Cybersecurity for Agriculture: Threats and Controls

Agriculture runs on tight seasonal windows, thin IT teams and a growing layer of connected machinery, which makes farms, cooperatives and food processors attractive to ransomware groups that know a victim at harvest cannot wait. The sector stretches from family farms and grain cooperatives through feed mills, seed and fertiliser suppliers, equipment dealers and precision agriculture platforms to meat, dairy and grain processors with full industrial control systems. This guide covers the threat picture as government sources describe it, the regulation that applies (and the gaps where none does), the controls that matter most for each part of the chain, and how to roll them out without disrupting planting or harvest. It is written for security leads at agribusinesses and cooperatives, the MSPs that support them, and OT engineers at processing plants.

Key takeaways

Timing is the attacker's lever. The FBI reported six grain cooperatives hit by ransomware between 15 September and 6 October 2021, and warned that attacks may be timed to planting and harvest when victims are most likely to pay.
Most damage starts in IT, not on the tractor. Phishing, exposed RDP, compromised administrator credentials and managed service provider software are the entry points in FBI case summaries; grain accounting, scale tickets, ERP and logistics are what stop the business.
Processing plants are OT sites. Meat, dairy and grain processing run PLCs, refrigeration control and batch systems, and need the same zone, conduit and remote access discipline as any manufacturer.
Regulation is uneven. Food processing and distribution is in scope of EU NIS2 and Australia's SOCI Act, but farms are largely outside sector cyber law in the US and UK, so most programmes are voluntary and driven by insurers, lenders and customers.
Manual operation and offline backups decide recovery. Both FBI notifications put tested offline backups and a plan to operate manually at the top of their mitigations, ahead of any tooling.

The agriculture attack surface, from field to processor

"Agriculture" covers very different environments. The CISA sector page counts an estimated 2.1 million farms and more than 200,000 registered food manufacturing, processing and storage facilities in the US alone, with the sector almost entirely privately owned. Controls have to fit the segment.

Segment	Typical systems	Characteristic exposure	Priority controls
Farms and ranches	Farm management software, telematics on tractors and combines, GNSS guidance, irrigation controllers, milking robots, climate control in livestock and greenhouse buildings	No dedicated IT staff, shared logins, consumer routers, vendor cloud accounts, remote access tools installed by dealers	MFA on email and banking, offline backup of records, unique passwords on controllers, vendor access inventory
Grain and supply cooperatives	Grain accounting and scale ticket systems, elevator and dryer controls, ERP, member portals, fuel and agronomy systems	Seasonal peaks, many locations on flat networks, outsourced IT, shared business management software	Segmented sites, EDR on servers, MSP access controls, manual scale ticket fallback, immutable backups
Inputs: seed, feed, fertiliser, crop protection	Feed mill batching, blending and bagging lines, logistics and dispatch	Disruption hits planting directly; the FBI described two February 2022 intrusions at a feed milling company stopped before encryption	Detection and response on IT, OT segmentation of batching systems, tested restoration of dispatch
Equipment and precision agriculture	OEM telematics platforms, dealer diagnostic tools, firmware update channels, agronomy data platforms, drones	Remote access into machines, API keys for data exchange, firmware integrity, large stores of farm data	Signed firmware, scoped API tokens, dealer access logging, data sharing agreements
Processing (meat, dairy, grain, produce)	PLCs, SCADA, ammonia refrigeration control, clean in place systems, packaging lines, historians, MES	IT to OT links through MES and historians, perishable product, food safety records	Zones and conduits, brokered remote access, passive OT monitoring, manual and paper fallback for food safety records

The sector also depends on other critical infrastructure: CISA lists water for irrigation and processing, transport for products and livestock, energy, and the chemical sector for fertilisers and pesticides. Dependency mapping should include those suppliers. For the generic OT architecture, see the OT Security Guide.

Threat picture

Government reporting on the sector is dominated by ransomware. Two FBI Private Industry Notifications give the clearest picture.

