IoT, sensors & automation · RFQ requirements
Cybersecurity for agricultural IoT: what to require from sensor, controller and platform suppliers
Sources reviewed · By the SeedMatch Group sourcing team · General guidance, not legal or agronomic advice
Short answer
Connected sensors, climate computers and irrigation controllers run the crop, so treat them as operational equipment, not gadgets. In the RFQ, require devices with unique credentials rather than shared default passwords, a secure software-update process with a stated support period, controlled remote access, data protection and export, logging, and a published way to report vulnerabilities. NIST's IoT device cybersecurity baseline and ETSI EN 303 645 give a practical starting list. Also ask what the system does when the network fails: irrigation and climate control should fall back to a safe local mode.
Comparison and checklist
| Requirement | Why it matters on a farm or greenhouse | Evidence to request |
|---|---|---|
| Device identity and inventory | You cannot secure or replace devices you cannot identify | Asset list with model, serial number, firmware and location |
| Unique credentials, no universal default passwords | Shared default passwords are a common entry point | Statement of the credential scheme and password policy |
| Secure software updates and support period | Unpatched controllers stay vulnerable for the life of the greenhouse | Update process, signing method and end-of-support date |
| Controlled remote access | Installer and vendor remote access is often left open after commissioning | Remote-access method, multi-factor authentication for cloud accounts, named user accounts |
| Data protection and data ownership | Crop and climate data has commercial value and may be needed if you change supplier | Encryption in transit, data-export format, contract clause on ownership |
| Logging and alerts | You need to see failed logins, configuration changes and offline devices | Log types, retention and alert channels |
| Vulnerability disclosure | Suppliers should receive and fix reported weaknesses | Published vulnerability-reporting contact or policy |
| Safe failure on network loss | Irrigation and climate must not stop or run uncontrolled if the internet drops | Description and test of local fallback behaviour |
Questions to answer before buying
- Which systems can change irrigation, dosing or climate settings remotely, and who can log in?
- How long will the supplier provide security updates for each device and the cloud platform?
- Can you export your historical data in an open format if you change supplier?
- What happens to irrigation and climate control if the internet connection or cloud service fails?
Risks to manage
- Default or shared passwords left in place after installation.
- Vendor remote-access accounts that stay active after commissioning.
- Devices reaching end of support during the project's operating life.
- Data locked in a proprietary platform without an export path.
- Unsafe behaviour of controllers when connectivity is lost.
What drives the cost
Qualitative drivers only — prices depend on specification, volume, origin and timing and come from supplier quotations.
- Length of the security-update and support commitment
- Network segmentation equipment and secure remote-access tools
- Integration between climate, irrigation and monitoring platforms
- Managed monitoring or service contracts
- Training for the operations team
Sustainability considerations
- Reliable, secure control keeps water, fertilizer and energy use on plan.
- A long support period extends equipment life and reduces premature replacement.
- Open data export lets you keep efficiency records when systems change.
Next steps
- List every connected device and who needs access to it.
- Add the requirements table to your sensor, controller and platform RFQs.
- Ask each supplier to demonstrate fallback behaviour during site acceptance.
- Remove or rotate installer credentials at handover.
Tools and checklists
Ready to compare supplier offers?
A SeedMatch Group sourcing specialist reviews each request and sources comparable offers from independent suppliers. The service is free for buyers; projects start at USD 250,000.
Request a greenhouse project RFQFrequently asked questions
Is ETSI EN 303 645 mandatory for agricultural sensors?
EN 303 645 is written for consumer IoT, so commercial agricultural devices may fall outside its scope. It is still a widely used baseline, and its provisions — such as no universal default passwords — make practical RFQ requirements. Check which rules legally apply in your market.
What is NIST IR 8259A?
A NIST publication defining a core baseline of device cybersecurity capabilities — identification, configuration, data protection, logical access, software update and cybersecurity state awareness — that organizations can use when acquiring IoT devices.
Should greenhouse controllers work without the internet?
Yes. Specify that irrigation, dosing and climate control continue in a defined safe mode during a network or cloud outage, and test it at site acceptance.
Sources
Rules and limits change. Confirm the current version with the issuing authority before acting.
- NIST IR 8259A — IoT Device Cybersecurity Capability Core Baseline (opens in a new tab) — National Institute of Standards and Technology, 2020-05-29
- ETSI EN 303 645 V3.1.3 — Cyber security for consumer IoT: baseline requirements (opens in a new tab) — ETSI, 2024-09-11