ISO 8102-20:2022

Overview

ISO 8102-20:2022 specifies cybersecurity requirements for lifts, escalators and moving walks (referred to as Equipment Under Control, or EUC). It defines minimum product and system security measures across the lifecycle - from product development and manufacturing to installation, operation, maintenance and decommissioning - for EUCs that can connect to external systems (building networks, cloud services, service tools). The standard focuses on protecting essential functions, safety functions and alarm functions and covers EUC interfaces to external systems (but not the external systems themselves). Note: it does not apply to EUCs installed before the standard’s publication date.

Key topics and technical requirements

ISO 8102-20:2022 centers on a secure development lifecycle and practical security controls. Major technical topics include:

• Secure development lifecycle (SDLC) for lifts, escalators and moving walks: process scoping, security management, development environment security and file integrity.
• Specification and design: product security context, threat modelling, secure-by-design and defense-in-depth principles.
• Secure implementation and verification: secure coding practices, security testing, vulnerability testing and penetration testing with tester independence.
• Security update management: qualification, documentation, delivery and timely patching of security updates and dependent component updates.
• Management of security-related issues: receiving, reviewing, assessing, addressing and disclosing vulnerabilities.
• Operational guidance: security hardening, account management, secure disposal and secure operation guidelines.
• Domains and levels: classification of EUC functions and selection of security controls; guidance on compensating controls and least privilege.
• Documentation: requirements for product supplier and system integrator to provide documentation enabling the EUC owner to achieve and maintain security.

Practical applications

ISO 8102-20 is designed to be applied by organizations involved in the lifecycle of connected vertical-transport equipment:

• Lift and escalator manufacturers - embed cybersecurity in product development, production and release processes.
• System integrators and installers - integrate EUCs securely with building management systems and cloud services.
• Maintenance and service providers - manage secure updates, vulnerability response and operational hardening.
• Building operators and facility managers (EUC owners) - use supplier documentation and guidance to operate and maintain secure EUCs.
• Security architects and compliance teams - align product design and risk assessments with operational technology cybersecurity best practices.

Adopting ISO 8102-20 reduces cyber risk to safety‑critical functions, supports secure connectivity to building networks and cloud services, and provides a documented approach to vulnerability management and patching.

Related standards

• ISO 8100 series (lift, escalator and moving walk standards)
• IEC 62443 series (operational technology cybersecurity) - ISO 8102-20 maps roles and lifecycle practices to IEC 62443 principles
• IEC Guide 120 (product security guidance)