FBI PIN, 1 September 2021: describes a November 2020 attack on a food and agriculture business with a USD 40 million demand after a phishing email, which the company did not pay and recovered from backups; a farm that lost about USD 9 million after attackers used compromised administrator credentials; a meat processor hit by Sodinokibi/REvil with US plants shut for several days; and a bakery that lost production, shipping and receiving for about a week after ransomware was pushed through software used by its IT managed service provider. Named entry vectors were phishing, RDP, software vulnerabilities and compromised credentials.
FBI PIN, 20 April 2022: six grain cooperatives hit in autumn 2021 by Conti, BlackMatter, Suncrypt, Sodinokibi and BlackByte; a LockBit 2.0 attack on a multi-state grain company in March 2022; and a July 2021 HelloKitty/Five Hands attack on a business management software company that caused secondary infections at several cooperatives.
Scale: the Food and Ag-ISAC tracked 167 ransomware attacks on the sector in 2023 (as reported by The Record in September 2024), and 84 in the first quarter of 2025 alone, more than double the same quarter of 2024, with Clop's exploitation of a file transfer product driving much of the rise.
JBS, May 2021: the FBI attributed the attack on JBS to REvil/Sodinokibi. JBS said its encrypted backups allowed a fast recovery, with less than one day of production lost, while plants in the US and Australia were disrupted. The Canadian Centre for Cyber Security cites it in its 2025 to 2026 national threat assessment as an example of ransomware against critical infrastructure.
Precision agriculture and data integrity: a 2018 DHS assessment of precision agriculture flagged phishing, malware and USB media as risks to automated farm systems, with a scenario in which stolen herd health data is altered to fake a disease outbreak.

The table maps the recurring scenarios to MITRE ATT&CK (verified against v20) and to the control that breaks the chain.

Scenario	ATT&CK	Where it shows up	Control that breaks it
Phishing leading to ransomware on business systems	T1566 Phishing, T1486 Data Encrypted for Impact	Cooperative head offices, processors, input suppliers	Phishing-resistant MFA for admins, attachment controls, EDR, offline backups
Exposed RDP or VPN with reused or stolen passwords	T1133 External Remote Services, T1078 Valid Accounts	Small sites, farm offices, dealer support connections	Close RDP to the internet, MFA on every remote path, remove dormant accounts
Compromise through an MSP or shared business software	T1199 Trusted Relationship, T1195.002 Compromise Software Supply Chain	Cooperatives sharing an outsourced IT provider or ag business platform	Contractual MSP controls, separate admin accounts per client, monitoring of RMM tools
IT ransomware forcing processing plants to stop	T0828 Loss of Productivity and Revenue (ICS)	Meat, dairy and grain processing where MES or ERP drives production	IT/OT dependency map, DMZ between MES and control, manual production procedures
Internet exposed controllers in barns, greenhouses or irrigation	T0883 Internet Accessible Device (ICS)	Climate control, irrigation pumps, grain dryers with remote apps	External exposure scanning, vendor cloud with MFA instead of open ports, default password change
Contractor laptop or USB at a plant or elevator	T0864 Transient Cyber Asset, T0847 Replication Through Removable Media (ICS)	Commissioning, seasonal maintenance, integrators	Media scanning kiosk, approved devices, contractor access policy

See the Top 10 Ransomware Initial Access Vectors for the wider pattern.

Regulation and frameworks (status checked October 2026)

There is no single agriculture cyber law; obligations depend on the segment and country.

Regime	Who it reaches in agriculture	What it asks for	Notes
US: sector partnership model (USDA and HHS as co-Sector Risk Management Agencies)	The whole food and agriculture sector, voluntarily	No sector cyber mandate; information sharing, sector plans, Food and Ag-ISAC	Reporting in 2024 described USDA's sector cyber office as small and lightly funded; a proposed Farm and Food Cybersecurity Act would add threat assessments and exercises
EU NIS2 Directive (Directive (EU) 2022/2555)	Food businesses engaged in wholesale distribution and industrial production and processing (Annex II, "other critical sectors")	Article 21 risk management measures, Article 23 incident reporting, management accountability	Primary agriculture is not listed as such; national transposition decides details. See the NIS2 Directive Guide
Australia Security of Critical Infrastructure Act 2018	Responsible entities for critical food and grocery assets	Asset register reporting, incident notification, risk management programme where the rules apply	The July 2026 reform consultation did not specifically consider the food and grocery sector
US SEC cybersecurity disclosure rules	Listed agribusiness, equipment and food companies	Form 8-K Item 1.05 disclosure of material incidents, annual risk management disclosure	Materiality is a business judgement; prepare the decision path in advance
Privacy law (GDPR, UK GDPR, US state laws)	Employee, member and customer data; some farm data	Security of processing, breach notification	Farm machine data is often commercial rather than personal, so data sharing contracts matter as much as privacy law

For a cross-sector view, see the Critical Infrastructure Regulation Map. Smaller organisations without a mandate get most value from the CISA cross-sector goals; see the CISA CPG Guide.

Priority controls for farms, cooperatives and input suppliers

The FBI mitigation lists and the incident pattern above point to a short, ordered list. Do these first, in this order.

