Secure APC Network Management Cards and PowerChute Shutdown

• Inventory every AP9640, AP9641, AP9643, embedded NMC3, UPS application, firmware version, UPS association, IP and DNS record, certificate, account, protocol, notification, integration, and support owner in a protected system.
• Place NMC access on a restricted management plane, use trusted certificates and unique roles, prefer HTTPS, SSH, and SNMPv3, disable unused legacy services, synchronize time, centralize logs, and test break-glass access.
• Model PowerChute Network Shutdown from the actual single, redundant, parallel, outlet-group, virtualization, and application topology rather than copying settings from an unrelated UPS or site.
• Test events and shutdown timing from alert receipt through workload stop, host shutdown, reserve, UPS turnoff, utility return, and controlled startup without forcing an uncontrolled production discharge.
• Treat NMC firmware, PCNS releases, operating systems, certificates, credentials, firewall rules, configuration backups, subscriptions, and retirement as one governed lifecycle with staged change and rollback.

Place NMC3 devices on a dedicated infrastructure management segment with explicit routes from approved administration, monitoring, logging, and PowerChute systems. Deny direct user, guest, wireless, and Internet access. Use source restrictions, firewall logging, and an administrative jump path appropriate to the organization, do not depend on obscurity or a nonstandard port. Replace initial credentials immediately, create named administrator and read-only roles for accountable use, remove or disable stale users, restrict powerful device actions, and keep a tested break-glass account whose secret is vaulted, monitored, and rotated after use. The current NMC3 security handbook should decide which authentication features and cryptographic options the installed firmware supports. Prefer HTTPS with an organization-trusted certificate, SSH for command access, and SNMPv3 with unique authentication and privacy settings. Disable HTTP, Telnet, FTP, SNMPv1/v2c, unused discovery, unused industrial protocols, and other unneeded services after dependencies are migrated. If a legacy monitoring platform temporarily requires an older protocol, document exact source, read-only scope where possible, compensating network restriction, owner, expiry, and replacement project. Do not export configuration files casually, they can reveal network and integration state even when passwords are obscured. Establish certificate governance. Use a hostname that matches the certificate, protect the private key, record issuing authority and expiry, renew before the operational freeze window, and test every browser, API, PCNS, monitoring, and automation client that validates the endpoint. Self-signed certificates may encrypt traffic but do not establish centrally trusted identity. Configure authoritative time and verify timezone so event chronology can be reconciled across UPS, NMC, PCNS, hypervisor, operating system, firewall, and ticketing systems. Send security and power events to resilient central logging and alert on authentication failure, account change, configuration change, protocol enablement, certificate problem, firmware action, communication loss, on-battery, low runtime, bypass, overload, battery fault, and control operations. Review event destinations after personnel, mail, logging, or monitoring changes, an alert configured to a retired system is no alert. Finally, back up a sanitized, access-controlled configuration and prove local console or recovery access before disabling the last known management path.

• Isolate NMC3 devices on a restricted management plane with explicit administration, monitoring, logging, and PowerChute flows.
• Use unique named roles, vaulted break glass, trusted HTTPS certificates, SSH, SNMPv3, source restrictions, authoritative time, and centralized events.
• Disable unused HTTP, Telnet, FTP, SNMPv1/v2c, discovery, and industrial protocols only after every dependency has migrated and been tested.
• Track legacy exceptions by source, privilege, compensating control, owner, expiry, and replacement plan.
• Protect configuration exports and certificate keys, verify recovery access, and alert on identity, configuration, protocol, firmware, communication, UPS, battery, load, and control events.

Select the PCNS edition and installation path from Schneider Electric’s compatibility and installation guidance for the exact platform. Record operating system or appliance build, PCNS 5.2 release, license, NMC support, firewall requirements, certificate behavior, virtualization manager, service account, storage and cluster prerequisites, and upgrade path before installation. Register only the NMC addresses and UPS topology that physically protect the host or cluster: single UPS, redundant UPS, parallel system, advanced configuration, or outlet group. Use a unique protected authentication phrase and ensure the NMC and PCNS values agree without exposing it in tickets or scripts. Separate NMC administrative credentials from application authentication and give virtualization or operating-system service accounts the minimum permissions documented for the selected actions. Translate business priorities into event configuration. Define which on-battery, low-runtime, communication-loss, UPS-off, bypass, battery, overload, or environmental events start notifications, commands, migration, workload shutdown, host shutdown, or UPS turnoff. Time the sequence backward from usable battery reserve. Allow for event confirmation, scripts, application drain, database checkpoints, virtual-machine prioritization, storage stop, host shutdown, command timeout, communication variance, and battery aging. A long delay that consumes all reserve is not resilience, an aggressive delay that stops production during a brief transfer may also be wrong. Validate with a tabletop review first, then a controlled functional test. Confirm NMC-to-PCNS authentication, certificate trust, event receipt, log timestamps, firewall behavior, command permissions, application and VM priority, outlet-group registration, and notification paths. Inject only approved test conditions or use vendor-supported test mechanisms, do not create an uncontrolled outage to prove software. During a planned failover exercise, observe the full chain from UPS event through PCNS action, workload stop, host power state, remaining runtime, UPS behavior, utility return, and startup ownership. Test failure cases too: one NMC unreachable in a redundant topology, DNS unavailable, logging offline, expired certificate in a lab, a shutdown command that returns nonzero, a host already down, and an operator cancel or stop condition. Preserve logs and timings without exposing infrastructure secrets. A passing test documents expected event, actual timestamps, variance, reserve, exceptions, corrective owner, and next rehearsal.

• Match PCNS edition, release, platform, license, firewall, NMC compatibility, certificates, service accounts, virtualization, storage, and cluster prerequisites.
• Register the physical UPS and outlet topology that actually protects each host, do not copy another site’s NMC list.
• Build event and shutdown timing backward from reserve, including confirmation, scripts, application drain, VM priority, storage, host stop, communication, and aging.
• Test authentication, trust, logging, permissions, event actions, failure cases, stop authority, reserve, utility return, and startup ownership through approved methods.
• Keep authentication phrases, service credentials, host lists, scripts, and live logs out of public records.

It can disclose power and environmental state, change configuration, control outlet groups, send commands, and participate in shutdown. Protect it like other infrastructure control planes, not like a passive web sensor.

Generally no. Place them on a restricted management segment and allow only approved administration, monitoring, logging, and PowerChute paths with source controls and resilient recovery access.

Prefer the secure services supported by the installed firmware and dependencies, typically HTTPS, SSH, and SNMPv3. Disable HTTP, Telnet, FTP, SNMPv1/v2c, and other unused services after migration and testing.

It can encrypt traffic but does not provide centrally trusted device identity. Use a certificate and hostname lifecycle that approved browsers, APIs, monitoring, automation, and PowerChute clients can validate.

Schneider Electric directs NMC3 version 3-and-later firmware through the Secure NMC System tool and applicable subscription. Confirm the exact hardware and application package, older update methods are not a universal substitute.

Include exact model, console or address recovery, trusted firmware source, current protected configuration, certificate and key custody, account recovery, PCNS reinstall and license records, topology, shutdown settings, and contacts.

ALLMSP can inventory dependencies, segment management access, govern certificates and roles, reduce protocols, centralize events, model PCNS sequencing, stage firmware, test failover, and close retirement objects.