Nicholas Whiting, VP Alarm Signalling, AddSecure UK, explains why the updated code of practice reflects the growing need to protect both the physical and digital resilience of modern fire alarm systems
The updated BS 5839-1:2025 code of practice reflects the increasing connectivity of fire alarm systems, introducing stronger guidance on remote access, signalling resilience and system security. As fire alarm technology evolves, cyber security is becoming a core part of protecting life safety and ensuring resilient fire detection.
How BS 5839-1:2025 is reshaping fire alarm best practice
Introduced in 2025, BS 5839-1:2025 replaced the previous 2017 edition, marking a significant evolution in how the fire alarm sector approaches the design, installation, commissioning and maintenance of fire alarm systems in non-domestic buildings. While the standard remains a code of practice rather than a new regulatory requirement, it reflects the growing complexity of connected fire alarm environments and highlights the increasing importance of cyber security alongside fire safety.
As the industry approaches a year since the publication of BS 5839-1:2025, the updated guidance offers valuable lessons on how fire safety and cyber security are becoming increasingly interconnected.
For many years, BS 5839-1 has provided the fire and alarm industry with a framework for good practice. The 2025 revision builds on this by improving fire safety guidance, strengthening detection requirements in higher-risk areas and incorporating lessons learned from major incidents, including Grenfell Tower. The revised code also introduces clearer expectations around documentation, false alarm reduction and protecting vulnerable building occupants.
Key changes for Category L and Category P fire alarm systems
Under BS 5839-1:2025, Category L systems, which prioritise life safety, should use smoke or multi-sensor detectors as the default in sleeping accommodation. Zone plans are now considered essential in multi-zone installations and must be verified for accuracy during maintenance.
For residential care premises, the updated guidance recommends automatic transmission of fire signals to alarm receiving centres, recognising that the absence of remote monitoring is no longer considered acceptable. Meanwhile, Category P systems, designed to protect property, include refreshed guidance on detector positioning around structural obstacles, simplified manual call point distances and enhanced signalling requirements. These include alarm signal transmission within 120 seconds and reporting catastrophic loss of both signalling paths within 31 minutes for dual-path systems.
Why cyber security is now part of fire alarm system design
Perhaps the most significant development within BS 5839-1:2025 is its recognition that fire alarm systems are no longer standalone installations. Modern systems are increasingly integrated into wider building networks, communicate over IP infrastructure and can often be accessed remotely for diagnostics and maintenance.
While these capabilities deliver operational benefits, they also introduce cyber security risks that were largely absent from traditional fire alarm systems. Any system capable of remote access presents the potential for unauthorised interference if appropriate safeguards are not in place.
Historically, engineers were required to attend site to diagnose faults or carry out maintenance. Today’s connected systems allow faster fault identification, earlier notification of issues and, in some cases, remote servicing. However, BS 5839-1:2025 makes it clear that improved functionality must be matched by appropriate security measures.
Although the guidance stops short of mandating specific cyber security controls, it outlines best practice for securing remote access. This includes using secure authentication before connections are established and ensuring equipment used to facilitate remote access is housed within locked cabinets or tamper-resistant enclosures. Whether systems communicate via IP or mobile networks, the revised code reinforces the importance of protecting remote access against unauthorised activity.
Strengthening signalling resilience under BS 5839-1:2025
The updated standard also places greater emphasis on signalling resilience, recognising that reliable communication is fundamental to effective fire protection.
For property protection systems, alarm signals should be transmitted within 120 seconds, while life safety systems are expected to achieve even shorter transmission times due to their higher-risk nature. Dual-path signalling devices must report catastrophic loss of both communication paths within 31 minutes (DP2) for Category P systems, helping ensure faults are detected and escalated promptly.
Dual-path radio systems may be used where they satisfy the reporting requirements for DP2 and DP3. For Category L systems, however, catastrophic failures should be reported within three minutes (DP4), with alarm signals transmitted within 90 seconds. DP3 dual-radio systems should only be used where a documented variation justifies their installation, such as where a fixed IP connection is not technically feasible.
These requirements demonstrate that signalling resilience extends beyond the fire alarm panel itself. As remotely monitored systems become increasingly common, installers are relying more heavily on manufacturers and signalling providers to deliver secure, resilient infrastructure capable of meeting the expectations set out in BS 5839-1:2025.
Training and future resilience
Alongside technological improvements, the revised standard also recognises the importance of ongoing competence. Modern fire alarm systems are active, connected assets that require continual management rather than one-off installation. The guidance recommends that installers invest in continuous professional development to ensure their knowledge evolves alongside increasingly sophisticated systems.
As fire alarm technology continues to become more connected, remotely managed and integrated within wider building management systems, cyber security is no longer a separate consideration. BS 5839-1:2025 demonstrates that protecting connected fire alarm systems now requires both physical and digital resilience. The updated code of practice reflects an industry where fire safety and cyber security are becoming inseparable, requiring manufacturers, installers and building owners to consider both as part of delivering resilient life safety systems.
