An intruder alarm is only as trustworthy as the panel that decides to signal, the path that carries the signal and the people and apps allowed to change its settings. Modern intrusion and hold-up alarm systems are networked devices: IP and cellular communicators talk to an alarm receiving centre (ARC), installers reach panels remotely to programme them, and owners set and unset sites from a phone app backed by a cloud service. That turns a physical security system into an IT and OT asset with credentials, firmware, certificates and third-party access to manage. This guide covers the cyber side of intrusion alarms in depth: what the EN 50131 security grades and EN 50136 alarm transmission categories mean in practice, how to secure ARC links, communicators, cloud apps and remote installer access, and how to monitor and test the whole chain. It goes beyond the door-focused Physical Access Control Systems Security Guide and is for physical security managers, facilities and IT security teams, and integrators specifying or running alarm systems for offices, retail, data centres and critical sites.
Key takeaways
- Grade the risk, then the cyber controls. EN 50131-1 grades (1 to 4) describe the intruder you expect; a Grade 3 or 4 site needs equally serious controls on the communicator, the app and remote access, not just better detectors.
- The signalling path is a security boundary. EN 50136-1 assigns an alarm transmission system (ATS) one of ten categories, SP1 to SP6 for a single path and DP1 to DP4 for dual paths, with requirements for transmission time, fault reporting, substitution security and information security.
- Remote installer access is privileged access. Treat remote programming as a privileged session: unique named accounts, owner authorisation, time limits and logging, never a shared engineer code left enabled.
- Cloud apps and communicators are part of the system. Owner apps, cloud portals and IP or cellular communicators hold credentials and can set, unset or reconfigure the panel; secure them like any internet-facing service.
- Test the whole chain on a schedule. Path failure, substitution and tamper tests with the ARC, plus review of app and remote access logs, are the evidence that the system still works as graded.
How an intrusion alarm system fits together
EN 50131-1 (Alarm systems, Intrusion and hold-up systems, Part 1: System requirements) specifies requirements for intrusion and hold-up alarm systems (I&HAS) installed in buildings; exterior systems are outside its scope. It defines an alarm transmission system as the equipment and network used to transfer information about the state of one or more I&HAS, and refers to the EN 50136 series for those transmission requirements. Each part of the system has a different cyber exposure.
| Component | What it does | Cyber exposure | Primary control |
|---|---|---|---|
| Control and indicating equipment (panel) | Processes detector inputs, holds codes and configuration, decides to alarm | Default or shared codes, outdated firmware, local programming ports | Unique codes per user, firmware maintenance, tamper monitoring, access levels enforced |
| Detectors and wireless devices | PIR, dual technology, contacts, glass break, hold-up devices | Radio interference or jamming on wireless links, tamper | Supervision and jamming detection, tamper detection as the grade requires |
| Supervised premises transceiver (SPT) | IP, cellular or dual-path communicator sending signals to the ARC | Network exposure, SIM and APN configuration, unencrypted or unauthenticated protocols | ATS category matched to grade, encryption and substitution protection, private APN where available |
| Receiving centre transceiver (RCT) and ARC | Receives signals and reports faults, operators act on alarms | Spoofed or replayed signals, path outages that go unnoticed | Polling and fault reporting within the category limits, monitored path failure |
| Cloud service and owner app | Remote set and unset, notifications, user management | Account takeover, weak app authentication, over-shared user accounts | Strong authentication, per-person accounts, alerting on remote set and unset |
| Installer remote programming | Upload and download of panel configuration, diagnostics | Shared engineer codes, always-on remote access, unmanaged laptops | Owner-authorised sessions, named accounts, logging, time limits |
EN 50136-1 uses its own terms for the signalling chain: the supervised premises transceiver (SPT) is the transmission equipment at the premises that interfaces to the alarm system and one or more networks, the receiving centre transceiver (RCT) is the equipment at the ARC, and an alarm transmission path (ATP) is the route an alarm message takes between one alarm system and its annunciation equipment. Using these terms in specifications and contracts avoids confusion between installer, ARC and network provider.
