official guidance (CISA-led joint fact sheet, Nov 5)
Tip: find your refrigeration and cold-chain controllers on the internet this week, then lock down setpoints
Inventory: ask facilities and your refrigeration contractor for every controller, gateway and remote-monitoring service, including the contractor's own access path (the EFS incident came in through a contractor's monitoring).
Exposure: scan your external ranges and check Shodan/Censys for your IPs; any controller web UI or protocol answering from the internet should come off it or go behind a VPN.
Credentials: change defaults, remove shared vendor logins, and require MFA on the remote-access path.
Setpoints: configure hard min/max limits and alerts on deviation, so a remote change to heating or defrost gets noticed in minutes, not hours.
Separate: put the controllers on an OT VLAN and allowlist which hosts may change settings.