they will be applied. Change default passwords on any connected gateway and remove unused remote access.
Dealers. Treat service laptops and update tools as sensitive. They carry software into many machines. Keep them patched and separate from guest networks.
Manufacturers. Publish component lists for firmware releases to customers who ask, notify when a component has a known vulnerability, and state how long each machine model gets updates. Industrial standards give a vocabulary: the ISA/IEC 62443 series, as titled on ISA's page, includes a secure product development lifecycle part for suppliers and a part on technical requirements for components. We read titles only, so read the text before you cite requirements.
NIST's SP 800-82 Revision 3 is aimed at operational technology in general and mentions transportation systems among examples. It is a useful reference for the ideas of segmentation and careful change, even where farm equipment is not named.
What about connected services?
Telematics and fleet portals are web services with accounts. Use unique passwords and multi factor sign in where offered, and remove ex-employees and old contractors. CISA also publishes a Food and Agriculture Sector cybersecurity fact sheet with voluntary steps and no cost resources, which is a good place for a small operation to begin.
What to do
- Build a register of machines with controller and firmware versions.
- Ask each manufacturer or dealer for a component list per firmware release.
- Record which machines have no available list and mark them as known gaps.
- Schedule update and test windows in the off season, with a rollback plan.
- Secure telematics and fleet accounts with unique passwords and multi factor sign in.
- Keep dealer and service laptops patched and off shared networks.
- Ask each manufacturer how long a model will receive security updates.
- Review the register after every update season.
Quick check
Do I need an SBOM as a farm owner?
You will rarely produce one. You can ask your maker or dealer for one, and use the register of versions to check advisories against your machines.
When should machines be updated?
Plan updates in the quiet season so a failure does not hit during planting or harvest.
Sources
- Food and Agriculture Sector, CISA, fetched 18 October 2026
- Critical Manufacturing Sector, CISA, fetched 18 October 2026
- ISA/IEC 62443 series of standards, ISA, fetched 18 October 2026
- NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security, fetched 18 October 2026
- Software Bill of Materials (SBOM), CISA, fetched 18 October 2026
Last reviewed: 18 October 2026.
