Food and Agriculture Identity Security Guide

Food and agriculture businesses run on identities that nobody clearly owns: shared logins at grain elevators, seasonal workers on one scale-house account, dealer and integrator accounts on machines and processing lines, and supplier users on ordering and traceability portals. This guide goes deeper than the sector overview on one question: who and what can log in across farms, cooperatives, input suppliers, processors and distributors, and how to control it. It covers seasonal workforce identity, food safety record signatures, supplier and member portals, dealer, integrator and MSP access, plant OT access and machine credentials. It is for identity and security leads at agribusinesses, processors and food distributors, and the MSPs that support them. For the wider threat and regulatory picture, see the Cybersecurity for Agriculture Guide.

Source note: incident, regulatory and agency details are attributed to the FBI, CISA, eCFR, FDA and EUR-Lex sources linked in the text, as checked in November 2026. Practice recommendations (role templates, rollout timings, metrics and targets) are NHI Mgmt Group recommendations. Confirm against the official text before relying on it.

Key takeaways

Credentials are the documented entry point. FBI notifications describe a farm losing about USD 9 million after an attacker used compromised administrator credentials, and recommend MFA, admin account audits and disabling unused RDP.
Seasonal labour breaks shared accounts. Harvest crews, drivers and scale operators who join for weeks are the reason shared logins persist; a time-boxed joiner and leaver process is the fix, not a ban that staff work around.
Food safety records need a named person. US preventive controls records under 21 CFR 117.305 must carry the signature or initials of the person performing the activity, so a shared login on a monitoring system undermines the record itself.
Dealers, integrators and MSPs hold standing access. Broker, log and expire dealer, integrator and IT provider accounts.
Portals are regulated data paths. Member, supplier and traceability portals carry payments and records that FDA can request within 24 hours, so their accounts need a full lifecycle.

The identity map from field to fork

Draw this map for your own business first: the riskiest accounts usually sit between two organisations.

Segment	Human identities	Partner and customer identities	Machine identities
Farms and ranches	Owner, family members, farm managers, seasonal and migrant workers	Agronomists, equipment dealers, veterinarians, crop insurers, lenders with access to farm records	Telematics units on tractors and combines, irrigation and climate controllers, milking robots, farm software API connections
Grain and supply cooperatives	Elevator and scale-house staff, agronomy and fuel staff, drivers	Members on member portals, outsourced IT, business management software supplier	Grain accounting and scale ticket integrations, dryer and elevator controls, ERP service accounts
Input suppliers (seed, feed, fertiliser)	Sales, logistics, mill operators	Dealers and distributors on ordering portals, carriers	Order and logistics integrations, mill control systems
Processors (meat, dairy, grain, produce)	Line operators, QA technicians, maintenance engineers, contract sanitation crews	Line integrators, OEM support engineers, auditors, retail customers' supplier portals	MES and historian service accounts, PLC engineering workstations, label printers, EDI connections
Distributors and wholesalers	Warehouse staff, drivers, buyers	Suppliers and customers on ordering and traceability portals	Warehouse management, EDI and API links, temperature monitoring

Ownership is blurred: a dealer account on a farm's telematics platform belongs to the dealer's employee but reaches the farm's machines and data. Assign an internal owner to every such account, even where you do not administer the system.

Workforce and seasonal identity

The FBI's 2022 notification on agricultural cooperatives recorded six grain cooperatives hit by ransomware between 15 September and 6 October 2021, during harvest. Harvest is also when the workforce is largest and least known.

Pre-season account templates: build role templates (scale operator, driver, sampler, line operator, sanitation) before the season, with the minimum application access each needs. Fast creation removes the main reason staff are handed a shared login.
End dates at creation: every seasonal and contract account gets an expiry date matching the engagement, set when it is created, and a named supervisor who confirms or extends it. See the Contractor Identity Lifecycle Guide.
Fast authentication on shared terminals: scale houses, packing lines and control rooms have shared terminals. Use badge tap or short PIN re-authentication on a per-user session rather than one login left open all shift. See the Passwordless for Frontline and Shared Devices Guide.
In-person issue: bind the account to the person the supervisor met on site and issue credentials in person, not to a number supplied by a labour contractor.
Leaver triggers: tie account disablement to the end of the payroll or labour contractor engagement, and run a sweep in the week after harvest closes for accounts that were not removed. See the Joiner-Mover-Leaver Guide.

