Building systems
HVAC, lighting, meters, lifts, alarms, access and other controlled equipment.
Smart Building Cybersecurity: A Practical Baseline
A connected building is not just an IT network with unusual devices. It is an operating environment where a digital action can change access, comfort, safety, energy use, and continuity.
Start with the boundary.
List the systems that can affect the building, every path into them, the people who can change them, and the minimum safe operating state. Controls come after the map—not before it.
Control in view
Security has to reach the equipment.
Segmentation, accountable maintenance, and recoverable operations are visible controls—not policy language alone.
01
02
03Published 8 September 2026 · reviewed 9 September 2026. Editorial illustrations generated for Hamed Helped; they do not depict a named site, vendor, or client.
System boundary
Four layers, one operating consequence.
Networks
Controllers, gateways, protocols, management servers, cloud links and integrations.
Remote access
Facilities teams, integrators, maintainers, manufacturers and support accounts.
Operations
Comfort, access, life-safety interfaces, uptime, evidence, and recovery.
Risk register
Five gaps worth finding before an incident finds them.
Unknown inventory
You cannot make a lifecycle, vulnerability, or recovery decision for devices and software the asset team cannot name.
Permanent vendor paths
A support route with no named owner, approval window, or review record becomes an unmanaged operating dependency.
Unexamined connections
Every integration between building, corporate, cloud, and third-party environments changes the path a failure can take.
No update decision
A patch policy that ignores uptime, vendor support, backups, and test conditions is not yet an operational plan.
The safe state is assumed
The team needs a shared answer for what the building should do when a controller, network, cloud service, credential path, or integration is unavailable.
Control baseline
Make the next control observable.
- Name the assets.
Record device, software, protocol, network location, support status, responsible owner, and operational consequence.
- Reduce standing access.
Identify remote paths and service accounts. Define who approves access, for how long, and what record remains.
- Draw the trust boundaries.
Show where building systems meet enterprise IT, cloud services, mobile credentials, and third parties.
- Plan change and recovery.
Pair updates with backups, rollback conditions, maintenance windows, and a documented minimum safe state.
- Review the evidence.
Ask for inventories, access logs, architecture records, support dates, recovery tests, and named exceptions—not a generic assurance.
Governance
Put each decision in a real role.
| Decision | Lead | Required input | Evidence retained |
|---|---|---|---|
| Operational priority | Property operations | Critical services and minimum safe state | Approved system criticality map |
| Network boundary | IT / OT security | Connections, protocols, data flows, and remote paths | Current architecture and exception register |
| Vendor access | System owner | Support need, identity, duration, and approval | Access record and periodic review |
| Recovery acceptance | Operations + safety stakeholders | Backup, rollback, manual mode, and test result | Recovery exercise record |
First 30 days
Move from assumption to owned evidence.
Set the room
Bring operations, IT, physical security, key vendors, and procurement into one boundary review.
Draft the map
Inventory critical systems, connections, remote paths, owners, and support status.
Close one path
Choose a high-consequence unmanaged access or network path and give it an owner and control.
Test recovery
Walk one realistic loss scenario through manual operation, rollback, communication, and evidence.
Next decision
Turn the baseline into a pilot gate.
Evidence trail
Sources behind this guide
- 01NISTGuide to Operational Technology (OT) Security — SP 800-82 Rev. 3 (external link)
Primary federal guidance covering OT environments, including building automation and physical access control examples.
- 02NISTTips & Tactics for Building Automation & Control System Cybersecurity (external link)
Current building-specific orientation published August 2026.
- 03Security Industry AssociationSecurity Convergence 2024 (external link)
Industry research on the organizational meeting point of physical and cybersecurity.