An elevator is a machine run by programmable controllers, which means it has firmware, libraries and network links like any other connected system. Building owners and maintenance firms can ask suppliers for a software bill of materials and a hardware parts list, then track them the way they track mechanical parts.
A note on sources: we found no elevator-specific cybersecurity standard among the primary sources we checked for this post. What follows applies general operational technology guidance, and says where that is our inference.
Why would an elevator need an SBOM?
NIST's Guide to Operational Technology Security, SP 800-82 Revision 3, describes OT as programmable systems and devices that interact with the physical environment. Its examples include industrial control systems, building automation systems, transportation systems and physical access control systems. A passenger elevator controller is a programmable device that moves people through a building. It is our reading that this puts it within the spirit of that description, and your risk assessment should decide how.
A bill of materials answers a plain maintenance question: when a flaw is published in a library or a chip, are we running it? Without a list, the answer takes weeks of calls to the manufacturer.
What kinds of bills of materials exist?
Software BOM. NTIA's minimum elements include supplier name, component name, version, other unique identifiers, dependency relationship, the author of the SBOM data and a timestamp. NTIA names SPDX, CycloneDX and SWID tags as formats that can carry these fields.
Hardware BOM. CISA's September 2023 Hardware Bill of Materials Framework gives vendors a consistent way to describe hardware components to buyers. Its taxonomy includes component part information and production details, and it records the firmware version shipped with a component. The framework itself says it stops short of examining the provenance of that firmware.
That limit matters. A parts list tells you which controller board you own and which firmware version it shipped with. It does not prove the firmware is clean.
What can a building owner actually do?
Most owners do not write firmware. They buy equipment and service contracts. So the lever is procurement and contracts.
- Ask the manufacturer for an SBOM covering controller software, and for firmware version history.
- Ask how security advisories reach you and how fast fixes ship.
- Ask what remote access the service provider uses, and who holds the credentials.
- Require notice before any firmware update, with a rollback plan.
- Keep an asset list that records each unit, controller model and firmware version.
For the remote access question, NIST's OT guidance is the right reference for segmenting control networks and limiting connections. Treat the elevator controller network as separate from guest and office networks.
What do maintenance contractors need to change?
Service laptops and remote tools are the usual bridge into controllers. Keep them inventoried and patched. Record every maintenance session, including what was connected and what was changed. If a contractor needs a standing remote connection, ask for multi-factor authentication and a log of sessions.
What should a calm response look like?
If a vulnerability affects a controller, your first step is a lookup in the asset list, then a call to the manufacturer with exact model and firmware version. Do not take elevators out of service on a hunch. Safety functions are specified separately from security, and decisions about them belong with the manufacturer and your licensed service provider.
What to do
- Build an asset list of every elevator controller, with model and firmware version.
- Request SBOMs and hardware part lists from manufacturers, in a named format.
- Add advisory notice and fix timelines to service contracts.
- Separate the controller network from other building networks.
- Require logged, multi-factor remote access for contractors.
- Test a firmware update on a non-critical unit first, if the manufacturer allows it.
- Review the list twice a year.
Quick check
Is there an official SBOM format for hardware?
CISA published a Hardware Bill of Materials Framework in September 2023 with a data taxonomy. It is a framework for vendors, not a regulation.
Does an SBOM prove firmware is safe?
No. It lists what is inside. CISA's HBOM framework itself stops short of examining firmware provenance.
Sources
- NIST SP 800-82 Rev. 3: Guide to Operational Technology (OT) Security
- NTIA: The Minimum Elements For a Software Bill of Materials (PDF)
- CISA: A Hardware Bill of Materials (HBOM) Framework for Supply Chain Risk Management (PDF)
Last reviewed: 18 October 2026.