EN 50131 security grades and what they mean for cyber controls
EN 50131-1 places every I&HAS into one of four security grades, chosen from a risk assessment of the premises and the likely intruder, and sets four environmental classes from Class I (indoor) to Class IV (outdoor, general). The grade drives tamper detection, the number of code combinations, event logging and the signalling performance required. The grade descriptions below are a practitioner summary; the binding text is in the standard itself.
| Grade | Expected intruder (summary) | Typical premises | Cyber controls to expect alongside |
|---|---|---|---|
| Grade 1 | Low risk: little knowledge of alarm systems, limited tools | Low risk domestic | Unique user codes, changed installer code, app with strong passwords |
| Grade 2 | Low to medium risk: limited knowledge, general tools | Most homes and small commercial sites | As Grade 1 plus monitored signalling, app multi-factor authentication, firmware updates |
| Grade 3 | Medium to high risk: conversant with alarm systems, comprehensive tools and portable electronic equipment | Commercial premises, retail, offices with valuable stock | Dual-path signalling with substitution and information security, controlled remote access, log review |
| Grade 4 | High risk: able to plan in detail, full range of equipment including means to substitute components | High value and critical sites, government, data centres | Highest ATS categories, strict change control on remote access, integration with the security operations centre |
EN 50131-1 also defines access levels to system functions. Level 1 covers what anyone can see (for example alert indications when the system is unset), and higher levels cover users, installers and manufacturers. In practice this maps neatly to least privilege: users set and unset, installers configure only with the user's authorisation where the standard requires it, and manufacturer-level functions such as firmware replacement are tightly controlled. In the UK, police response for remotely monitored systems also depends on conformance with PD 6662 and BS 8243 and an approved installer and ARC, as the NSI and ProtectUK guidance describes.
Alarm transmission: securing the path to the ARC
EN 50136-1 sets requirements for the performance, reliability and security of an ATS between the supervised premises and annunciation equipment at the ARC, for all alarm types (intrusion, fire, access control and social alarms). An ATS must be assigned one of ten categories: SP1 to SP6 for single-path systems and DP1 to DP4, which add resilience through alternate paths. The category sets the maximum transmission time, the reporting time for path faults and the classes for substitution security and information security.
| EN 50136-1 attribute | What it protects against | What to specify and test |
|---|---|---|
| Transmission time | Delayed alarms that arrive after the intruder has gone | Category value agreed with the ARC; measure end-to-end latency in commissioning tests |
| Reporting time (path fault) | A cut cable, jammed cellular link or failed router going unnoticed | Polling interval matched to category; ARC alerts on loss of each path |
| Substitution security | A device replacing the genuine SPT or RCT to send false "all clear" or suppress alarms | Device authentication between SPT and RCT; confirm the class claimed on the product certificate |
| Information security | Reading or altering alarm messages on the network | Encryption and integrity protection of messages; confirm the class claimed on the product certificate |
| Dual path (DP categories) | Single point of failure in one network | Two independent bearers, for example fixed IP plus cellular on a different provider |
- Decision guidance: Grade 3 and 4 sites, and any site where insurers or police response require it, should normally use a dual-path category; confirm the required category with the insurer and alarm receiving centre. Single-path IP only suits low grades where a delayed fault report is acceptable.
- Bearer choice: When a communicator relies on the site's corporate network, put it on a dedicated VLAN or firewall zone with outbound rules only to the ARC receivers, so the alarm path does not depend on general office traffic and cannot reach other systems.
- Cellular paths: Use a private APN or the provider's closed user group where available, lock the SIM to the device, and confirm the ARC detects loss of the cellular path within the category reporting time.
- ARC side: ARCs operate to EN 50518 (monitoring and alarm receiving centre). Ask how receivers authenticate SPTs, how keys are provisioned, and how the ARC detects a substituted or cloned communicator.
