Your HVAC controller just became a network entry point. Your access control system shares infrastructure with payroll. Your lighting management platform connects to the same backbone that routes financial transactions. Building Automation & Control Systems (BACS) no longer exist in isolation, and that convergence creates attack vectors your IT security team wasn't designed to address.
Recent infrastructure incidents have made one thing clear: operational technology (OT) demands its own security discipline. You can't secure a manufacturing line the same way you secure a file server. The stakes are different, the constraints are tighter, and the expertise required sits at the intersection of engineering and cybersecurity.
This guide walks you through securing BACS environments using the NIST Cybersecurity Framework, tailored for resource-constrained teams managing critical infrastructure. You'll implement controls that protect operations without triggering downtime or interfering with safety systems.
Preparing for Implementation
Inventory Your OT Assets
Document every BACS component: controllers, sensors, actuators, human-machine interfaces, and gateways. Note firmware versions, network segments, and external connections. You can't secure what you haven't cataloged.
Identify Network Boundaries
Map where BACS networks connect to corporate IT, cloud services, and external vendors. These integration points are your highest-risk zones. If you're running HVAC controls on the same VLAN as email servers, that's your first problem to solve.
Assign Ownership
Designate who owns BACS security. In most organizations, facilities teams manage the systems but lack cybersecurity expertise, while IT security teams understand threats but don't control OT environments. Resolve this gap now. Appoint a single accountable party, typically someone who reports to both facilities and IT leadership.
Establish a Maintenance Window Policy
Unlike IT systems, you can't patch a chiller controller during business hours without impacting building operations. Define acceptable downtime windows for updates, testing, and configuration changes. Coordinate with facility managers to understand operational constraints.
Baseline Your Current State
Use the NIST Cybersecurity Framework to assess where you stand. Focus on the five core functions: Identify, Protect, Detect, Respond, Recover. Rate your maturity in each area. This baseline determines your starting point and helps you prioritize investments.
Step-by-Step Implementation
Step 1: Segment BACS Networks
Isolate building automation systems from corporate networks using VLANs or physical separation. Configure firewalls to permit only necessary traffic between zones. For example, if your energy management system needs to send data to corporate analytics platforms, create a unidirectional data flow through a demilitarized zone (DMZ). Block all inbound traffic from corporate networks to BACS controllers.
Implementation: Deploy industrial firewalls that support deep packet inspection for OT protocols like BACnet, Modbus, and LonWorks. Standard enterprise firewalls don't recognize these protocols and can't enforce granular policies.
Step 2: Disable Unnecessary Services and Ports
BACS controllers often ship with default configurations that enable remote access protocols, web servers, and diagnostic interfaces you don't need. Audit each device and disable unused services. Change all default credentials immediately.
For each controller, document:
- Required communication protocols
- Authorized IP addresses for management access
- Necessary ports for operation
Close everything else. If a lighting controller doesn't need SSH access, disable it.
Step 3: Implement Access Controls
Require multi-factor authentication for all administrative access to BACS systems. Create role-based access policies that limit privileges to specific functions. A technician adjusting temperature setpoints shouldn't have credentials that allow firmware updates.
Deploy privileged access management for vendor and contractor accounts. Vendors who maintain your systems need temporary, auditable access, not permanent backdoors. Implement session recording for all remote vendor connections.
Step 4: Establish Monitoring and Detection
Deploy network monitoring tools that understand OT protocols. Configure alerts for anomalous behavior: unexpected configuration changes, unusual traffic patterns, failed authentication attempts, or communication with unauthorized IP addresses.
For BACS specifically, monitor:
- Setpoint changes outside normal parameters
- Controller reboots or firmware modifications
- New devices appearing on the network
- Traffic to external IP addresses
Integrate OT security alerts into your Security Operations Center. Your SOC analysts need visibility into building systems, not just corporate networks.
Step 5: Create an Incident Response Plan for OT
Your standard incident response playbook assumes you can isolate compromised systems immediately. That approach fails in OT environments where isolation might shut down critical building functions. Develop OT-specific response procedures that balance security containment with operational continuity.
Define decision trees: If you detect malware on an HVAC controller, do you isolate it immediately or maintain operation while containing the threat through network controls? Document who makes that call and under what criteria.
Step 6: Implement Patch Management for OT
Test every firmware update in a lab environment before deploying to production. Unlike IT patches, OT updates can introduce incompatibilities that disable equipment or create safety hazards.
Create a tiered patching schedule:
- Critical security vulnerabilities: patch within 30 days after testing
- High-priority updates: quarterly maintenance windows
- Low-priority updates: annual system upgrades
Maintain vendor support agreements that guarantee access to security patches. Some BACS manufacturers discontinue support for older equipment, leaving you with unpatchable vulnerabilities.
Validation: How to Verify It Works
Network Segmentation Test
Attempt to connect from a corporate workstation to a BACS controller. The connection should fail. Verify that authorized connections through approved gateways succeed while unauthorized paths remain blocked.
Access Control Audit
Review access logs monthly. Confirm that all administrative sessions used multi-factor authentication. Verify that no default credentials remain active. Attempt login with known default passwords; all attempts should fail.
Detection Capability Test
Conduct tabletop exercises simulating OT security incidents. Verify that your monitoring tools detect unauthorized access attempts, configuration changes, and anomalous network traffic. Measure time from detection to alert.
Patch Verification
Maintain a spreadsheet tracking firmware versions for all BACS components. Compare current versions against vendor security bulletins. You should have documented justifications for any unpatched vulnerabilities.
Maintenance and Ongoing Tasks
Monthly
- Review access logs for BACS systems
- Verify backup integrity for controller configurations
- Update network asset inventory with any new devices
Quarterly
- Assess new vulnerabilities affecting your BACS platforms
- Test incident response procedures with facilities team
- Review vendor access logs and revoke unused accounts
Annually
- Conduct penetration testing focused on OT networks
- Reassess NIST Cybersecurity Framework maturity
- Update network diagrams and security architecture documentation
- Review and update OT security policies
Continuous
Monitor NIST's ongoing revision of SP 800-82 Guide to Operational Technology Security. When the updated guidance becomes available for public comment, participate in the review process. The revised framework will reflect current risk management approaches for OT environments.
Integrate BACS security metrics into your board reporting. Track key indicators: percentage of controllers with current firmware, mean time to detect OT security incidents, percentage of network segments properly isolated. Your board needs visibility into OT risk, not just IT risk.
Building automation systems keep your facilities running, but their convergence with corporate networks creates exposure that traditional IT security doesn't address. This guide gives you a structured approach to securing OT environments without sacrificing operational reliability. Start with network segmentation, build monitoring capabilities, and establish governance that bridges facilities and cybersecurity teams. The infrastructure attacks we've seen recently won't be the last, and your BACS environment is only as secure as the controls you implement today.
