# Cold Storage and Building Controls Lockdown Kit

Purpose: a printable, standalone set of worksheets and checklists for owners of restaurants, grocers, convenience stores, caterers, florists, small pharmacies and food distributors who have networked refrigeration or building controls. It follows the FBI and CISA warning about attacks on refrigeration systems. It helps you find which devices touch a network, close the easy doors, install an independent alarm, and plan for spoilage. It assumes no IT staff. Do the checklist in an afternoon and file the worksheets with your insurance papers.

## Checklist

- [ ] Walk the building and list every device that controls temperature or building systems (walk-in coolers, reach-ins, freezers, ice machines, HVAC).
- [ ] Mark each device as Ethernet, Wi-Fi, cellular, or not connected. If you can't tell, mark UNKNOWN and ask the vendor.
- [ ] Find the remote app or dashboard for each device and note who has a login.
- [ ] Send the vendor question email (template below) for every connected device.
- [ ] Change every default or shared password to a unique one stored in a password manager.
- [ ] Delete accounts for former staff, former vendors and anyone who no longer needs access.
- [ ] Turn on multi-factor sign-in wherever the dashboard offers it; if it doesn't, record that in your vendor reply log.
- [ ] Update controller firmware, or ask the vendor in writing to do it and confirm the date.
- [ ] Move controllers to a guest or IoT network, separate from point-of-sale and office computers.
- [ ] Confirm your router has no port forwarding pointed at any controller.
- [ ] Install a battery-powered temperature alarm that texts you, and test it with warm water.
- [ ] Write and post the one-page manual-monitoring plan (template below).
- [ ] Ask your insurance agent whether a cyberattack on a refrigeration controller is covered, and get the answer in writing.
- [ ] Read the original FBI and CISA warning and compare it with your vendors' answers.

## Worksheet 1: Device inventory

Copy one row per device.

| Device | Location | Brand/model | Connection (Ethernet / Wi-Fi / cellular / none / unknown) | Remote app or dashboard | Who has login | Default password changed? (Y/N) | MFA on? (Y/N/not offered) | Vendor reply received (date) |
|---|---|---|---|---|---|---|---|---|
| | | | | | | | | |
| | | | | | | | | |
| | | | | | | | | |
| | | | | | | | | |

## Worksheet 2: Spoilage and loss

Fill in the blanks and keep it with your insurance papers.

- Inventory value in each cold unit: $______
- Total refrigerated inventory across all units: $______
- Insurance deductible (equipment breakdown / spoilage / cyber): $______
- Cost of one lost service day (revenue minus saved costs): $______
- Cost of an independent alarm: $______
- Estimated loss if one overnight failure goes unnoticed: inventory $______ plus lost service $______ = $______
- Estimated loss if the alarm catches it within an hour (assume you save about ______% of product): $______
- Insurance questions to ask: Is spoilage covered if a cyberattack changes the setpoint? Is there a waiting period? Is there a per-incident cap? Do I need to prove the cause? What records do you need from me?

## Worksheet 3: One-page manual-monitoring and response plan

Fill in and post inside the office door.

- Manual temperature check times: ______ and ______ and ______
- Where readings are recorded: ______
- Person responsible each shift: ______
- Discard threshold (confirm with your local health department): ______
- If a unit is above the threshold: move product to ______; call vendor at ______; call insurer at ______; call health department at ______
- How to document losses: photo of the display, list of items and cost, time found, who found it
- Who decides what is discarded: ______

## Template A: Vendor question email

```text
Subject: Security questions about the refrigeration controller at [business name]

Hello [vendor contact],

We use [brand/model] controllers at [location]. After the recent FBI and CISA warning about attacks on refrigeration systems, I'd like written answers to a few questions:

1. Does the controller need an inbound connection from the internet, or can it work with outbound-only or local access?
2. What is the default login, and where do I change it?
3. How are firmware updates delivered, and what version are we on now?
4. Does the dashboard support multi-factor sign-in?
5. Who at your company has remote access to our equipment, and how is that access logged?
6. If we need to disconnect the controller from the internet, what do we lose?

Please reply in writing by [date]. Thank you.

[name, phone]
```

## Template B: Password and access cleanup

```text
For each dashboard or app:
1. List every account with access.
2. Remove anyone who no longer works here or no longer services us.
3. Replace default and shared passwords with unique ones in a password manager.
4. Turn on multi-factor sign-in; if unavailable, write "MFA not offered" and the date you asked.
5. Record the date you finished: ______
```

## Template C: Network separation questions for your IT provider

```text
- Can you put the refrigeration and building controllers on a separate guest or IoT network?
- Will that keep them from reaching point-of-sale and office computers?
- Is port forwarding turned off for these devices?
- Will remote monitoring still work after the change, and how will we test it?
- What do we need to do if the vendor's app stops working?
- Can you give me the changes in writing?
```

## Prompts

Use each with your own documents; tell the AI to say when it is unsure.

```text
I run a [restaurant/grocery/florist/pharmacy]. Below is text from the labels, manuals and dashboards of my refrigeration and HVAC controllers. Build an inventory table with device, brand/model, connection type, remote app, who has access, and questions for the vendor. Use only the text I provide; write "UNKNOWN" where something is unclear.

[paste text]
```

```text
Write a one-page spoilage response plan for my business. Inventory value: $[amount]. Insurance deductible: $[amount]. Base discard thresholds only on the guidance I paste; if none, tell me to confirm with my health department. Say where you are unsure.

[paste guidance and contacts]
```

```text
Compare the cost of a battery-powered temperature alarm ($[amount]) against the expected loss from one overnight cooler failure with inventory of $[amount] and a deductible of $[amount]. Show the arithmetic and mark every assumption you made.
```

## Sources

- https://www.bleepingcomputer.com/news/security/fbi-cisa-warn-of-cyberattacks-targeting-refrigeration-systems/
- https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/
- https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/
- https://apprised.news/desk/defense/2026-11-06
- https://apprised.news/desk/tech/2026-11-06