Inspect four things first on agricultural machinery: what connected equipment you have and what software it runs, how it is reached remotely, how it gets updates, and what it shares data with. Then apply operational technology guidance. This is a planning list; we cite no incident, since none is needed to justify the checks.
Why does farm equipment belong in a security conversation?
CISA describes the US Food and Agriculture Sector as almost entirely privately owned, with an estimated 1.9 million farms, more than 700,000 restaurants and over 220,000 registered food manufacturing, processing and storage facilities. It depends on water, transportation, energy and chemical sectors. CISA offers a no cost Food and Agriculture cybersecurity fact sheet and related services such as vulnerability scanning and StopRansomware.gov.
The CISA page we fetched does not discuss operational technology, precision agriculture or farm machinery, so the guidance below comes from general OT standards, not from a sector specific source. Check with your equipment makers and your national agriculture authority for rules specific to machinery.
Which standards give you a frame?
NIST SP 800-82 Rev. 3, published September 2023, is the guide to OT security. It covers programmable systems that monitor or control physical processes, with examples including industrial control systems, building automation and transportation systems. It describes typical topologies and threats and recommends countermeasures that respect performance, reliability and safety. The page notes an initial public draft of Revision 4 open for comment until 30 November 2026.
ISA/IEC 62443 is a series for industrial automation and control systems built on shared responsibility. Part 4-1 covers secure product development lifecycle requirements and Part 4-2 covers technical security requirements for components, aimed at product suppliers. Part 2-1 covers security programs for asset owners, and a technical report covers patch management. Farm machinery is not the same as an industrial plant, so use these as a vocabulary and a checklist, not as a claim of coverage.
What do you inspect first?
1. Inventory. List each tractor, harvester, sprayer, drone, grain system and controller that has a network connection, telematics unit or software update capability. Record make, model, software version and owner. You cannot protect what you have not listed.
2. Remote access. Many machines are reachable through the manufacturer's cloud, dealer tools, cellular modems or farm management apps. Who can connect, with what credentials, and can you see the access log? Default and shared passwords go to the top of the fix list.
3. Update path. How does software reach the machine: over the air, a dealer visit, a USB stick? Who approves it, and can you verify what was installed? NIST SP 800-82 treats patching of OT as a planned activity because of safety and uptime.
4. Data flows. Where do yield maps, location and machine data go? To the manufacturer, to an agronomy platform, to a contractor? Know which accounts hold them and who can export them.
5. Dependencies. Ask for a software bill of materials for machine software and for the apps connected to it. When a library vulnerability makes news, you want to know whether it is in your fleet within hours.
6. Network placement. Keep machine and controller networks apart from office and guest networks, and restrict traffic to what is needed.
7. Seasonal fragility. A failure at planting or harvest has a cost far above one at other times. Plan updates for off season and test fallbacks, including manual operation.
What are the limits?
Many farm operations are small and have no security staff. Controls should be few and concrete. A manufacturer's cloud may be the only way to update a machine, so your influence is in purchasing: ask suppliers for what you need before you buy.
What to do
- Build a list of every connected machine and controller with version and owner.
- Change default credentials and remove shared accounts on remote access tools.
- Ask each manufacturer for its update process, an SBOM and a security contact.
- Separate machine networks from office and guest networks.
- Schedule updates off season and keep a manual fallback.
- Map the data flows from each machine and review who has access.
- Download CISA's Food and Agriculture fact sheet and compare it to your list.
Safeguard can inventory the software you build or manage and match advisories to SBOMs, but equipment firmware from a manufacturer must come through their disclosure process.
Quick check
Is IEC 62443 written for farms?
No. It targets industrial automation and control systems. Use it as a frame, with judgment.
What is the first thing to do with no budget?
Make the inventory and change default or shared credentials on remote access.
Sources
Last reviewed: 18 October 2026.
