How to Build a BMS Cybersecurity Checklist: Network Segmentation Priorities

If you're responsible for building management systems, there's a critical vulnerability in your network right now that's giving attackers a straight path to your most sensitive data. The 2013 Target breach started exactly this way, and most facilities still haven't closed the gap.

Key Takeaways

• A significant proportion of organisations carry exploitable vulnerabilities in their operational technology (OT) environments - and Building Management Systems are among the least protected.
• Flat network architecture is the single biggest structural risk: a BMS connected to your corporate IT network gives attackers a clear path to sensitive data and systems.
• Network segmentation - creating a dedicated OT network with a DMZ firewall - is the highest-priority control a facilities manager can implement today.
• A practical BMS cybersecurity checklist covers credential management, secure remote access with MFA, and regular software patching alongside segmentation.
• Standards like IEC 62443 and BACnet/SC set a measurable bar - knowing whether your installation meets them is a good starting point for any security review.

Building Management Systems were built to keep buildings running smoothly - not to withstand a cyberattack. That gap between operational design and security reality is exactly what attackers are now exploiting. This guide breaks down the specific vulnerabilities that make BMS networks soft targets, explains why network segmentation should top any cybersecurity checklist, and provides a practical, prioritised set of controls any facilities manager can act on.

OT Environments Are Under Attack - Your BMS Is Likely a Target

Research consistently shows that a large proportion of organisations carry exploitable vulnerabilities in their operational technology environments. Building management systems rank among the least protected OT assets - not because they are overlooked intentionally, but because they were never designed with cybersecurity in mind.

The 2013 Target data breach illustrates the risk clearly. Attackers gained access to 40 million credit card numbers - not by breaking through Target's firewalls, but by compromising the credentials of an HVAC contractor with remote access to building systems. The building controls were the unlocked side door into the corporate network. In 2021, a water treatment facility in Oldsmar, Florida was accessed remotely through building operations software, with an attacker attempting to alter chemical dosing levels. These are not edge cases. They reflect how BMS are being exploited today.

For facilities managers responsible for the safe and efficient operation of buildings, the cybersecurity posture of the BMS is no longer someone else's problem. Resources and practical guidance on managing this risk - including how network segmentation fits into a broader security strategy - are available at successclick.ai.

Why BMS Networks Are Soft Targets

Unencrypted Protocols by Design

BACnet is the dominant communication protocol in commercial BMS installations. It was designed in an era when building controls networks were physically isolated - air-gapped from both the internet and corporate IT infrastructure. Security was not part of the specification because physical access was assumed to equal authorisation.

The result: standard BACnet/IP has no native encryption, no authentication, and no access control. It broadcasts device information on UDP port 47808 to anything on the network willing to listen. Using a free BACnet discovery tool, anyone on the same network can see every controller, every setpoint, and every schedule in the building - without logging in at all. Modbus, another widely used protocol, shares the same fundamental design limitations.

The Flat Network Problem

In many buildings, BMS controllers sit on the same VLAN as office PCs, printers, and guest Wi-Fi. There is no network segmentation, no firewall between OT and IT, and no traffic monitoring between them. This flat network architecture means a compromised laptop on the guest Wi-Fi could potentially reach every controller in the building - and from there, every connected corporate system. It is the single biggest structural vulnerability in most BMS installations, and it requires no sophisticated hacking to exploit.

The Real Risks of a Compromised BMS

Ransomware and Operational Shutdown

Ransomware groups have identified building systems as high-pressure targets. Facilities managers responsible for hospitals, schools, or critical infrastructure will act quickly when heating, cooling, or access control goes offline. Attackers understand this dynamic and are increasingly deploying ransomware specifically designed to target OT environments - locking out the operational team and demanding payment to restore control. The National Cyber Security Centre (NCSC) has published guidance on ransomware threats to operational technology environments, and building management systems fall within that scope.

Lateral Movement into Corporate IT

A compromised BMS is rarely the end goal - it is the entry point. When BMS networks are not segmented from IT infrastructure, attackers use building controllers as a foothold to move toward higher-value targets: financial systems, confidential databases, and tenant data. Many modern BMS platforms run on Windows-based servers and connect to cloud dashboards, meaning a compromise can also trigger a data breach notification obligation under UK GDPR. The operational disruption, regulatory fines, and reputational damage that follow a cyber incident in a building environment consistently far exceed the cost of preventive measures.

Network Segmentation: Your Highest-Priority Control

OT vs IT: Why Separation Matters

The core principle is isolation. OT systems - controllers, field devices, BMS servers - and IT systems - office PCs, email servers, corporate databases - have fundamentally different security profiles and risk tolerances. OT systems prioritise availability and uptime; IT systems are typically better resourced for security patching and monitoring. Connecting them without controls imports IT-side risks into an OT environment that is far less equipped to handle them.

Placing BMS assets on a dedicated VLAN, separate from the corporate network, limits the blast radius of any breach on either side. A compromise in the IT network does not automatically mean disruption to critical building functions. A compromised building controller does not automatically become a pathway to financial data.

Building the DMZ Between Networks

Effective segmentation goes beyond putting devices on different VLANs. Best practice involves creating a demilitarised zone (DMZ) between the OT and IT networks - a controlled buffer enforced by a firewall with explicit, minimal permit rules.

In practice, this means:

• