CyberCQR Good Practice Guide · Network security

Securing connected devices in the office: a good practice guide

How a UK firm of up to 2,000 people can find the CCTV, door access, heating, alarms, lighting and other connected devices in its buildings, separate them from its data, control who can reach them and recover if one is misused. It includes a register template, a network separation design, supplier connection rules, buying questions, contract clauses and a recovery plan.

CyberCQR Good Practice Guide · Version 1.1 · Reading time about 16 minutes

Summary

In October and November 2026, attackers took over smart refrigeration in hundreds of European supermarkets. The controllers were open to the internet, managed remotely by contractors and in many cases past their support date [1] [2]. Most offices have equipment in the same condition. The National Cyber Security Centre (NCSC) warns that such kit is often reachable online and likely to be used as a pivot point into corporate networks [3]. This guide sets out the controls in five groups: find the devices, separate them, own the access, keep them current, and be ready to notice and recover.

How to use this guide. Part 1 summarises the guidance, and 2 explains how these devices are attacked. Sections 3 and 4 help you find and record them, and 5 sets out a separation design. Then come accounts and supplier access (6 and 7), buying and contracts (8), monitoring (9), recovery (10), testing and board reporting (11), and a checklist (12). The templates are CyberCQR's illustrations, not legal advice: adapt them with your IT provider, contractors and advisers. Whoever does the work, the firm's directors or partners stay accountable for these controls. The argument is in our briefing Do you know what is connected to your network?, and the short version in our Top 10 Actions.

1. What does the guidance say?

Source	What it says, in short	What it means for the firm
NCSC: enterprise connected devices	Devices are often internet-reachable, security is often an afterthought, and compromised devices are likely to be used as pivot points. Botnets are the greatest threat. Common weaknesses are default passwords, old protocols, misconfiguration and missing updates [3].	Sections 4 to 8.
NCSC: secure connectivity principles for operational technology (OT)	Limit exposure, centralise and control connections, log and monitor them, and plan how to isolate systems [4].	Sections 5, 7, 9 and 10.
Cyber Essentials v3.3	Devices that accept internet connections are in scope. Change default passwords. Remove unsupported software or place it in a sub-set with no internet traffic. A sub-set separated by a firewall or virtual LAN (VLAN) can be excluded, with justification [5].	Separation is good security and helps keep certification achievable.
Consumer connectable product law	Since 29 April 2024: no universal default passwords, a way to report flaws, and a stated update period, for consumer products [6].	Business equipment is not covered. Ask for the same things when buying (section 8).
Government response on enterprise connected devices	Published 8 April 2026. Manufacturers should follow the NCSC's device security principles now; codes, certification and regulation are being considered [7].	No new duty on firms yet. Do not wait for one.
CISA advisory, and CERT-FR after the freezer attacks	Keep control systems off the internet and behind firewalls [8]. Limiting access to trusted addresses is only a first step; rebuild compromised devices in a set order [2] [9].	Sections 5 and 10.

Table 1. The guidance, paraphrased. Sector rules, such as data protection duties for CCTV footage, may also apply.

2. How are these devices attacked?

Four routes account for most of the cases on record.

Route	What happens	Example
Exposed to the internet	A management screen or viewing port is open to the internet and found by scanning.	Thousands of refrigeration controllers found online before the 2026 attacks [10].
Default or leaked passwords	The installer's password is never changed, or a supplier's admin login leaks.	A leaked admin login at camera supplier Verkada exposed 150,000 customer cameras in 2021 [11].
Known flaws left unfixed	A published flaw is exploited because the device is never updated.	About 80,000 cameras still open to a flaw a year after it was fixed, with botnets using it [12].
Supplier access and a flat network	A contractor's account is stolen and used to reach other systems on the same network.	Target, 2013: a heating contractor's login led to the theft of about 40 million card records [13].

Table 2. Common attack routes. Most incidents combine more than one.

In the freezer attacks, the intruders used the devices' own features, such as forced defrosting and stretched cycles that delay the alarm [2]. That is typical. Monitoring must look for unusual changes and connections, not just malware.

3. What is in your building?

Use this as a prompt when walking the building with facilities and the IT provider.

