Cybersecurity for Wineries, Tasting Rooms and Ag Businesses

Why wine and ag businesses are their own security problem

The Census Bureau's County Business Patterns for 2023 counted about 115 winery establishments in Santa Barbara County and about 166 in San Luis Obispo County, plus 56 agricultural support businesses in Santa Barbara County. The Santa Barbara County Vintners put the countywide count of wineries and tasting rooms closer to 325 (a 2024 marketing figure that counts locations differently).

Whatever the count, the pattern is familiar. A small office handles payroll, compliance paperwork and distributor invoices. A tasting room takes cards all weekend. A website sells wine club memberships. Seasonal crews come and go. Somewhere out in the field, a sensor or controller reports back over the internet. All of it usually shares one network and a handful of shared passwords.

Keith Systems works on the network side of that picture: your own router and firewall, your Wi-Fi, your accounts and your written policies. Jacob Keith holds the CISSP, CompTIA CySA+ and CompTIA SecurityX, and brings about six years of security compliance work on government systems.

PCI DSS 4.0.1: wine club checkout and tasting-room payments

Since March 31, 2025, every future-dated requirement in PCI DSS 4.0.1 is mandatory. For a winery selling online, the change that matters most is the payment page. Requirements 6.4.3 and 11.6.1 expect e-commerce merchants to control the scripts that run on the page where card data is entered, and to detect unauthorized changes to that page.

Many wine club sites run on a commerce platform with a payment company's hosted checkout. That helps, but it does not remove your responsibility for what loads on your own pages or for the questionnaire your processor asks you to complete.

Keith Systems can help you:

• Map where card data actually flows: website, wine club billing, tasting-room terminals, phone orders
• Review which scripts load on checkout and membership pages, and who can change them
• Prepare answers and evidence for your self-assessment questionnaire
• Keep tasting-room point-of-sale on its own network segment, apart from guest and office traffic

Keith Systems is not a Qualified Security Assessor (QSA) and does not sign PCI attestations. The work is preparation. More detail is in the PCI DSS guide for winery websites and tasting rooms.

Guest Wi-Fi and the tasting-room network

Guests expect Wi-Fi. They should never share a network with your card terminals, your office computers or the cameras, door controllers, printers, thermostats and other connected devices that tend to pile up behind the bar and in the back office.

Network segmentation fixes this on gear you already own: a guest network that reaches only the internet, a payments segment, an office segment and a separate segment for connected devices, with firewall rules between them. Keith Systems reviews your current layout, writes down what should talk to what, and checks the firewall rules against that plan. Keith Systems does not log into, configure or manage the devices themselves. See small business network segmentation and connected device network security.

Seasonal staff accounts and harvest-time email fraud

Harvest and crush bring temporary staff, and temporary staff bring accounts that outlive the season. A short written process helps: named accounts instead of shared logins, multi-factor authentication on email and point-of-sale admin access, and a checklist to remove access when the season ends.

The same months bring a flood of invoices: barrels, glass, labels, trucking, custom crush, labor contractors. That makes fall a good time for business email compromise, where a fake or hijacked vendor email asks you to "update" bank details. Practical defenses include a phone call to a known number before any payment change, two-person approval for new payees, and mail settings that flag outside senders. The business email compromise guide walks through it.

Remote access to field sensors and irrigation controllers

Soil moisture sensors, weather stations, irrigation controllers and cold-room alarms often report to an app over the internet. The risk is usually not the device itself but how it is reached: a port left open on the office router, an old remote-access tool, or a vendor account nobody remembers.

Keith Systems looks at this from the network side only:

• Which inbound connections your firewall allows, and to where
• Whether field devices sit on their own segment, away from office computers
• Who holds remote access accounts, and whether they use multi-factor authentication
• An external exposure review, with written authorization from the owner, to see what the internet can see

Keith Systems does not configure, patch or recommend those devices or their vendors. You get written findings you can hand to whoever supports the equipment.

Ransomware readiness before the busy season

Losing your systems in October, when compliance reports, shipping and club releases all land at once, hurts far more than losing them in February. Readiness work is plain: test that backups can actually be restored, keep one copy offline or immutable, write a short incident response plan with phone numbers on paper, and run a tabletop exercise with the people who would really be on the call.

If customer data is involved, California's breach law now sets a 30-calendar-day notice clock, covered in the California breach notification guide. Cyber insurers often ask about the same controls; see the insurance questionnaire guide and incident response readiness.

To talk through your setup, book a free security consult or call (805) 800-8163. Local pages: Lompoc, Solvang, Buellton, Santa Maria.