Cloud apps, portals and IP communicators
Most current panels offer remote set and unset, push notifications and user management through a manufacturer or installer cloud. This is convenient and, when well run, more visible than a keypad. It also creates an internet-facing identity system that can unset a site.
- Per-person accounts: Give every key holder their own app account and their own panel code; never share one owner login across a team. Removing a leaver then means disabling one account, not changing everyone's code.
- Strong authentication: Turn on multi-factor authentication for the app and installer portal where the service offers it, and use a password manager for the account. Disable SMS or keypad-only remote commands where an authenticated app is available.
- Notification as detection: Enable push or email alerts for every remote set, unset, user change and bypass. A remote unset outside opening hours is a security event, not just a log line.
- Default credentials: Change every default installer, engineer and web interface password at commissioning. Under the UK PSTI product security regime, in force from 29 April 2024, relevant consumer connectable products must not ship with universal default passwords, must publish how to report security issues, and must state a minimum security update period; ETSI EN 303 645 sets the wider baseline for consumer IoT. Check the update period before buying.
- Exposed web interfaces: Never publish a panel or communicator web interface directly to the internet through port forwarding. Use the manufacturer's outbound cloud connection or a managed remote access service instead.
- Firmware: Record firmware versions of the panel, communicator and keypads, subscribe to the manufacturer's security advisories and include updates in the maintenance contract.
For the wider pattern of connected physical security devices, see the IP Camera and CCTV Security Guide and the ETSI EN 303 645 Guide.
Remote installer access and maintenance
Remote programming (often called upload and download) lets an installer change zones, codes, signalling and timers without a site visit. It is the highest-impact access path in the system, because it can change what the panel reports. NIST SP 800-53 treats this as nonlocal maintenance (MA-4) and remote access (AC-17), and the same discipline applies here.
- Inventory who can connect: list every installer company, engineer account and remote tool that can reach each panel, including any monitoring company and the manufacturer cloud.
- Require owner authorisation: configure the panel so remote programming needs a user-level authorisation for each session where the product supports it, rather than permanent engineer access.
- Use named accounts: each engineer has an individual login on the installer platform with multi-factor authentication; shared engineer codes are retired.
- Time-box and log: open sessions for a defined window, record who changed what, and have the panel event log show the remote session start and end.
- Review changes: after any remote session, compare the configuration export with the approved baseline (zones, signalling, codes, bypasses).
- Contract for it: write these conditions into the maintenance contract, including notification of staff departures at the installer and handling of configuration backups.
The same approach is covered for industrial sites in the OT Third-Party and Integrator Access Guide.
Where identity fits
Alarm codes, app accounts, installer accounts, communicator credentials and SIMs are all identities. Codes and app accounts belong to people and should follow joiner, mover and leaver processes driven from HR, ideally from the same source that drives badge access. Communicator credentials, device certificates and SIMs are non-human identities: record which device holds them, who can reissue them and when they expire. Measure the time from a leaver's last day to code and app account removal, exactly as you would for badges. See the Physical and cyber security convergence guide for joint governance.
Implementation roadmap
- Assess and grade: confirm the grade and environmental class from the risk assessment, insurer requirements and police response policy, and record the ATS category required.
- Inventory: panels, firmware, communicators, SIMs, ARC accounts, cloud accounts, installer accounts and network placement for every site.
- Quick wins: change default and shared codes, turn on app multi-factor authentication, enable remote set and unset notifications, remove ex-staff accounts.
- Signalling: move higher-grade sites to dual-path categories, isolate IP communicators on their own network segment, agree polling and fault reporting with the ARC.
- Remote access: implement owner-authorised, logged installer sessions; remove permanent remote access.
- Test with a rollback plan: before changing signalling, put the site on test with the ARC, keep the old path live until the new one passes transmission and fault tests, then remove it.