Device	Usually bought or run by	How it often connects	What could go wrong
CCTV cameras and recorders	Security contractor	Office network, with a phone app or open port for remote viewing	Footage watched or deleted; cameras off; a route to the office network
Door access control	Security contractor or landlord	Cloud portal or on-site server on the office network	Doors unlocked, staff locked out, access records changed
Intruder and fire alarm panels	Alarm company	Monitoring link, sometimes an app	Alarms disabled or false alarms raised
Heating, ventilation and air conditioning (HVAC), and comms room cooling	Facilities or landlord	Building management system (BMS) with contractor remote access	Offices unusable; servers overheat
Lighting controls	Facilities or landlord	BMS or a cloud app	Lights off or on; a foothold on the network
Printers and multifunction devices	IT provider or leasing company	Office network, often with supplier remote monitoring	Documents copied; a foothold. Printers were 79% of the vulnerable devices in one NCSC-cited search [3]
Meeting room screens, video bars and smart TVs	IT provider or audio-visual supplier	Office network or Wi-Fi	Meetings overheard; a foothold
Smart plugs, speakers, coffee machines, kitchen fridges	Staff or facilities	Office Wi-Fi, often added without asking	A foothold on the network
Electric vehicle chargers and power backup	Facilities or landlord	Mobile data or office network	Charging or backup power unavailable

Table 3. Common connected devices. Your buildings will differ.

4. Find them and keep a register

Use three sources, because each one misses things the others catch.

The walk. Go round with facilities and the IT provider and note every device with a network cable, Wi-Fi or SIM card.
The network. Ask the IT provider for everything connected that is not a managed laptop, phone or server. Switches, Wi-Fi controllers and firewalls hold this information. Many security tools that firms already pay for, including Microsoft's, can also discover unmanaged devices; ask whether yours is switched on.
The suppliers. Ask each security, facilities and audio-visual firm, and the landlord, for a list of what they installed and how they reach it.

Then add an outside view: a check of the firm's internet addresses, and any contractor mobile routers, for visible management screens. Record everything in a register. A spreadsheet is enough.

Column	What to record	Example
Device and site	What it is and where	CCTV recorder, Preston office, comms room
Maker, model and firmware	From the label, screen or supplier	Maker X, model Y, firmware 5.2
Business owner	Named person at the firm	Office manager
Supplier and contract	Who maintains it, contract reference, renewal date	ABC Security Ltd, renews June 2027
Network	Which network it is on	Staff network (should move)
Internet exposure	Result and date of last outside check	Port open for phone viewing, 4 November 2026
Accounts	Who has accounts, whether defaults are changed, whether MFA is on	Installer's default admin; no MFA
Remote access	Who can reach it from outside, and how	Installer, via the maker's cloud portal
Support ends	Maker's end of security updates	Unknown: ask supplier
Impact if misused	High, medium or low, in business terms	High: footage of reception and staff areas
Action and date	What will be done, by whom, by when	Move to security network; close port; firm admin account with MFA; by January 2027

Table 4. Illustrative register. The example row shows the kind of finding that should reach the board.

5. Separate them from your data

Network segmentation means dividing your systems into zones so a problem in one part cannot easily spread. It is the single control that limits the damage from every other weakness in this guide. The design below is CyberCQR's illustration for an office of this size; your IT provider will adapt it to your equipment.

Network	What goes on it	What it may reach
Staff	Managed laptops and desktops only	The internet and cloud services through normal controls; servers as needed
Servers and core systems	File servers, line-of-business systems, network management	Only what each service needs
Building and security	CCTV, door access, alarm panels, BMS, HVAC, lighting controls	Only the named supplier cloud services or gateway each device needs. No access to staff or server networks
Office devices	Printers, meeting room screens, smart TVs	Staff devices may print or present to them; they may not start connections to staff devices or servers
Guest and personal	Visitors' and staff personal devices, smart plugs, kitchen appliances	The internet only
Isolated	Unsupported devices that cannot yet be replaced	Nothing outside their own segment; no internet traffic, as Cyber Essentials requires for unsupported software [5]

Table 5. Illustrative network separation. Each network is a VLAN or physically separate, with a firewall between them that blocks by default.

