Remote Supervision and Dealer Remote Access Across 30 Sites

Start with what a supervising station actually needs: a path it knows is alive.

• Supervision interval. A 24-hour heartbeat means a path can be dead for a day with no notification anywhere. A single-path design must be supervised at a short interval - the commonly applied interval for a single path is on the order of minutes, not hours - and the central station must be able to distinguish “no signal received” from “no alarm received.” Verify the exact interval against the edition your AHJ enforces and the listing of the communicator; do not rely on a remembered number.
• No redundancy. Removing the cellular radios at 12 sites removed the second path. Where only one path exists, the design must either accept a short supervision interval and a fast response, or the owner must accept the risk in writing. A broadband circuit with a router that applies firmware updates on its own schedule is not a reliable sole path.
• No exception handling. Nine days of silence should have been impossible. The central station account must be configured for automated exception reporting on missed test signals, and someone must be accountable for acting on it within a defined time.
• No local indication. The panel should annunciate a communication failure at the protected premises, so a store manager sees something wrong.
• The 14-minute report. Determine whether the delay was the detection, the panel-to-communicator transfer, the transmission path, or the central station's handling. Those are four different fixes and the AHJ will ask which one it was. Produce the event timeline from the panel log and the central station's records side by side.

Kill the port forwards today. Every forwarded port on a store router is a public door into a life-safety panel. Close them at all 30 sites, confirm closure from outside the network, and treat any remaining forward as an incident.

Replacement architecture: outbound-initiated, encrypted tunnels from the panel or a site gateway to a dealer-managed access broker; no inbound listening services; multi-factor authentication; unique named credentials per technician, never a shared account; the broker records who connected, when, from where, and for how long, and that log is retained.

Change the default password on all 30 panels, plus any service or installer account, and put credential rotation on a schedule. Default credentials on internet-reachable fire panels are a physical safety issue, not an IT hygiene issue.

Process controls:

• Remote programming is limited to what the adopted code and the equipment listing permit without a site visit; anything affecting device programming, sequencing, or output mapping requires a documented change, a site verification, and notification to the AHJ where required.
• The site owner authorizes remote sessions; sessions outside a maintenance window require an additional approval.
• Disable remote access by default and enable it per session, or at minimum audit it monthly.
• Every remote session ends with a functional verification - signal to the central station, and a check of the affected devices.
• Track the panel and gateway firmware inventory and patch on a change-controlled schedule; an unpatched internet-facing panel is the same problem as a default password.

Put all of it into the dealer's written maintenance agreement with the chain, with the chain, not the dealer, holding the right to audit.

The plan should read as a controlled document, not an apology. Structure it as:

1. Finding and scope - each defect, with the site count affected and the date identified.
2. Root cause - one paragraph each: value engineering removed the second path at 12 sites; supervision interval set at 24 hours; router firmware changed an outbound rule with no change control; remote access by port forward with default credentials.
3. Immediate interim measures - port forwards closed, default credentials changed at all 30 sites, supervision interval shortened, exception reporting enabled at the central station, daily test-signal verification until permanent work is complete.
4. Permanent remediation - restore the second path at the 12 sites or document the owner's written risk acceptance with a schedule; broker-based remote access; firmware inventory; per-site proof test with central station confirmation of signal receipt.
5. Verification evidence - signed test sheets per site, central station signal reports, screenshots of the new supervision configuration, and a list of who performed each item and when.
6. Ongoing controls - quarterly path tests, annual remote-access audit, change-control procedure, training, and a named responsible person.

On the 12 sites: do not argue that the risk was accepted years ago by someone who has left. Present the options and their costs - cellular radio restoration, a second diverse path, or a documented single-path design with short supervision and monitoring - and let the owner choose in writing. Then tell the AHJ which option the owner chose and when it will be complete. The AHJ is testing whether the organization can find and fix its own defects; a plan that hides the value-engineered sites will fail that test regardless of how good the rest of it is.