When retailers in Belgium, Ireland, Sweden, Finland, and Estonia noticed sudden temperature changes in their fridges and freezers, the issue wasn't malware on a server. Attackers targeted refrigeration controllers, exploiting legitimate functions. Ahold Delhaize confirmed an incident affecting refrigeration systems in dozens of its stores, leading to the disposal of valuable food. This pattern had already emerged in France in mid-October, prompting CERT-FR to issue an advisory.
The advisory highlighted a gap in ownership, not a technical fix. As an Enterprise Risk Officer, you must determine where connected operational equipment fits into your risk program. Use the guidance below to make your decision.
The Decision You Are Facing
You need to integrate connected operational equipment, like refrigeration controllers and building management systems, into your enterprise risk process. Many organizations have treated these as facilities issues. Boards will now question why vendor contracts, incident response plans, and exercises never accounted for physical outcomes.
Three realistic paths exist. Your choice depends on your current understanding.
Key Factors That Affect Your Choice
Consider these questions before choosing a path.
1. Can you list every connected device at every site? If you need to physically check a telco closet to find out, the answer is no. You can't assess exposure on unknown connections.
2. Who can disconnect the device? If a contractor installs, monitors, and guarantees the controller, the store may lack both the ability and authority to shut it down.
3. Do your vendor contracts address security? Review terms for remote access, patching duties, incident notification, and the insurance or warranty implications of disconnecting a device. CERT-FR advised reviewing insurance terms in refrigeration contracts before disconnecting a controller.
4. Is any equipment past end of life? Devices might function operationally but no longer receive security patches. This requires decisions about isolation, compensating controls, and replacement.
5. What is the worst physical outcome? Spoiled inventory is obvious. Temperature-sensitive servers shutting down when building systems are manipulated is less visible.
Path A: Contain First, Contract Second
Choose this if: You can't confirm your exposure, or you have devices with public IP addresses.
Then:
- Remove public exposure. CERT-FR advised disconnecting refrigeration control systems with public IPs, then reconnecting through a secure VPN after verifying configuration and possibly restoring factory defaults.
- If quick action isn't possible, filter inbound connections to allow only your refrigeration suppliers' or service providers' IPs. CERT-FR described this as an emergency measure.
- Conduct site visits. Inventory work involves asking pointed questions about equipment in network closets and dedicated vendor-support circuits.
- Renegotiate contracts after securing the environment.
Requirements driving this path: CIS Controls v8.1 emphasizes inventory of enterprise assets and network infrastructure. The NIST Cybersecurity Framework (CSF) 2.0 places asset management under its Identify function. Both assume knowledge of existing assets before protection.
Trade-off: This approach is fast and cost-effective relative to potential losses but addresses symptoms. It disrupts vendor access arrangements store by store.
Path B: Fold IoT and OT into Your Existing Risk Management Framework
Choose this if: You know what's connected, containment is underway or complete, and your gap is governance.
Then:
- Assign a named owner for each class of connected operational equipment. "Facilities" or "the vendor" isn't sufficient.
- Register these assets in your risk register with physical, financial, and operational impact, not just data loss.
- Add physical-outcome scenarios to your Incident Response Plan and run a Tabletop Exercise on one, such as remote manipulation of refrigeration or HVAC.
- Define Key Risk Indicators (KRIs), such as the percentage of connected devices with a confirmed owner, devices reachable from the public internet, and devices past end of life.
- Require independent safeguards in design reviews. Remote access shouldn't allow equipment to operate outside intended parameters.
Requirements driving this path: ISO/IEC 27005 and NIST SP 800-39 frame information security risk as an enterprise concern. NIST SP 800-61 supports building incident handling around realistic scenarios. If you're in scope for the NIS2 Directive, its risk management and supply chain security expectations make operational equipment hard to ignore.
Trade-off: This builds durable coverage but is slow. Don't choose it as a substitute for Path A if exposure is unconfirmed.
Path C: Rebuild the Vendor Relationship
Choose this if: Your exposure stems mainly from outsourced management, and you can't act without the contractor's cooperation.
Then:
- Map who owns the hardware versus who maintains and manages it. Many affected retailers own equipment but outsource upkeep, leading to confusion about responsibility.
- Rewrite contracts to cover remote access methods, authentication, patch and end-of-life commitments, incident notification, and your right to restrict connectivity without voiding warranties or insurance.
- Require inventory disclosure from vendors, including devices on dedicated support circuits your security team may not have seen.
- Treat the contract as a control, tested like any other.
Requirements driving this path: Third-party risk obligations under the NIS2 Directive and supplier assurance expectations in ISO/IEC 27001 and NIST SP 800-53 emphasize enforceable security terms over informal trust.
Trade-off: This is the most durable fix for ownership gaps but the slowest. Contracts take months, attackers don't. Pair it with Path A.
Summary Matrix
| Your situation | Start with | Main driver | Watch out for |
|---|---|---|---|
| Unknown or public-facing devices | Path A | CIS Controls v8.1 asset inventory; CERT-FR advisory | Treating a temporary IP filter as the end state |
| Known assets, unclear ownership and scenarios | Path B | NIST CSF 2.0, ISO/IEC 27005, NIST SP 800-61 | Governance work without containment |
| Vendor-run systems you can't change | Path C | Supplier requirements in ISO/IEC 27001, NIST SP 800-53, NIS2 Directive | Slow contract cycles leaving exposure open |
Most organizations need all three paths, in order: A, then C and B in parallel. Skipping A to start with a framework exercise is a mistake the advisory-era retailers couldn't afford.
The test for your board is simple. Can you say who owns your refrigeration controllers, whether they're reachable from the internet, and what your contract lets you do about it today? If any answer is uncertain, you know your starting path.