Food safety records and why named accounts matter

Identity in a food plant is not only a security question. US preventive controls records under 21 CFR 117.305 must be accurate, indelible and legible, created at the time of the activity, and must include the signature or initials of the person performing it. Electronic records kept only to meet Part 117 are exempt from 21 CFR Part 11, but records that are also required under other statutes or regulations remain subject to Part 11. Where Part 11 applies, 21 CFR 11.300 requires that no two individuals share the same identification code and password combination, that codes and passwords are periodically checked or revised, that lost or compromised tokens and cards are electronically deauthorised, and that attempted misuse is detected and reported.

Record or system	Identity requirement	Practical control
Temperature, cooking and CCP monitoring entered on tablets or HMIs	Signature or initials of the person performing the activity (21 CFR 117.305(f)(3))	Per-user login or badge tap before data entry; no generic "QA" or "line 2" account
Records also required under another regulation	Part 11 controls, including unique ID and password combinations (21 CFR 11.300(a))	Named accounts, periodic credential review, lost badge deauthorisation process
Food Traceability Rule records (key data elements and traceability lot codes)	Records and an electronic sortable spreadsheet provided to FDA within 24 hours of a request in an outbreak or recall	Named portal and system users, so you can show who created or changed a lot record; tested export access for the people on call
Recipe, batch and label settings in MES	Change accountability for allergen and label control	Separate roles for operators, supervisors and recipe administrators; change log reviewed by QA

FDA states that the original Food Traceability Rule compliance date of 20 January 2026 was proposed for extension to 20 July 2028 and that Congress directed it not to enforce the rule before then (checked November 2026). Either way, the people who must produce traceability data at short notice need named, working access that does not depend on one employee's password.

Supplier, member and customer portals

Food businesses sit on both sides of many portals: they host member and dealer portals, and they log in to retailers' supplier portals, wholesalers' ordering systems, certification bodies and logistics platforms.

Portals you host: member portals at cooperatives show settlement statements, contracts and payment details; dealer and distributor ordering portals carry pricing and credit. Offer MFA to all users and require it for anyone who can change bank details or place orders above a threshold. Let each member farm or dealer administer its own users. See the B2B CIAM and Organisation Management Guide.
Bank detail changes: changes to payee details for members, growers or suppliers are a recurring fraud target. Require a call back to a number already on file before any change takes effect, and notify the account's existing contacts. See the Invoice Redirection and Supplier Bank Detail Fraud Guide.
Portals you use: keep a register of external portals, who holds accounts and whether MFA is on. Where a portal allows only one login per supplier, keep it in a team vault with access logging and rotate it when a holder leaves.
Help desk resets for partners: a caller claiming to be a member, grower or supplier who has lost access is a social engineering route. Verify through the organisation's registered administrator or a call back, never through details the caller supplies. The Marks and Spencer cyberattack began with impersonation of a third-party user, linked in reporting to an outsourced help desk. See the Account Recovery and Help Desk Security Guide.

Dealers, OEMs, integrators and MSPs

The 2021 FBI notification describes a bakery shut down for about a week after REvil ransomware was deployed through software used by its IT managed service provider, and the 2022 notification describes a business management software company whose compromise led to secondary infections at several agricultural cooperatives.

