To protect connected elevators in a Tennessee building, start by identifying every controller and communications path, remove unnecessary internet exposure, restrict vendor access, and agree on how software changes and incidents will be handled. Treat these as operational decisions, not just IT settings. A network change that interrupts diagnostics, dispatch, or an equipment interface can affect the building’s ability to operate its elevators reliably.
Our practical rule at Kaiser Elevator is to make each connection answer three questions: What does it do? Who can use it? What happens if it fails or is compromised? Apply that rule during a new installation, before a controller modernization, and whenever a service provider or building network changes. The checklist below gives Tennessee owners and facility teams a way to assign the work without asking building staff to alter elevator controls themselves.
What is elevator cybersecurity?
Elevator cybersecurity is the protection of the digital systems and connections used to operate, monitor, configure, or service an elevator. Depending on the installation, those systems may include a controller, destination-dispatch equipment, a monitoring gateway, a service connection, or an interface to building access control. Not every elevator has every connection. The first task is to establish what is actually present in the building.
The principal concern is not simply whether someone could view data. An unauthorized connection or poorly managed change could interrupt communications, interfere with diagnostics, or complicate recovery after a fault. A cybersecurity review must therefore account for both network security and elevator operation. Physical protection of the controller and careful control of software changes belong in the same plan.
Start with a connection map, not a product list
Before buying security tools or changing firewall settings, have the facility manager, building IT team, and qualified elevator personnel draw a simple connection map for each elevator group. Show the controller, local network equipment, any cellular or other gateway, service access, and connections to other building systems. Label who owns each device and connection. An unknown modem or an old service account is a more useful finding than a generic statement that the system is connected.
Keep this map with the equipment records. It should be updated when a controller is replaced, a network is reconfigured, a service arrangement changes, or a temporary commissioning connection is removed. For properties with several buildings, use the same record format across sites while preserving each building’s actual configuration.
A practical checklist for connected elevator controls
1. Inventory the equipment and name its owner
Create a record for each elevator and its connected equipment. Include the building address, elevator identification, controller make and model, software or firmware version where available, gateway and network equipment, physical location, and service contact. Record whether the connection supports monitoring, service access, dispatch, or another defined function.
- Facility team: Maintain the master record and identify the person authorized to approve changes.
- Elevator personnel: Identify elevator equipment and explain which interfaces are necessary for operation or service.
- IT or network team: Identify network addresses, routes, gateways, and external connections.
Do not mistake a list of elevator cars for an asset inventory. A single group may have equipment beyond the individual car controllers, and a gateway can remain in place after other components have been modernized. The useful inventory connects each device to a purpose, an owner, and a way to remove access when it is no longer needed.
2. Find and reduce external exposure
Ask the network team and elevator provider whether any controller or associated gateway can be reached directly from the public internet. If one can, determine why that route exists and arrange a controlled alternative before changing it. Also identify cellular connections: they may not appear in the building’s ordinary network diagram, but they are still external communications paths.
The goal is not to disconnect a necessary service feature without planning. It is to avoid an unexplained route into operational equipment. Record the approved connection method, responsible vendor, permitted destination, and procedure for disabling access. Remove unused paths left after commissioning or provider transitions.
3. Separate elevator traffic from unrelated building traffic
Elevator equipment should not share unrestricted access with tenant Wi-Fi, ordinary office devices, or other systems merely because connecting them was convenient during construction. Ask IT to define the permitted traffic between the elevator environment and any building management, access-control, or vendor service system. A dedicated network segment with appropriately controlled traffic can limit the effect of a problem elsewhere in the building.
Document each allowed route by its purpose, not just its technical setting. A rule identified only by a port number will be difficult to review after the original installer leaves. Include temporary rules in the closeout review so they are not treated as permanent simply because the elevator passed commissioning.
Network changes should be coordinated with qualified elevator personnel. A blocked connection may stop a monitoring function or another intended interface even while the car appears to run normally. Test the intended functions after the network team makes a change.
4. Put vendor access under named approval
Remote access can help with service coordination, but it needs a clear authorization process. Ask who can connect, how their identity is established, what they are permitted to do, and whether a session can be traced to an individual. Favor individual accounts, multifactor authentication where supported, limited permissions, and access that is enabled for a defined service purpose rather than left open indefinitely.