Offline, tested backups: keep at least one copy of grain accounting, ERP, member and agronomy data that cannot be modified or deleted from the source system, stored in a separate, segmented location. Test a full restore of the systems needed at harvest before harvest. See the Backup Security Guide.
MFA on every remote path and on email: VPN, remote desktop gateways, cloud email, banking and vendor portals. Close RDP to the internet entirely and review remote access logs.
Manual operation plans: paper scale tickets, manual grain receiving and dispatch procedures, phone trees for members, and printed contact lists for the MSP, insurer and law enforcement.
Segment locations and functions: elevators, dryers and feed mill batching on their own segments; branch sites unable to reach each other except through controlled paths; guest and member Wi-Fi isolated. See the Network Segmentation Guide.
Control the MSP and shared software: require named, MFA-protected technician accounts, logging of remote monitoring and management (RMM) actions, and notification of any compromise at the provider. See the Cybersecurity for MSPs and MSSPs Guide.
Patch internet facing systems first: VPN appliances, file transfer products and remote access tools. The 2025 rise in sector attacks tracked a mass exploitation of a file transfer product.
Least privilege for administrators: separate admin accounts, no daily email on admin accounts, and an audit of who holds domain admin at each site.

Precision agriculture, connected equipment and farm data

GAO found that only 27 percent of US farms or ranches used precision agriculture practices in 2023, so connected equipment is still spreading, and the security model is often set by the equipment maker rather than the farmer.

Telematics and OEM clouds: combines, tractors and sprayers report to manufacturer platforms. Protect the farm's account with MFA, remove former employees and contractors, and review which dealers and agronomists have delegated access.
Dealer remote diagnostics: dealers can often connect to machines and push updates. Ask how that access is authenticated, logged and limited, and who can approve it.
Firmware and software updates: prefer equipment that only accepts signed firmware and documents its update process. See the Firmware and Boot Security Guide.
GNSS dependence: auto-steer, variable rate application and yield mapping depend on satellite positioning and correction services. Have a manual fallback for critical field operations and monitor for loss of correction signal.
Farm data integrity: yield, soil, herd health and traceability records feed lending, insurance, certification and food safety. GAO notes that farmers often do not trust how farm data is collected and managed. Write data sharing agreements that state ownership, retention, deletion and breach notification.
Drones and sensors: treat field sensors, livestock monitors and drones as IoT fleets with an inventory, unique credentials and update plans. See the IoT Security Guide and the Drone and Counter-UAS Security Guide.

Processing plants: OT controls that differ from the general case

Refrigeration and hazardous processes: industrial refrigeration, often ammonia based, and steam and pressure systems have safety implications. Keep their controllers and any safety instrumented functions in a dedicated zone with read only data leaving it. See the Safety Instrumented Systems Security Guide.
Perishability shortens decisions: product in chillers and on lines spoils quickly, so the incident plan must say in advance who decides to stop lines, divert raw material or hold product, and on what evidence.
Food safety records: temperature logs, HACCP records and traceability data must survive an IT outage. Keep a paper or standalone fallback and a way to reconcile records afterwards.
MES and historian links: the usual path from IT to OT. Put them in a DMZ between business and control networks and allow no direct IT to controller traffic.
Integrators and OEM support: processing lines are commissioned and maintained by many vendors. Broker all remote sessions, with MFA, approval and recording. See the OT Remote Access Guide.
Asset visibility: passive OT monitoring at the DMZ and key cell networks gives an inventory and alerts without touching fragile devices. See the OT Asset Visibility Guide.

Choosing where to start

Single farm or small ranch: MFA on email and banking, an offline backup, unique passwords on controllers and cameras, and a list of every vendor that can connect.
Cooperative or input supplier with 5 to 50 sites: the seven priority controls above, an MSP contract with security clauses, and a harvest readiness exercise each year.
Processor or large agribusiness: a full OT programme using IEC 62443 zones and conduits, a SOC with OT playbooks, and supplier assurance. See the IEC 62443 Guide and the Manufacturing Identity and OT Access Guide.

Where identity fits

The FBI's farm case began with compromised administrator credentials, and the MSP and shared software cases rode on trusted technician accounts. Agriculture is full of identities nobody owns: shared office logins at elevators, a single account on the grain accounting system used by every seasonal worker, dealer accounts on telematics platforms, API keys that move agronomy data between platforms, and service accounts used by MES and historians. Give each an owner, remove shared logins where the platform supports named users, rotate API keys and store them in a vault, and review dealer and integrator access before each season. See the OT and ICS Identity and Access Guide and the Identity for IoT Fleets Guide.