Partner type	Typical access	Identity risk	Control
Equipment dealer	Delegated access to the farm's account on an OEM telematics platform, remote diagnostics and software updates	Access outlives the dealer relationship; dealer staff turnover is invisible to the farm	Review delegated organisations and partners before each season; remove dealers no longer used; ask how dealer staff authenticate and how remote sessions are approved
Agronomist and data platform	Read or write access to field, yield and application data, often through an API connection	Long-lived tokens and connections nobody remembers granting	List connected apps on each platform; revoke unused ones; prefer scoped, revocable connections
Line integrator or OEM support	Remote access to PLCs, HMIs and engineering workstations in processing plants	Shared vendor accounts, always-on remote tools, default passwords	Brokered sessions with MFA, approval per session and recording. See the OT Remote Access Guide
IT MSP	Domain admin and RMM tools across all sites	One compromised MSP account reaches every client	Named, MFA-protected technician accounts per client, RMM logging, notification duty in contract. See the RMM Tool Security Guide

For a structured approach to partner accounts, see the Third-Party Access Guide and the Vendor Privileged Access Management (VPAM) Guide.

Plant OT access

CISA, FBI, EPA and DOE's primary mitigations for OT tell operators to remove OT from the public internet, change default passwords immediately, use a VPN with phishing-resistant MFA for remote users, document remote access by asset, role and scope of work, disable dormant accounts and be able to run OT manually. In identity terms that means:

Separate OT identities from corporate ones. Engineering workstations and HMIs should not trust the corporate directory directly. Use a separate OT domain or local accounts managed through a privileged access tool, so a corporate credential compromise does not reach the plant floor.
Replace shared HMI and engineering logins. Move to named users where the platform supports them; otherwise control physical access, log shift handover and rotate the password when staff leave.
Change default passwords on controllers and devices. Grain dryer, refrigeration and irrigation controllers with remote apps are a common exposure; prioritise devices reachable from the internet.
Broker every remote session. Vendors connect through one gateway, with per-session approval by the plant, MFA and recording; remove standing remote tools installed during commissioning.
Keep break-glass access local. Store emergency OT credentials offline at the site, sealed and checked after use, so a lost identity provider does not stop the plant. See the Break-Glass Account Guide.

For zone and conduit design and role models, see the OT and ICS Identity and Access Guide and the Food and Beverage Manufacturing Cybersecurity Guide.

Machine identities across the chain

Yield data moves from machines to agronomy platforms, scale tickets to grain accounting, orders over EDI and temperature readings to the cloud, and each link uses a credential.

API keys and tokens: record each with an owner and expiry, keep keys in a vault rather than scripts, and revoke them when a partner relationship ends. See the API Key Management Guide.
Service accounts: MES, historian, label printing and ERP integrations; scope them, deny interactive logon and alert on interactive use. See the Service Account Security Guide.
EDI links and field devices: manage certificates with renewal dates and owners, and give telematics units and sensors unique credentials. See the EDI and B2B Integration Security Guide.

Regulation that names identity controls

In the EU, NIS2 (Directive (EU) 2022/2555) Annex II covers food businesses engaged in wholesale distribution and industrial production and processing; Article 21(2)(i) requires human resources security, access control policies and asset management, and Article 21(2)(j) the use of multi-factor or continuous authentication where appropriate. Primary farming is not listed as such. See the NIS2 Directive Guide. In the US, farms are largely outside sector cyber law, and the identity obligations that bite are the FDA record rules above; CISA lists the Department of Agriculture and the Department of Health and Human Services as co-Sector Risk Management Agencies.

How to implement

Off season, months 1 to 2, inventory: list every system, portal and remote access path, every partner with access, and every shared account. Mark the ones needed at planting and harvest.
Months 2 to 3, quick wins: MFA on email, banking, VPN and remote desktop gateways; disable dormant accounts; close RDP exposed to the internet; change default controller passwords. Pilot each change at one site first.
Months 3 to 4, partners: move dealers, integrators and MSP staff to named accounts behind a brokered gateway, one partner at a time. Keep the previous access path documented and disabled for one week so it can be restored if a critical vendor is locked out during a breakdown.
Months 4 to 6, workforce: build seasonal role templates, set expiry dates on all temporary accounts, introduce badge or PIN re-authentication on shared terminals, starting with QA and food safety record entry.
Before peak season, test: a harvest tabletop where the identity provider or an MSP account is compromised, covering local break-glass access and the traceability export.