Two principles make it work. First, block by default: allow only the connections each device needs, and log the rest. Second, keep the firewall rules owned by the business and reviewed, not added to by each new supplier. For a law firm, accountant or adviser, this also means that a compromised camera cannot reach the client files.

6. Own the accounts

Change every default password on installation, to a strong and unique one. Cyber Essentials requires this for any factory-set or guessable account [5].
Named accounts, not shared ones. Each person who manages a system has their own login, so access can be removed when they leave.
Multi-factor authentication (MFA) on every cloud portal for cameras, door access and building systems. The supplier's web service is the control panel for every device behind it.
Use the firm's sign-in where possible. If the portal supports single sign-on with Microsoft Entra ID, use it, so your existing policies apply and leavers lose access with their main account. Our identity Top 10 covers them.
The firm holds the master key. Make sure you, not only the installer, have an administrator account on each system, kept with your other privileged credentials.
Remove installer accounts at handover, or disable them until needed.

7. Rules for supplier remote access

The standard below is CyberCQR's illustration, drawing on the NCSC's connectivity principles [4] and CISA's advice [8]. Watch the watcher: if the supplier sets up the access, holds the accounts and is the only party who would see a strange login, the firm has no independent view.

Illustrative standard: supplier access to connected devices

No direct exposure. No management screen or viewing port is open directly to the internet.
One way in. Suppliers connect through a gateway or remote access service the firm controls, never via routers, modems or software they fitted themselves.
Named people, strong sign-in. Each engineer has their own account with MFA. No shared or default passwords.
On when needed. Access is switched on for booked work and off afterwards.
Logged and visible. Every remote session is recorded, and the firm can see the records.
Reviewed. Access lists are checked every quarter; supplier leavers are removed promptly.
Exceptions. Only the named owner can approve one, in writing, with an end date.

8. Buying and contracts

The UK's default password ban covers consumer products only [6]. For business equipment, the protection comes from what the firm asks for. Before buying any connected device, ask:

Does it need to be on the internet at all, or can it work on a separate local network?
For how long will the maker provide security updates, and how are they applied?
Does it ship with a unique password, or force one to be set?
Does its cloud portal support MFA and, ideally, single sign-on?
Can the firm hold its own administrator account?
Does the maker publish a way to report security flaws?

Illustrative contract clauses: connected devices

Inventory. The supplier will give the client a list of every connected device it installs or maintains, with model, firmware and connection method, and keep it current.
Network. The supplier will connect devices only to the segment the client specifies, and will not fit routers, modems or remote access software without written approval.
Accounts. The supplier will change all default passwords when fitting equipment, use named logins with MFA, give the client administrator rights and remove its own set-up credentials at handover.
Updates. The supplier will apply security fixes within [30] days of release, or sooner for flaws known to be exploited.
End of life. The supplier will give at least 12 months' notice before any device loses the maker's security support, and propose a replacement.
Logging. The supplier will log remote sessions and give the client the logs on request.
Notification. The supplier will tell the client's named contact within [4] hours of suspecting a compromise of a maintained device or of its own access.
Recovery. The supplier will provide out-of-hours support to rebuild a compromised device, as set out in section 10.

Ask the landlord which shared building systems serve your space, who maintains them, and how they are kept apart from your network.

9. Which signs should we monitor?

The response times are CyberCQR's illustrations, not a standard. Alerts should reach a named person at the firm as well as the supplier.

Sign	Why it matters	Illustrative response time
A new, unknown device appears on the network	Something added without approval	Same working day
A building or security device tries to reach a staff device or server	Possible attempt to move into the firm's systems	Within 1 hour
A device connects to an unexpected internet address	Possible botnet or remote control	Within 1 hour
A new remote login, or one at an odd time or from an odd place	Possible stolen supplier or portal account	Within 1 hour
A new account or a changed password on a device or portal	Attacker making access last	Within 1 hour
Key settings changed: doors unlocked on a schedule, cameras off, alarms disabled, temperatures changed	Direct misuse, as in the freezer attacks [2]	Within 15 minutes for high-impact systems
A firewall rule added for a supplier outside a change request	Separation quietly undone	Same working day

Table 6. Monitoring signs. A simple independent alarm, such as a standalone temperature sensor in the comms room, does not depend on the system being watched.