- Operate: monthly log review, quarterly path failure tests, annual maintenance with firmware review and configuration baseline comparison.
Detection and measurement
- Monitor: remote set and unset events, user and code changes, remote programming sessions, path failures and restorals, tamper events, and repeated wrong code entries. Forward ARC and cloud events to the SOC where the platform allows, so physical and cyber events can be correlated.
- Metric: path availability per site, from ARC fault reports.
- Metric: time to detect path loss in tests, against the category reporting time.
- Metric: percentage of sites with no shared or default codes and with app multi-factor authentication enabled.
- Metric: leaver to code removal time, target the same day.
- Metric: remote sessions without an owner authorisation record, target zero.
- Metric: panels and communicators on supported firmware.
Framework mapping
| Control area | NIST CSF 2.0 | NIST SP 800-53 Rev 5 | ATT&CK (ICS) |
|---|---|---|---|
| Inventory of panels, communicators, SIMs | ID.AM-01 | CM-2 | |
| Codes, app and installer accounts | PR.AA-01, PR.AA-05 | IA-2, IA-5 | T0859 Valid Accounts |
| Remote installer access | PR.IR-01 | AC-17, MA-4 | T0822 External Remote Services |
| Signalling confidentiality and integrity | PR.DS-02 | SC-8 | |
| Communicator network isolation | PR.IR-01 | SC-7 | |
| Event logs, alarm and path monitoring | DE.CM-02, PR.PS-04 | AU-2, PE-6, SI-4 | |
| Firmware maintenance | PR.PS-02 | SA-22 |
Common failure patterns
- Default engineer code never changed. The installer code from the product manual stays active for years, often shared across many customer sites.
- Grade on paper, not in signalling. A site certified as Grade 3 still signals over a single IP path that nobody tests, so a cut line goes unreported for hours.
- One app login for the whole team. Leavers keep the ability to unset the site, and logs cannot show who did what.
- Permanent remote programming. Remote access stays open between maintenance visits, with no owner authorisation or review of changes.
- Communicator on the flat office network. The IP communicator sits beside desktops and printers, reachable from anywhere internal, and an office outage silently takes the alarm path down.
- Firmware outside any patch process. Nobody owns updates for the panel and communicator, so they run the version installed on day one.
Practitioner checklist
- Record the EN 50131 grade, environmental class and EN 50136 ATS category for every site, with the risk assessment that justifies them.
- Change all default installer, engineer and web passwords; give every user a unique code and app account.
- Turn on multi-factor authentication for owner apps and installer portals and alert on every remote set, unset and user change.
- Use dual-path signalling for Grade 3 and 4 sites, with path loss reported to the ARC within the category limits.
- Place IP communicators in a dedicated network zone with outbound access to the ARC and manufacturer cloud only.
- Require owner authorisation, named accounts and logging for every remote installer session.
- Track firmware versions and security update periods for panels and communicators and include updates in the maintenance contract.
- Run quarterly path failure and tamper tests with the ARC and keep the results as evidence.
- Remove leavers' codes and app accounts on their last day, driven from the same process as badge revocation.
Standards and references
- CENELEC: EN 50131-1 Alarm systems, Intrusion and hold-up systems, Part 1: System requirements
- CENELEC: EN 50136-1 Alarm systems, Alarm transmission systems and equipment, Part 1: General requirements
- ETSI: EN 303 645 Cyber Security for Consumer Internet of Things: Baseline Requirements
- UK Government: The UK Product Security and Telecommunications Infrastructure (Product Security) regime
- ProtectUK (Counter Terrorism Policing): Alarms and CCTV
- NSI: Intruder Alarm Systems
- NIST: SP 800-53 Rev 5 Security and Privacy Controls
Related NHI Mgmt Group resources: Physical Access Control Systems Security Guide · Physical Security Guide for Security Teams · Physical Intrusion Response Playbook · IP Camera and CCTV Security Guide