A greenhouse outage and a fraudulent supplier invoice create different problems. These six checks help horticulture businesses protect growing operations and the office that keeps orders moving.
Start with the work that cannot wait
Plants keep growing while you try to restore an account. If the greenhouse dashboard goes offline, who checks irrigation and ventilation? If a supplier emails new bank details during the busiest shipping week, who verifies the change before money leaves?
Horticulture business cybersecurity is about the accounts, equipment connections, orders, and payments a nursery, greenhouse, or garden center depends on. Start by asking which digital problem could interrupt growing, selling, or getting paid—and who would handle it.
In an October 12, 2026 AgFunderNews opinion article, Jennifer Marston argues that cybersecurity deserves more attention as agrifood adopts connected technology. Growers can apply that point close to home by identifying which work depends on a working account, connection, or software service.
A greenhouse grower may rely on environmental controls. A wholesale nursery may depend on availability lists, customer orders, and delivery schedules. A retail garden center may rely more on checkout, inventory, and supplier payments. Your priorities depend on how your business actually works.
1. Identify what must keep working
Walk through a normal day with the grower, office manager, and sales or shipping lead. Follow the work from watering and climate management through purchasing, sales, and delivery. List the accounts, devices, equipment, and service providers each step relies on.
For each system, note what happens if it is unavailable or its information is wrong, whether staff can keep working locally or manually, who owns it, who provides support, and how long it can stay down before work or product is affected.
Keep growing equipment and office software on the same business inventory, but do not treat them as the same kind of system. Operational technology (OT) monitors or changes a physical process; reliability and safe operation matter when making changes to it.
- A greenhouse control or irrigation system: identify who monitors it and what happens if remote access is lost.
- Orders, inventory, and delivery schedules: identify what staff need if the normal software or account is down.
- Email, accounting, and banking: identify who can access them and approve changes.
- For every entry: name a business owner, a support contact, and a recovery priority.
2. Find out who can change growing-system settings
A technician may need remote access to troubleshoot a controller. A grower may use an app to adjust settings. Either way, someone at the business should know which people and services can view readings, change settings, or administer accounts.
Ask the equipment supplier how its technicians connect: through a cloud portal, remote-support tool, or separate gateway. Find out whether access is always available or approved for a particular job, whether you can review sign-ins and changes, and who can revoke access when a technician or contract changes.
Internet-connected equipment is not necessarily reachable directly from the public internet. A cloud dashboard alone does not show that a controller is exposed. Ask the supplier to explain the actual access route and work with a qualified technical provider before changing it; an unplanned change could disrupt monitoring or growing operations.
Joint CISA, FBI, EPA, and DOE guidance recommends reducing direct public exposure, securing necessary remote access, limiting permissions, and separating business and equipment networks. Apply the advice with the people responsible for keeping the equipment running.
- Ask for a documented access route and a current list of approved users.
- Identify the person who can end a support session or revoke an account.
- Ask how access is limited to the equipment and work that the supplier needs.
3. Protect the office accounts behind orders and money
Business email, accounting, online banking, inventory, and wholesale ordering deserve attention whether or not the greenhouse has connected controls. A compromised mailbox can expose order details or make a fraudulent payment request look like an ordinary supplier conversation.
Give each person an individual account so the business can grant and remove access. Turn on multifactor authentication (MFA) wherever it is offered, especially for email, administrator accounts, banking, and remote access. Use passkeys or security keys where the service supports them.
Keep control of account recovery. A critical business account should not depend entirely on a former employee's phone or a contractor's personal email address. Make sure the business knows who can recover each account and update those contacts when roles change.
NIST's Cybersecurity Framework 2.0 Small Business Quick Start Guide can help organize this review. It is a starting point, not evidence that safeguards are already in place; ask your IT provider to show which accounts are covered.
- Confirmation that MFA is enabled for critical accounts.
- A current list of account owners and administrators.
- Recovery methods controlled by the business.
4. Verify supplier payment changes before paying
Picture an email that appears to come from your pot supplier. A large invoice is due, and the message says the supplier has changed banks. The message may look convincing; the payment still needs independent verification.
Call a trusted supplier contact using a number already in your records. Do not use the number or link in the change request. Record who confirmed the details, and require a second approval before updating payment instructions.
Give staff a clear rule: urgency is not a reason to skip verification. Use the same pause when someone requests an unusual refund or a change to the delivery destination for a valuable order. Confirm through an established contact before acting.
- A written callback rule that uses contact details already on file.
- A second approver for changes to supplier payment details.
- A record of who verified and approved each sensitive change.
5. Give seasonal and vendor access an end date
Before the busy season, decide which roles need access to inventory, customer records, shared files, checkout administration, and supplier portals. Avoid spreading one supervisor password across the team; individual accounts make it possible to see who has access and remove it when a role ends.
Set an end date for temporary accounts and permissions, and assign someone to check that access is removed. When an employee leaves, transfer business records and responsibilities first, then close the account and revoke active sessions where the service supports it.
Review vendor access when a maintenance contract changes or a technician no longer supports the business. Keep a named business owner for each outside connection.
- A current account list with a responsible manager.
- An end date and removal owner for seasonal or temporary access.
- A review of vendor accounts when staff, contracts, or equipment support changes.
6. Run an outage exercise before busy season
Choose a realistic scenario: staff cannot access email and the grower's remote dashboard is unavailable. Talk it through; do not disconnect live systems to run the exercise.
Can someone check actual growing conditions using an independent reading? Will local controllers continue to operate without the internet or cloud service? What supplier-approved local or manual procedure is available? How will the office find today's orders, delivery schedule, and customer contacts? Who can restore business records and equipment configurations?
Keep important support contacts and operating instructions available outside the accounts or services that might be affected. Confirm fallback behavior with the supplier instead of assuming that automation stops—or continues safely—when connectivity fails.
Office backups and controller backups are different. NIST's OT backup guidance emphasizes regular backups, testing, and recovery exercises. Have qualified personnel plan any equipment restoration test around the growing operation.
- Evidence of a recent restore test for business records.
- A supplier-confirmed equipment recovery plan, where relevant.
- Named recovery owners and contacts that can be reached outside affected systems.
Start with one growing dependency and one payment risk
You do not have to solve every issue this week. Choose the growing system whose failure would hurt soonest and the account or approval process that controls your next significant payment. Ask someone to verify each one and write down what still needs attention.
For broader guidance on business IT safeguards, see our page for agriculture and farm-service businesses. Keep any review of greenhouse controllers or other operational equipment separate from an ordinary business IT assessment, and agree the scope with qualified providers.
Related resources
Know what is public—and what still needs verification
The free Zero-Access Business Exposure Review checks public email, domain, and website signals without passwords or internal access. It does not inspect greenhouse controllers, prove internal account safeguards, or test recovery. The $1,995 Business Security Baseline verifies agreed internal safeguards for businesses with up to 25 employees; larger businesses receive a confirmed quote. Equipment controls require an explicitly agreed scope and the right operational specialists.