What should a Central Valley agriculture business require from an IT provider?
A Central Valley agriculture business should require an IT provider that understands both office IT and operational technology: identity security, remote access, endpoint management, backups, vendor access, ERP uptime, and incident response. Precision agriculture, cold storage, irrigation systems, financial workflows, and distributed field operations create a risk profile that generic help desk support does not cover.
For agriculture companies around Modesto, Manteca, Stockton, Merced, Fresno, and the broader Central Valley, the wrong IT partner usually fails in predictable places. They protect laptops but ignore field devices. They monitor email but not remote-access exposure. They back up servers but never prove restoration. They support accounting software but do not lock down payment approvals. They say they “do cybersecurity” but cannot explain how they would contain a ransomware event during harvest, shipping, or production.
The agriculture sector is no longer a low-tech environment. CISA notes that food and agriculture organizations run both operational technology and information technology systems that are vulnerable to cyberattacks, and its sector checklist points organizations toward MFA, phishing reporting, software updates, vulnerability scanning, OT protection, backups, and incident response planning.1 CISA has also warned that precision agriculture uses embedded and connected technologies for crop and livestock management, and that attackers could exploit weaknesses to access sensitive data, steal resources, or damage equipment.2
This listicle is for agriculture executives, controllers, operations leaders, and internal IT teams comparing managed IT providers. It is not a generic “cyber tips” article. It is a buying checklist for selecting a provider that can support real agricultural operations.
1. Require proof they can support both IT and operational technology
An agriculture IT provider must understand the difference between office IT and operational technology. Office IT includes Microsoft 365, accounting systems, ERP, endpoints, printers, Wi-Fi, file shares, and business applications. Operational technology includes connected equipment, irrigation controllers, sensors, scales, cold storage monitoring, facility systems, and production-related networks.
This matters because agriculture operations increasingly depend on connected systems that are not managed like normal laptops. USDA AMS has noted that agriculture is adopting robotics, aerial imaging, digital mapping, GPS, IoT, cloud computing, AI, autonomous robots, big data, and related digital technologies, all of which create new cyber-attack surfaces.3 That does not mean every farm or processor has the same environment. It does mean the provider needs a discovery process that goes beyond “how many computers do you have?”
Ask prospective providers:
- Which systems do you classify as office IT, operational technology, vendor-managed technology, and unmanaged shadow technology?
- Do you build a network map that separates business systems from production, facilities, irrigation, warehouse, and guest networks?
- Can you identify internet-facing systems, remote access tools, wireless bridges, controllers, cameras, and third-party service tunnels?
- How do you handle systems that cannot run normal endpoint protection?
- How do you document risk when a vendor insists on persistent remote access?
A weak provider will say, “We support your computers and network.” A stronger provider will ask what systems keep operations moving, which vendors require access, which devices are seasonal, and which systems would stop shipping, harvesting, cooling, billing, or payroll if they went down.
For Datapath’s local service context, see managed IT services in Modesto and managed IT services in Fresno.
2. Require identity security for email, ERP, banking, and vendor portals
Agriculture companies often run lean administrative teams with high-trust workflows: invoice approval, payroll, ACH, wire transfers, grower payments, vendor orders, freight coordination, insurance documents, and seasonal labor administration. That makes identity security a commercial requirement, not an abstract security feature.
At minimum, your IT provider should enforce multifactor authentication for Microsoft 365 or Google Workspace, financial systems, ERP, remote access, administrator accounts, password managers, and vendor portals. They should also monitor mailbox forwarding rules, suspicious sign-ins, privileged-role changes, impossible travel, legacy authentication, and dormant accounts.
The FBI IC3 2025 Annual Report recorded 24,768 business email compromise complaints and $3,046,598,558 in reported BEC losses in 2025.4 Agriculture companies are exposed because many payment and procurement workflows still depend on email trust. A convincing spoofed message, compromised vendor mailbox, or fake domain can redirect payments or trigger fraudulent orders.