For an urgent fault, the approval process should still work outside ordinary office hours. Name an on-call building contact who can authorize access and a second contact for escalation. Record the reason for the session and confirm that access is closed afterward. When a technician leaves a provider or a service contract changes, review accounts and connections as part of the handover, not at the next annual meeting.
5. Control credentials and local service devices
Default passwords, shared accounts, and unattended service devices make it difficult to know who changed a system. At installation or modernization turnover, ask for confirmation that default credentials have been addressed, unused accounts removed, and required service credentials transferred through an approved process. Avoid storing passwords in an open equipment binder or on a controller cabinet.
Physical access matters just as much. Limit entry to machine rooms and access to controller cabinets, gateways, switches, and service ports. Keep a record of authorized keys or access privileges. If staff discover an unfamiliar connected device, they should document it and escalate it rather than disconnecting equipment without understanding its purpose.
6. Plan software updates as elevator work
A controller update is not an ordinary desktop patch. Before any firmware or software change, identify the affected equipment, the reason for the change, the approved installer, the expected operating impact, and the tests required afterward. Ask how settings will be backed up if the equipment supports it and what recovery steps are available if the update does not work as expected.
Schedule the work around building occupancy and elevator availability. In a hospital, hotel, or single-elevator building, the consequence of taking a car out of service may shape the work window. Qualified elevator personnel should confirm the applicable operational and safety checks before the elevator returns to normal service. Keep the version and test results with the maintenance history.
If an update is not available for older equipment, do not assume a network setting can solve every problem. Consider the equipment condition, supportability, access requirements, and likely modernization path together. Our guide to controller modernization in Tennessee offers a related starting point for aging controls.
7. Collect useful logs without assuming every controller can produce them
Determine which systems can record remote sessions, login attempts, configuration changes, communication faults, or software updates. The answer may differ by controller and gateway. Where logs exist, identify who can retrieve them, how they are protected from alteration, and who reviews them when a problem occurs.
A log is most useful when it can be matched to a maintenance event. If an elevator begins reporting communication faults after network work, compare the fault timing with the network change and service record before assuming the controller has failed. For recurring operational issues, callback tracking helps building teams preserve that history.
8. Write a rider-first incident procedure
An unexpected controller condition may be a technical failure, a communications problem, or a security incident. The initial response must protect people without asking unqualified staff to diagnose the cause. If passengers are trapped or the elevator is behaving unsafely, follow the building’s established emergency procedure and contact the appropriate emergency and elevator service resources.
For a suspected cyber incident, notify the building security or IT lead and the elevator service contact. Identify which elevators are affected, preserve available logs and change records, and have the network team restrict suspicious access in coordination with elevator personnel. Do not bypass safety devices, alter controller logic, or repeatedly reset an affected elevator to see whether it recovers. The decision to return equipment to normal use should follow appropriate inspection and testing.
Keep an offline or otherwise accessible copy of the contact list and incident procedure. A plan stored only in the system experiencing the outage is of limited use when the building needs it.
9. Make security responsibilities part of the contract
Installation, modernization, and maintenance agreements should say who supplies connectivity, who administers accounts, who approves remote access, who receives vulnerability notices, and who documents software changes. Specify the records the owner will receive at turnover and after significant service work. Without assigned ownership, a vendor may assume IT controls access while IT assumes the elevator vendor does.
Include a transition procedure for a change of service provider. Review physical keys, credentials, remote connections, equipment records, and any access that must be removed. Our maintenance contract guide explains why clearly defined service scope matters beyond the immediate repair.
Where cybersecurity fits in the elevator life cycle
New installation: settle interfaces before commissioning
For a new Tennessee development, bring the elevator contractor, electrical and low-voltage teams, building IT, and any building-system integrator into the discussion before network connections are installed. The design and procurement documents should identify intended interfaces and who is responsible for the network path to each one. This is especially important where access control or destination dispatch is part of the elevator plan.
At turnover, request a current connection map, asset list, access procedure, equipment and software records, and evidence that intended interfaces were tested. Confirm which temporary accounts or connections used during construction have been removed. This makes the system maintainable by the operations team that inherits it, rather than only by the people who commissioned it.
Kaiser Elevator provides design, supply, and installation for commercial elevator projects, including systems with advanced control options. We recommend resolving operational interfaces alongside the elevator specification, not leaving them as an undefined IT task at the end of construction. For more on early coordination, see our new-construction scope gap checklist.