Rollback: if per-user authentication slows a packing line or scale house at peak, lengthen the re-authentication timer on those terminals only and keep named accounts; do not return to a shared login.

Decision guidance

Small farm or ranch: individual logins with MFA for banking, email and OEM platforms, a list of dealers and apps with access, and prompt removal when people leave.
Cooperative or input supplier: central directory with MFA, seasonal templates, member portal MFA and bank detail verification, and contractual controls on the MSP and business software supplier.
Processor or large distributor: separate OT identity domain, privileged access management for engineering and vendor sessions, identity governance with access reviews, and named accounts on every food safety record system.
Phishing-resistant MFA or app-based MFA: CISA calls FIDO and PKI-based MFA the gold standard and suggests starting with administrators and the help desk; for smaller organisations it names app-based codes or push with number matching as the interim option. Use phishing-resistant methods for admins and remote OT access first. See the Phishing-Resistant MFA Guide.

Detection and measurement

Alert on accounts created outside HR or labour contractor records, seasonal logons after end dates, interactive use of service accounts, MFA changes followed by a new device, OT remote sessions outside approved windows, portal bank detail changes and bulk exports from grain accounting or member systems.

Metric	Target	What it shows
Shared accounts on food safety and CCP monitoring systems	Zero	Records are attributable to a person
Seasonal accounts disabled within 2 days of end date	Above 95 percent	Leaver process works at scale
Partner accounts with named users, MFA and a current owner	100 percent	Third-party access under control
Remote OT sessions brokered and recorded	100 percent	No standing vendor tunnels
Machine credentials with owner and expiry recorded	Rising quarter on quarter	NHI inventory coverage
Portal bank detail changes verified by call back	100 percent	Payment fraud control

Framework mapping

Control area	NIST CSF 2.0	NIST SP 800-53 Rev. 5	MITRE ATT&CK
Named and seasonal account lifecycle	PR.AA-01, PR.AA-02	AC-2, PS-4, PS-7	T1078 Valid Accounts
MFA and remote access	PR.AA-03	IA-2, AC-17	T1133 External Remote Services; ICS T0822 External Remote Services
Partner, dealer and MSP access	GV.SC-07	SA-9, IA-8	T1199 Trusted Relationship; T1195.002 Compromise Software Supply Chain
Least privilege and separation in MES and OT	PR.AA-05	AC-5, AC-6	ICS T0859 Valid Accounts
Default and shared credentials on devices	PR.AA-01	IA-5	ICS T0883 Internet Accessible Device
Monitoring of account activity	DE.CM-03	AU-6	T1566 Phishing (entry for credential theft)

Common failure patterns

The harvest login: one account on the scale ticket or grain accounting system shared by every seasonal worker, never changed after the season.
Dealers forever: a dealer or agronomist granted access to a telematics or farm data platform years ago still has it after the relationship ended.
The MSP master key: one MSP technician account with admin rights at every client site, without MFA.
Generic QA accounts: food safety monitoring entered under "QA1" on a tablet, so the record does not show who performed the check.
Phone resets for partners: supplier or member accounts reset on the strength of a phone call.

Practitioner checklist

Map human, partner and machine identities for each segment of your business and give every account an internal owner.
Turn on MFA for email, banking, VPN, remote desktop gateways and OEM platforms; phishing-resistant MFA for admins first.
Build seasonal role templates with expiry dates and run a leaver sweep after each peak season.
Replace shared logins on food safety record systems with named accounts and fast badge or PIN re-authentication.
Review dealer, agronomist and connected app access on every telematics and farm data platform before each season.
Broker, approve and record all integrator and OEM remote sessions to plant OT; remove standing tools.
Require named, MFA-protected MSP technician accounts and RMM logging in contracts.
Verify bank detail changes on member and supplier portals by call back to a known number.
Inventory API keys, service accounts and EDI credentials with owners and expiry dates.
Test the traceability export and OT break-glass access before peak season.

Food and Agriculture Identity Security: Supplier Portals, Farm Systems and Plant OT Access