10. How do we recover?

Agree this plan with your IT provider and suppliers in advance. Keep it somewhere that does not depend on email or the affected network, and name a deputy for each role.

When	Action	Who (illustrative)
Minutes 0 to 15	Make it safe. Isolate the device or its network segment from the internet and from other networks. Run doors, alarms or plant locally or by hand. Protect anything at risk.	Site lead and IT provider
Minutes 0 to 30	Keep the evidence. Record settings, logs, accounts and network connections before anything is reset.	IT provider and supplier, overseen by the named owner
Within the hour	Check how far it could reach. If the device was on a network with staff computers or servers, treat it as a possible wider breach and follow the firm's incident plan. Notify the insurer under its terms.	Named owner and IT provider
Same day	Report to the NCSC [14] and to Report Fraud or Police Scotland [15]. If CCTV footage or access records involving personal data may have been exposed, decide within 72 hours whether to report to the Information Commissioner's Office (ICO), and record the decision [18].	Named owner and data protection lead
Before reconnecting	Rebuild, do not just reset. Follow the order CERT-FR set out for the refrigeration controllers: limit access to suppliers; factory reset; apply all fixes; change every password and secret; check the accounts; fully reconfigure [9]. A factory reset alone is not enough [16]. Reconnect only to the correct separated network. Replace unsupported devices rather than reconnect them.	Supplier, signed off by the named owner
Within two weeks	Review what happened; update the register, firewall rules and contracts; report to the board.	Named owner

Table 7. Illustrative recovery plan. The order matters more than the exact times.

The NCSC's guidance on what to do when cyber attacks disrupt your organisation covers the wider response [17].

11. Testing and reporting to the board

Controls drift. A supplier opens a port during a repair; a new meeting room screen goes on the staff network. Illustrative checks:

Quarterly: outside check of what the internet can see; list of unknown devices found on the network; review of supplier and portal accounts.
Every six months: register checked against the walk, the network and supplier lists; firewall rules between zones reviewed; progress on end-of-life replacements.
Every year: a 30-minute tabletop exercise, for example "our CCTV recorder is talking to an unknown address overseas"; a test that doors, alarms and plant can run locally; a review of the standard and clauses in this guide.

Put two or three measures in the regular security report to directors, each with a tolerance: for example, "connected devices on the staff network: target zero" and "management screens visible from the internet: none". Our guide to board cyber reporting shows how.

12. Checklist

A named director or partner owns connected devices and reports to the board.
A register built from the walk, the network and supplier lists.
A quarterly outside check of what the internet can see.
Building, security and office devices on their own networks, with block-by-default firewall rules.
No management screen or viewing port open directly to the internet.
Every default password changed; named accounts with MFA on every portal.
The firm holds an administrator account on every system.
Supplier access through a gateway the firm controls, switched on only when needed.
Updates in maintenance contracts; a plan for every unsupported device.
Buying questions and contract clauses in use for new equipment and renewals.
Alerts on new devices, odd connections and key setting changes going to a named person.
A recovery plan held outside email, and a yearly exercise.

Glossary

Term	Meaning
Botnet	A network of compromised devices controlled together by an attacker, often used to attack others.
Building management system (BMS)	The system that controls a building's heating, cooling, ventilation and often lighting and access.
CERT-FR	France's government computer emergency response team.
Cybersecurity and Infrastructure Security Agency (CISA)	The United States government agency for cyber and infrastructure security.
End of life	The date after which a maker stops fixing faults or security flaws in a product.
Firewall	A control that decides which network traffic is allowed between two networks.
Gateway	A single, controlled entry point through which remote users must pass to reach internal systems.
Heating, ventilation and air conditioning (HVAC)	The systems that heat, cool and move air in a building.
Internet of Things (IoT)	Everyday devices connected to a network, such as cameras, sensors, screens and smart plugs.
Multi-factor authentication (MFA)	Signing in with something beyond a password, such as an app prompt or a security key.
Network segmentation	Dividing a network into separate parts, so a problem in one part cannot easily spread to the others.
Operational technology (OT)	Equipment and software that control physical processes, such as cooling, doors, lifts and power.
Single sign-on	Using one company account, such as a Microsoft Entra ID account, to sign in to other services.
Virtual LAN (VLAN)	A way of dividing one physical network into separate logical networks.

