How to Set Refrigeration Setpoint Limits and Alerts

Refrigeration setpoint limits are the minimum and maximum values a controller will accept for a unit's target temperature, defrost settings and alarms. Set them correctly and a compromised or mistaken change cannot push a cold room far outside its safe range without an alert. The joint US fact sheet issued after the 2026 refrigeration controller attacks tells operators to define reasonable setpoint ranges and alert on deviations. This guide covers how to do that without vendor-specific steps.

What is a setpoint limit?

A setpoint limit is a bound on the value an operator, or an attacker, can enter as a unit's target. If a freezer's setpoint is limited to a range of a few degrees below zero, nobody can set it to 50°C from the controller interface.

Many commercial refrigeration controllers support limits on setpoints, defrost duration and defrost frequency, and separate high and low temperature alarms. Exactly which settings exist, and where they live, depends on the manufacturer and firmware, so confirm the options in your vendor's documentation or with your refrigeration contractor.

Why do setpoint limits matter for security?

Setpoint limits matter because the European attacks worked by changing settings, not by breaking hardware. Attackers forced units into continuous defrost and heating, and temperatures reached 50°C. A unit that refuses out-of-range values, or raises an alarm the moment one appears, turns that change into an early warning.

Limits do not replace removing internet exposure or changing default passwords. An attacker with full administrative access may be able to change the limits too. Their value is in catching mistakes, slowing an intruder down and making sure someone hears about a dangerous change quickly.

How to set refrigeration setpoint limits step by step

1. Build an asset list with the product in each unit

List every controlled unit: walk-in coolers, freezers, display cases, blast chillers, pharmacy fridges, refrigerated trailers. For each, record what it stores and who is responsible for that product. A setpoint range only makes sense against a product's tolerance.

If you do not yet know which controllers you have, start with an inventory. Our earlier guide on how to inventory the OT controllers your facilities contractors put online covers that.

2. Define the safe operating range per unit

Take the range from the product, not from the equipment. Food safety rules, pharmacy storage requirements and blood bank standards set the limits that matter; the controller's factory range is usually far wider. Write down three values per unit:

• Target setpoint: the normal operating temperature.
• Allowed setpoint range: the narrow band staff may ever need to choose.
• Alarm thresholds: high and low temperatures at which someone must be told, with a delay that avoids false alarms during normal defrost.

Get the product owner (store manager, pharmacist, lab lead) to sign off. That record is what you compare against later.

3. Set limits on defrost behavior

Defrost is where the 2026 attacks did their damage. Record the normal defrost schedule, the maximum defrost duration and the termination temperature for each unit, and ask your contractor to cap them in the controller where the firmware allows. A defrost cycle that never ends should be impossible, or at least alarmed.

4. Configure the limits on the controller

Have the refrigeration contractor apply the agreed limits, or do it yourself if you have the access and documentation. Do this in a maintenance window, one unit at a time, and confirm the unit returns to its normal setpoint afterward. Change the controller's default passwords at the same visit; the fact sheet lists that as a core mitigation, and the Dutch victims were running defaults.

5. Add deviation alerts outside the controller

Alerts generated by the controller can be disabled by whoever controls the controller. Add at least one alert path that does not depend on it:

• A monitoring platform that polls the units and alarms on readings outside the range.
• Independent wireless or battery data loggers in the highest-value units.
• An alert when a setpoint, alarm threshold or defrost parameter changes, if your monitoring system can see configuration.
• A "no data" alert when a unit stops reporting, which catches the denial-of-view condition the agencies describe.

Send alerts to a phone that someone answers at 3 a.m. Both European waves happened overnight.

6. Back up the configuration

Export or record each controller's configuration once the limits are in place and store a copy offline, as the fact sheet recommends. If a controller is tampered with, a known-good configuration lets the contractor restore it quickly instead of rebuilding from memory.

7. Test and review

Test each alert path at least once: raise a logger's threshold briefly, or have the contractor simulate a high-temperature condition. Review the ranges when product mix changes and after any controller replacement or firmware update, since updates can reset settings.

How do you know the limits are working?

You know the limits work when an out-of-range change either fails at the controller or produces an alert that reaches a person within minutes. Anything else, including an alert that only appears on a dashboard nobody watches, means the control exists on paper only.

Keep a short log of each test: date, unit, what was tested and how long the alert took to arrive. That record is useful for food safety and pharmacy audits as well as for security reviews.

Common mistakes

• Using the factory range. Controllers often accept far wider values than any product could tolerate.
• Alarming only inside the controller. If an attacker owns the controller, its alarms are theirs too.
• No owner for alerts. A deviation alert that goes to a contractor's general inbox may not be read until morning.
• Forgetting defrost. Temperature setpoints get limited, while defrost duration stays open.

Limits and alerts buy time. What staff do with that time is the subject of why cold storage sites need a manual fallback plan.