Implementation: a phased programme built around the season

Phase 0, scope (weeks 0 to 4): list sites, systems, vendors and remote access paths; mark which are needed for planting and harvest; identify any NIS2, SOCI or disclosure obligations.
Phase 1, quick wins (off season, months 1 to 3): MFA on remote access and email, close internet exposed RDP and controllers, disable dormant accounts, take offline backups. Pilot each change at one site before rolling out, and keep the old access path documented but disabled for a week so it can be restored if a critical vendor is locked out.
Phase 2, resilience (months 3 to 6): write and print manual procedures, run a tabletop based on a harvest-time ransomware scenario, and test a full restore of grain accounting or ERP.
Phase 3, architecture (months 6 to 12): segment sites and OT, broker vendor access, deploy EDR on servers and passive monitoring at processing plants. Schedule network changes outside peak receiving periods.
Phase 4, sustain: annual pre-harvest readiness review, quarterly access review for vendors and dealers, and supplier security questions in contracts.

Detection and measurement

Log: VPN and remote desktop authentication, RMM tool sessions, admin account use, backup job results and deletions, and OT DMZ traffic at processing plants.
Alert on: new admin accounts, RMM activity outside agreed windows, mass file changes, backup deletion, and IT hosts talking directly to controllers.

Metric	Target	Why it matters
Remote access paths with MFA	100 percent	Remote services and valid accounts are the recurring entry point
Days since last successful full restore test of harvest critical systems	Under 365, and always before harvest	Backups only count if they restore in time
Internet exposed RDP or OT services	Zero	Easiest path for opportunistic ransomware
Vendor and dealer accounts with a named owner and expiry	100 percent	Trusted third parties carried several sector incidents
Sites with a printed manual operation procedure tested in the last year	100 percent of receiving and processing sites	Keeps grain moving and product safe during an outage

Framework mapping

Control area	NIST CSF 2.0	NIST SP 800-53 Rev. 5	CIS Controls v8.1	ISO/IEC 27001:2022 Annex A
Asset and dependency inventory	ID.AM-01, GV.OC-04	CM-8	Control 1	A.5.9
Remote access and MFA	PR.AA-01, PR.AA-05	AC-17, IA-2	Control 6	A.5.15, A.8.5
Segmentation	PR.IR-01	SC-7	Control 12	A.8.22
Backups and recovery	PR.DS-11, RC.RP-01	CP-9, CP-10	Control 11	A.8.13
MSP and supplier risk	GV.SC-07	SR-3, SR-6	Control 15	A.5.19, A.5.21
Monitoring	DE.CM-01	SI-4	Control 13	A.8.16
Incident response and manual operation	RS.MA-01	IR-4, CP-2	Control 17	A.5.24, A.5.29

Common failure patterns

Planning recovery for the quiet season: restore tests run in winter on a small dataset, then fail to meet the hours available at harvest when every scale ticket counts.
Trusting the MSP by default: one technician account with access to every member site, no MFA and no RMM logging; the bakery and cooperative cases in the FBI notifications show how one provider spreads an infection.
Backups on the same domain: backup servers joined to the production domain with the same admin accounts are encrypted or deleted along with everything else.
Remote apps opened through port forwarding: barn, greenhouse and irrigation controllers reachable from the internet with default credentials because the installer wanted remote support.
No owner for dealer and telematics access: former employees, previous dealers and agronomists keep access to machine and field data for years.
No decision rights for stopping a plant: processors lose hours debating whether to halt lines while product spoils, because nobody agreed the trigger in advance.

Practitioner checklist

Map every site, system and vendor needed for planting, harvest and processing, including water, energy and transport dependencies.
Enforce MFA on all remote access, email, banking and vendor portals, and close RDP to the internet.
Keep offline, immutable backups and complete a full restore test of harvest critical systems before each harvest.
Write, print and exercise manual procedures for receiving, dispatch and food safety records.
Segment branch sites, elevators, feed mills and processing OT, with a DMZ between business systems and control.
Put security clauses, named accounts and logging into every MSP and integrator contract.
Give every shared, dealer, service and API identity an owner and expiry, and rotate keys after staff or dealer changes.
Scan for internet exposed controllers and remote services monthly and fix findings within agreed times.
Run a harvest-time ransomware tabletop each year that includes the insurer, MSP and legal counsel.

Cybersecurity for Agriculture Guide: Threats, Regulation and Priority Controls