Do you know what's connected to the internet in your business?

Recent cyberattacks targeting refrigeration systems in European supermarkets show just how directly digital access can affect business operations. In France, refrigeration systems were remotely manipulated. Incidents have since been reported in other European countries, including Belgium.

For business leaders, the key question starts close to home:

Do we know which devices and systems are connected, who has access to them, and what happens if that access is misused?

Your router only tells part of the story

Having an overview of your company network is a good starting point. However, it doesn't automatically reveal every connection at your premises.

A device may have its own mobile modem, using a SIM card, eSIM or integrated iSIM. It can then communicate over the mobile network, independently of your fixed internet connection. This traffic won't appear in your company router's logs. With eSIM and iSIM technology, there may not even be a removable SIM card.

Equipment without its own internet connection can also be accessible through a gateway or maintenance system. An inventory should therefore cover not only devices, but also their connections and dependencies.

Looking at your network alone isn't enough. You also need to know what your suppliers have installed and how they provide support.

Start by knowing what you have and what you need

A list of device names and IP addresses offers little practical guidance when an incident occurs.

For every relevant system, your inventory should answer a number of business questions:

• Which business process does it support?
• Which connections and external services does it use?
• Who can read data, change settings or install software?
• Who is responsible for it internally?
• Who provides maintenance and security updates, and for how long?
• What happens if the device or its connection fails?
• How can access be revoked without creating an unsafe situation?

These questions link technical asset inventories to operational responsibility. They are consistent with CISA's guidance on operational technology and NIST's baseline security recommendations for connected devices.

Clear ownership is essential. A system may have been purchased by the facilities department, managed by a supplier and considered indispensable by operations. Without a clearly designated internal owner, security responsibilities can easily fall between the cracks.

Keep the benefits of connected equipment

Remote access can be valuable. A maintenance partner can analyse faults and monitor equipment without having to visit the site every time. Remote monitoring is also a legitimate business function for refrigeration systems.

The question, therefore, is what level of access is necessary and under which conditions.

• Can the supplier only view measurements, or can they also change settings?
• Is maintenance access permanently available?
• Who approves changes?
• What information do you receive when something goes wrong?

A device connected to both your internal network and a mobile service deserves particular attention. Investigate which systems can be accessed through that device and restrict access to what is genuinely necessary. A separate network segment can protect your internal environment, but it won't stop direct mobile communication.

Build a solid foundation, then organise ongoing maintenance

For many businesses, creating an initial inventory requires a focused effort: reviewing locations and installations, consulting suppliers, collecting documentation and assigning responsibilities.

That foundation can then be maintained internally, provided updates become part of normal business operations. According to CISA, asset inventory management is an ongoing process. A one-off scan isn't enough.

A practical approach:

Where possible, start with your existing procurement, maintenance and asset management processes. Then determine which additional tools are needed.

Make security part of the quotation process

If you only ask how a device communicates after it has been installed, important decisions have already been made.

That's why you should request an overview of the following in advance:

• All network and mobile communication capabilities, including SIM, eSIM and iSIM.
• External platforms used and data transmitted.
• Access granted to manufacturers, installers and maintenance providers.
• Authentication, access rights and available logging capabilities.
• Security updates, support duration and end-of-support dates.
• Procedures for vulnerabilities and incidents.
• Options for disabling access and connections.
• Procedures for changing suppliers or decommissioning equipment.

These are recommended procurement considerations, based on security capabilities and supplier requirements described by NIST. The specific requirements should reflect the potential business impact of the equipment.

Also establish how you will verify compliance upon delivery. A general promise that a product is "secure" is no substitute for clear, verifiable agreements.

The same effort can deliver business benefits

A useful inventory supports more than security. It can also reveal opportunities:

These are measurable opportunities, not guaranteed savings. They do, however, demonstrate why operations, procurement and finance all benefit from having access to the same essential information.

Regulation reinforces the need for action

For Belgian organisations within the scope of NIS2, appropriate cybersecurity risk management measures and supply chain security are mandatory. The management body must approve these measures and oversee their implementation. However, NIS2 doesn't automatically apply to every business. Its applicability depends on the organisation's activities, size and any legal exemptions.

Where personal data is processed, Article 32 of the GDPR requires appropriate technical and organisational security measures proportionate to the risks. This doesn't mean that every technical failure automatically constitutes a personal data breach.

In addition, the European Cyber Resilience Act imposes obligations on manufacturers of products with digital elements. The main obligations will apply from 11 December 2027, while certain reporting obligations have already applied since 11 September 2026. This doesn't provide a general guarantee that all existing equipment is secure today.

Start with the systems your business depends on

You don't need to investigate every device in the same level of detail. Prioritise systems where failure, manipulation or misuse could have the greatest consequences. A risk-based inventory helps determine those priorities.

The first step is to establish a practical overview: what do we have, what do we need it for, who has access and who takes responsibility?

Build that foundation thoroughly from the outset. Then make sure every purchase, modification and replacement keeps it up to date. This way, cybersecurity becomes a manageable part of your business operations.