For: dealers, installers, facility IT teams and commercial buyers
The decision: Who owns the network, access, update and retirement responsibilities for the proposed consoles?
60-second answer: Bring the buyer’s IT owner into the quote before installation. Document permitted connections, administrator access, updates, support deadlines and data removal. Treat connectivity as a commissioned system with an owner.
Make the IT handoff part of the equipment proposal
The installer may assemble the treadmill while the facility’s IT team controls its connection. Name the owner of network design, credentials, remote support and acceptance before the order. A Wi-Fi password is not a complete handover plan.
NIST’s IoT Device Cybersecurity Capability Core Baseline is a starting point for identifying security capabilities in connected devices. The checklist below is FEX’s procurement application of that approach, not a claim that a particular console has NIST certification.
| Question | Evidence to request | Owner |
|---|---|---|
| 1. What connects? | Models, device identifiers, interfaces and software versions | Dealer and IT |
| 2. What must it reach? | Vendor-documented services and network requirements | Manufacturer and IT |
| 3. What separates it from other systems? | Approved network design and verified access restrictions | Facility IT |
| 4. Who can administer it? | Account roles, authentication controls and credential handover | Manufacturer and IT |
| 5. How does remote support work? | Authorization, access records and revocation process | Service provider and IT |
| 6. Who manages updates? | Update notice, verification and recovery procedure | Named maintenance owner |
| 7. When does support end? | Written support policy and available options | Manufacturer and buyer |
| 8. How is data removed? | Sign-out, reset, deletion and account-transfer instructions | Buyer, IT and removal contractor |
Verify required connections before accepting the work
Ask IT to allow the documented functions the facility needs, using suitable segmentation and access controls. Some systems require management or identity services beyond a content feed. A blanket rule that assumes every console only needs one vendor website can break legitimate operation. The manufacturer should document requirements and IT should approve the design.
- Reconcile delivered devices with the asset list.
- Confirm authorized administrative access and remove unnecessary access.
- Verify normal operation on the approved network and record the software version.
- Demonstrate the support path and how access can be withdrawn.
- Assign owners and dates to unresolved acceptance items.
Use authorized personnel and IT-approved tests. If the vendor cannot document a needed control, record the limitation for the buyer’s decision before deployment. An equipment dealer should not probe unrelated customer systems.
Price support after opening day
Include IT coordination, commissioning and ongoing support responsibilities in the proposal. Identify who receives vulnerability notices and confirms updates. For an unsupported console, assess replacement, restricted connectivity or offline use with the manufacturer and IT; verify which operating functions depend on connectivity before disconnecting it.
What to do this week
- Attach the checklist to the next console quote.
- Review requirements with the manufacturer and buyer’s IT owner.
- Add access revocation and software support to the handover record.
Continue with firmware management and support-obsolescence planning. This checklist is FEX editorial guidance.