Modernization: retire old access as carefully as you add new controls
A controller modernization can introduce a different service interface, gateway, or building-system connection. Before work begins, compare the existing and proposed connection maps. Decide which older devices and credentials will be removed, how the new arrangement will be tested, and who will update the owner’s records. Do not leave an old modem in place simply because the replacement controller is operating correctly.
Plan operational testing and changeover around the building’s needs. A mixed-use property may need to protect resident access while coordinating separate retail operations. A medical building may have patient transport demands that affect outage scheduling. Cybersecurity is part of that same transition plan: access must be controlled before turnover, and the people responsible for ongoing service need accurate records.
Maintenance and repair: review what changed
Routine service already involves inspection, operational and safety testing, adjustments, documentation, and communication with building management. When connected equipment is involved, add a short change review: Was a service device connected? Was a setting or software version changed? Did a gateway or network cable change? Is any temporary access still active? The facility representative can record the answers without needing to interpret controller logic.
Keep cybersecurity observations separate from claims that every elevator requires the same technology. An older installation with no external connection may need better physical access control and accurate records rather than a new remote platform. A connected system may need more detailed coordination with IT. For readers evaluating what remote connections can and cannot tell a service team, see our remote elevator monitoring guide.
Best practices for Tennessee property teams
Make the checklist manageable by prioritizing actions according to exposure and consequence. Start with unidentified external access, unknown accounts, and missing ownership. Then address network separation, change records, and incident practice. A carefully maintained connection map often makes later decisions faster because the team can distinguish a necessary interface from an abandoned one.
- For facility managers: Keep one current record of elevators, contacts, approved connections, and recent changes. Ask for an explanation whenever a new gateway or remote-access method is proposed.
- For developers and general contractors: Assign network and turnover responsibilities in the project scope. Make sure the operations team receives the information needed to manage vendor access after construction.
- For IT and security teams: Treat elevator connections as operational technology. Coordinate restrictions and testing with elevator personnel rather than applying office-network changes without an operating plan.
- For owners with multiple Tennessee sites: Standardize the questions and approval process, but assess each building’s equipment and connections individually.
One useful test is to ask whether the building could explain an unfamiliar remote session on a particular elevator. If the team cannot identify the account owner, connection path, purpose, and service event, the access process needs attention. The same test works after a modernization or service-provider transition.
Frequently asked questions
Are all modern elevators connected to the internet?
No. Control systems and connectivity vary by installation. A controller may operate locally while another part of the system supports remote service or a building-system interface. Confirm the actual connections for each elevator rather than assuming that a modern control panel means internet access.
Does an elevator on a separate VLAN have enough protection?
A separate network segment helps organize and restrict traffic, but its effectiveness depends on the rules governing connections to other networks and remote users. Ask the network team to document allowed traffic and test the elevator functions after changes.
Should we turn off remote elevator access immediately?
First identify what the connection supports and whether anyone depends on it for service or monitoring. Unneeded access should be removed. Necessary access should have an approved purpose, named users, appropriate safeguards, and a removal process. Coordinate any change with qualified elevator personnel.
Who should approve a firmware update?
The building’s designated owner representative should authorize the work after the elevator provider explains the reason, affected equipment, outage plan, recovery approach, and required tests. IT should review network implications where relevant. Qualified elevator personnel should perform and verify work on elevator equipment.
What should we do if we suspect an elevator cyber incident?
Follow rider and building emergency procedures first. Notify the facility lead, IT or security contact, and elevator service provider. Preserve logs and recent change records, restrict suspicious access through a coordinated process, and have qualified personnel assess the elevator before it returns to normal service.
When should we revisit this checklist?
Revisit it when an elevator is installed or modernized, a controller or gateway changes, the building network changes, a new service provider takes over, or an unusual access or operating event occurs. Regular review helps keep the inventory and contact list useful between those events.
Keep connectivity useful and accountable
The strongest elevator cybersecurity plan is one the building team can operate: know the equipment, name the owners of every connection, restrict and record access, manage changes with qualified personnel, and prepare for safe recovery. This approach supports connected controls without confusing IT security with authority to modify an elevator’s operating or safety functions.
For Tennessee installation, modernization, repair, or maintenance planning, Kaiser Elevator’s vertical transportation services can help you coordinate the elevator scope with the building’s operational needs. Contact us at Kaiser Elevator to discuss your equipment and project plans.
