NFPA 72 2025 Edition: Cybersecurity Requirements for Fire Alarm Systems
The 2025 edition of NFPA 72, the National Fire Alarm and Signaling Code, is the latest edition of the standard. The NFPA Standards Council issued it in August 2024. Its headline change turns cybersecurity guidance into requirements in Chapter 11, which become enforceable wherever this edition is adopted.
What changed in cybersecurity
In the 2022 edition, cybersecurity guidance sat in the non-mandatory Annex J. The 2025 edition deletes that annex and moves its material into Chapter 11 and Annex A as requirements. Key requirements include:
| Item | What the 2025 edition requires |
|---|---|
| Network-connectable equipment | A security level suited to how the equipment connects, based on IEC 62443, UL 2900 or a comparable level (11.3) |
| Unused data ports | Physically protected, administratively disabled, or requiring authentication |
| Software updates | The manufacturer must notify the owner when cybersecurity update support ends |
| Maintenance plan for network-connectable equipment | A list of all accounts, people and organizations with electronic access credentials, reviewed annually for least-privilege access, plus owner-kept access logs for equipment that supports remote access, reviewed at least annually (7.6.7) |
| Systems that are not connected | No minimum security level is required for systems with no network-connectable equipment and no uploadable software configuration (11.1.2) |
Other notable changes
- Thermal image fire detection and acoustic leak detection were added to the detection chapter.
- Prescriptive spacing for spot smoke detectors is limited to ceilings up to 40 ft (12.2 m); higher ceilings need a performance-based design.
- A restricted audible mode of operation (RAMO) was added for occupancies that need reduced sound levels, subject to a risk analysis or direction from the authority having jurisdiction (AHJ) (18.4.8).
- Voltage drop calculations required for notification appliance circuits were expanded (18.3.7).
- The emergency control function interface may now be up to 20 ft (6.1 m) from the controlled component, instead of the usual 3 ft (1 m), where conductors are in metal raceway or metal-armored cable (21.2.4.1).
- For inspection and testing, testers are not required to evaluate the adequacy of an existing approved design (14.1.6).
Does the 2025 edition apply in Saudi Arabia?
Each jurisdiction adopts editions on its own schedule, and many still enforce earlier ones. In Saudi Arabia, the edition that applies to a project is set by the referenced standards of the Saudi Fire Protection Code (SBC 801) and Civil Defense requirements, so publication of the 2025 edition does not make it mandatory automatically. Its cybersecurity requirements are nonetheless sound practice for any networked alarm system. The next edition (2028) is currently in development.
Practical steps now
- Establish whether your fire alarm system is connected to the building network, the building management system or the internet, and how.
- Ask your supplier or contractor to state the cybersecurity level of the panel and devices, and their software update policy and support period.
- Disable unused data ports, change default passwords and define who has access to the system.
- Keep a log of access to the system and review it regularly under the maintenance contract.
For an overview of the standard, see our NFPA 72 fire alarm code guide and how to choose a fire alarm control panel.
Is your fire alarm system connected to a network? AZEIDK provides programming and systems integration and annual maintenance contracts for fire alarm systems. Request a system review