Ask providers for their standard identity-security baseline:
- MFA enforced for all users, not merely “available”
- Conditional access policies for risky sign-ins
- Separate administrator accounts
- Emergency access accounts with documented controls
- Removal of legacy authentication where possible
- Quarterly access reviews for finance, payroll, and operations users
- Alerting on suspicious mailbox rules and external forwarding
- Vendor portal credential management
- Offboarding within a defined SLA
If a provider treats MFA as optional because “users may complain,” move on. In agriculture, where owners, finance teams, managers, and field supervisors may work across offices, facilities, trucks, yards, homes, and mobile devices, identity is the control plane.
Related Datapath resources: Microsoft 365 identity security services and email authentication setup guide.
3. Require remote access controls for field sites, facilities, and vendors
Agriculture operations often span multiple facilities: offices, packing houses, storage yards, processing locations, cold rooms, field operations, and remote network closets. Remote access is necessary. Uncontrolled remote access is dangerous.
Your provider should inventory every remote access path:
- VPNs
- Remote desktop tools
- Vendor support agents
- Firewall management portals
- Cellular gateways
- Cloud dashboards
- Camera systems
- Wireless bridges
- Remote access to controllers or facility systems
- Personal-device access to business applications
CISA’s food and agriculture checklist specifically calls out protecting OT systems by hardening remote access, strengthening security posture, and limiting adversarial use of common vulnerabilities.1 That is practical buying guidance. The provider should not merely say, “We use a firewall.” They should explain how they reduce external exposure and how they approve, log, and revoke access.
Your requirements should include:
- MFA on every remote-access path where technically possible
- No shared vendor accounts
- Named accounts for support technicians
- Time-limited vendor access when feasible
- Logging of remote sessions
- Approval workflows for high-risk access
- Network segmentation between business and operational systems
- Removal of abandoned tools from prior providers
- Patch tracking for VPNs, firewalls, remote monitoring tools, and gateways
The most dangerous phrase in an IT sales call is “we’ll figure that out during onboarding.” Remote access is too important to improvise after the contract is signed.
4. Require backup proof, not backup promises
Agriculture businesses cannot evaluate backup quality by asking, “Do you back us up?” The useful question is, “What can you restore, how fast, from what date, and how do we know?”
CISA advises food and agriculture organizations to regularly back up OT and IT systems so they can recover to a known safe state after compromise.1 NIST’s small-business information security guidance exists to help smaller organizations build an information security program in practical language, which fits many agriculture companies that have serious operational risk but limited internal security staff.5
A provider should be able to produce a backup and recovery matrix for each critical system:
| System | Backup frequency | Retention | Immutable/offline copy | Restore test | Business owner |
|---|---|---|---|---|---|
| ERP/accounting | Daily or better | Defined by business need | Yes where possible | Scheduled | Controller/CFO |
| File shares | Daily or better | Defined by policy | Yes where possible | Scheduled | Operations/Finance |
| Microsoft 365 | Third-party backup if required | Defined by policy | Vendor-dependent | Scheduled | IT/Finance |
| Dispatch/shipping systems | Based on operational tolerance | Defined by business need | Yes where possible | Scheduled | Operations |
| Facility/OT configs | After changes and on schedule | Defined by system | Offline export where possible | Documented | Operations/IT |
The provider should also separate backup monitoring from restore testing. A green dashboard only proves a job ran. It does not prove the business can recover. Require evidence of restore tests: date, system, scope, result, issue found, owner, remediation, and next test.
For a deeper internal link, see Datapath’s backup and disaster recovery guide and disaster recovery services.
5. Require vulnerability management that accounts for seasonality
Agriculture is seasonal. Planting, harvest, processing, school purchasing cycles, annual audits, inventory turns, and shipping windows can all affect when updates are safe to deploy. But “we were busy” is not a vulnerability management strategy.
The right provider should define patch categories:
- Emergency patches for known exploited vulnerabilities
- Internet-facing infrastructure patches
- Normal workstation and server patches
- Firmware patches
- Application patches
- Vendor-managed system patches
- Deferred patches with documented business justification
CISA’s sector checklist recommends regular cybersecurity assessments, public-facing exposure reduction, cyber hygiene services, and prioritizing patching according to the Known Exploited Vulnerabilities catalog.1 That gives agriculture companies a clear evaluation standard: a provider should know which assets are exposed, which vulnerabilities are actively exploited, and which patches must be escalated.