Table 8. Terms used on this page (alphabetical).

References

[1]Al Jazeera, with Reuters, Very cold war: who's attacking Europe's supermarket freezers?, 3 November 2026.
https://www.aljazeera.com/news/2026/11/3/very-cold-war-whos-attacking-europes-supermarket-freezers
[2]Nozomi Networks, French supermarket fridge cyberattacks and the risks of internet-connected OT, viewed 4 November 2026 (summarises CERT-FR alert CERTFR-2026-ALE-012).
https://www.nozominetworks.com/blog/french-supermarket-fridge-cyberattacks-and-the-risks-of-internet-connected-ot
[3]National Cyber Security Centre, Organisational use of enterprise connected devices, 10 May 2022.
https://www.ncsc.gov.uk/report/organisational-use-of-enterprise-connected-devices
[4]National Cyber Security Centre, Secure connectivity principles for operational technology (OT), viewed 4 November 2026.
https://www.ncsc.gov.uk/collection/operational-technology/secure-connectivity
[5]National Cyber Security Centre, Cyber Essentials: requirements for IT infrastructure, v3.3, April 2026.
https://www.ncsc.gov.uk/sites/default/files/2026-08/IT%20Requirements%20v3.3.pdf
[6]GOV.UK, Regulations: consumer connectable product security, updated 17 March 2025.
https://www.gov.uk/guidance/regulations-consumer-connectable-product-security
[7]GOV.UK, Government response to the call for views on enterprise connected device security, 8 April 2026.
https://www.gov.uk/government/calls-for-evidence/call-for-views-on-enterprise-connected-device-security/outcome/government-response-to-the-call-for-views-on-enterprise-connected-device-security
[8]Cybersecurity and Infrastructure Security Agency, ICS advisory ICSA-25-140-03: Danfoss AK-SM 8xxA series, 20 May 2025.
https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-03
[9]The Hacker News, Attackers heat French supermarket fridges up to 50°C by hijacking Danfoss controllers, 13 October 2026 (sets out CERT-FR's six recovery steps).
https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html
[10]Claroty Team82, Freeze the controller, defrost the food: uncovering vulnerabilities in Danfoss refrigeration controllers, 9 August 2026.
https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers
[11]CBS News, Hack of video security company Verkada exposes footage from 150,000 connected cameras, 10 March 2021.
https://www.cbsnews.com/news/verkada-hack-tesla-nissan-equinox-cloudflare/
[12]BleepingComputer, Over 80,000 exploitable Hikvision cameras exposed online, 22 August 2022.
https://www.bleepingcomputer.com/news/security/over-80-000-exploitable-hikvision-cameras-exposed-online/
[13]Computerworld, Target breach happened because of a basic network segmentation error, February 2014.
https://www.computerworld.com/article/2487425/cybercrime-hacking/target-breach-happened-because-of-a-basic-network-segmentation-error.html
[14]National Cyber Security Centre, Report a cyber incident, viewed 4 November 2026.
https://report.ncsc.gov.uk/
[15]Report Fraud, Report Fraud service goes live, 4 December 2025.
https://www.reportfraud.police.uk/news/report-fraud-service-goes-live/
[16]ActuIA, Danfoss: Claroty reproduit avec l'IA l'exploit de failles connues en 28 minutes pour environ 6 dollars (in French), October 2026.
https://www.actuia.com/actualite/danfoss-claroty-reproduit-avec-lia-lexploit-de-failles-connues-en-28-minutes-pour-environ-6-dollars/
[17]National Cyber Security Centre, What to do when cyber attacks disrupt your organisation: immediate activities, viewed 4 November 2026.
https://www.ncsc.gov.uk/collection/what-to-do-when-cyber-attacks-disrupt-your-organisation/recovering/immediate-activities
[18]Information Commissioner's Office, Personal data breaches: a guide.
https://ico.org.uk/for-organisations/guide-to-dp/guide-to-the-uk-gdpr/personal-data-breaches

Security is the outcome, not a solution.

CyberCQR is a UK cyber security advisory practice. We help firms find what is connected to their network, separate it from their data, bring supplier access under their own control and rehearse recovery, without vendor commissions or product resale.

Book a call