Ask:
- How quickly do you patch known exploited vulnerabilities on internet-facing systems?
- How do you handle firewalls, VPNs, and remote access tools?
- Do you maintain a device inventory that includes servers, workstations, network devices, and vendor appliances?
- How do you handle systems that cannot be patched immediately?
- Do you document compensating controls when patches are deferred?
- How do you report patch status to management?
A serious provider will not promise “everything patched instantly.” That is fake. They will explain risk-based sequencing, maintenance windows, rollback plans, owner approval, and exception handling.
6. Require incident response planning before the incident
An incident response plan should exist before ransomware, email compromise, vendor compromise, or data exposure occurs. During an incident, agriculture leaders need roles, decisions, and communication paths already defined.
CISA recommends developing cyber incident response plans before an incident occurs and exercising those plans with tabletop scenarios, including resources tailored for the Food and Agriculture Sector.1 That point is especially relevant for Central Valley companies with lean teams. During a real event, the owner, controller, operations manager, plant lead, HR, insurance broker, legal counsel, bank, and IT provider may all need to coordinate quickly.
A provider should help answer these questions:
- Who can authorize containment actions?
- Who decides whether to disconnect a system?
- Who contacts cyber insurance?
- Who contacts banks after suspected payment fraud?
- Who communicates with customers, vendors, or employees?
- Who preserves logs and evidence?
- Who approves restoration order?
- Which systems come back first?
- What manual workarounds exist for shipping, payroll, order intake, and receiving?
- How are vendors notified if their access is suspended?
For agriculture, restoration order matters. Payroll may matter before archived file shares. Shipping may matter before conference room AV. Cold storage monitoring may matter before standard desktop recovery. Finance may need bank fraud response faster than general help desk triage.
See Datapath’s ransomware incident response playbook and incident response retainer services.
7. Require business reviews that tie IT work to operational outcomes
A good agriculture IT provider should not bury leadership in ticket counts. Ticket counts matter, but they do not answer whether the business is safer, more resilient, more efficient, or better prepared for growth.
Quarterly or semiannual business reviews should connect IT activity to operational outcomes:
- Downtime trends
- Recurring support issues
- Security control coverage
- Backup test results
- Patch exposure
- Aging hardware
- Internet and carrier reliability
- Wireless coverage at facilities
- Vendor access risk
- Insurance or compliance evidence
- Budget forecast
- Project roadmap
The provider should bring a roadmap, not just a retrospective. For example:
- Replace end-of-life firewalls before renewal deadlines
- Segment guest Wi-Fi from business and facility networks
- Clean up Microsoft 365 licensing and stale users
- Improve backup retention for accounting and shared files
- Standardize endpoint protection across seasonal and full-time staff
- Document vendor remote access
- Upgrade UPS units in network closets
- Prepare a tabletop exercise before peak operational season
This is where managed IT becomes strategic. If the provider only reacts to tickets, leadership has no forward view of risk. If the provider brings evidence, decisions, and budget options, IT becomes part of operational planning.
For Datapath’s model, see vCIO services and managed IT services.
How should agriculture companies compare managed IT providers?
Agriculture companies should compare managed IT providers on operational fit, not just monthly price. The better provider will document systems, harden remote access, enforce identity controls, test backups, patch based on risk, prepare incident response, and review business outcomes with leadership. The cheapest provider is rarely cheapest after downtime, fraud, failed backups, or emergency remediation.
Use this scorecard during sales calls:
| Requirement | Weak answer | Strong answer |
|---|---|---|
| IT/OT discovery | “We support networks.” | “We classify office IT, OT, vendor systems, and unmanaged devices.” |
| MFA and identity | “We recommend MFA.” | “We enforce MFA and monitor risky identity events.” |
| Remote access | “Vendors have access as needed.” | “Vendor access is named, logged, reviewed, and removed when no longer needed.” |
| Backups | “Backups run daily.” | “Here is what we restore, how often we test, and who owns each system.” |
| Patching | “We patch monthly.” | “We prioritize exploited and internet-facing vulnerabilities first.” |
| Incident response | “Call us if something happens.” | “Here is the documented incident plan and tabletop schedule.” |
| Business reviews | “We send ticket reports.” | “We review uptime, risk, roadmap, budget, and evidence.” |
When should a Central Valley agriculture business switch IT providers?
A Central Valley agriculture business should consider switching IT providers when the current provider cannot document backups, secure remote access, enforce MFA, produce an asset inventory, explain incident response, or connect IT planning to operational risk. Repeated outages, unresolved ticket patterns, surprise project costs, and vague cybersecurity answers are also warning signs.
Specific red flags include:
- No current inventory of servers, workstations, network devices, and critical applications
- No list of vendor remote access tools
- No tested restore evidence
- Shared administrator accounts
- Optional MFA
- No quarterly business review
- No patch reporting
- No written incident response plan
- No roadmap for aging infrastructure
- No clear escalation path during harvest, production, or shipping windows
Switching providers should be planned, not rushed. A competent incoming provider should perform discovery, collect documentation, review contracts, identify critical systems, map vendors, confirm backups, plan credential turnover, and avoid disrupting operations.
See Datapath’s MSP onboarding checklist and managed IT transition services.
Practical CTA: get an agriculture IT risk review
If your agriculture business depends on connected facilities, ERP, accounting systems, remote users, vendor portals, field networks, or production-adjacent technology, do not evaluate IT providers on help desk price alone.
Datapath helps Central Valley and multi-site organizations assess managed IT, cybersecurity, backup, remote access, and operational resilience requirements before a provider transition.
Talk with Datapath about managed IT for agriculture and Central Valley operations
FAQ
What is the most important IT control for an agriculture business?
The most important starting control is enforced multifactor authentication on email, remote access, administrator accounts, financial systems, and cloud applications. Agriculture companies rely heavily on email, vendor portals, payments, payroll, and distributed access, so stolen credentials can quickly become business email compromise, payment fraud, or unauthorized system access.
Does precision agriculture create cybersecurity risk?
Yes. Precision agriculture uses connected and embedded technologies to collect data and manage crop, livestock, equipment, and operational decisions. CISA has warned that attackers could exploit precision agriculture vulnerabilities to access sensitive data, steal resources, or damage equipment.2 The risk depends on the specific systems deployed and how they are connected.
Should agriculture companies segment operational systems from office networks?
Yes. Segmentation reduces the chance that a compromised office account, infected laptop, or exposed remote access tool can reach production-adjacent systems. The right segmentation model depends on the environment, but business networks, guest Wi-Fi, vendor access, cameras, facility controls, and operational systems should not all sit on one flat network.
How often should backups be tested?
Backups should be tested on a defined schedule based on business criticality. Critical systems such as ERP, accounting, file shares, Microsoft 365 data, dispatch, shipping, and operational configuration backups should have documented restore tests. The test should record date, scope, result, issues found, remediation, and next test date.
What should an agriculture company ask an IT provider before signing?
Ask for their standards for MFA, remote access, backups, patching, endpoint protection, vendor access, incident response, business reviews, and onboarding. Then ask for sample reports. Strong providers can show how they document risk and communicate with leadership. Weak providers stay vague until after the contract is signed.
Is managed IT different for agriculture than for a normal office?
Yes. Agriculture companies often combine office IT, field operations, warehouses, facilities, seasonal labor, vendors, remote sites, payment workflows, and production-adjacent technology. The provider must understand business continuity, not just desktops and tickets.
Footnotes
-
Cybersecurity and Infrastructure Security Agency, “Food and Agriculture Cybersecurity Checklist and Resources,” Source ↩ ↩2 ↩3 ↩4 ↩5
-
Cybersecurity and Infrastructure Security Agency, “Cybersecurity Threats to Precision Agriculture,” Source ↩ ↩2
-
U.S. Department of Agriculture Agricultural Marketing Service, “GIAC Cyber Security Discussion Paper,” Source ↩
-
Federal Bureau of Investigation Internet Crime Complaint Center, “2025 IC3 Annual Report,” Source ↩
-
National Institute of Standards and Technology, “Small Business Information Security: The Fundamentals,” NISTIR 7621 Rev. 1, Source ↩
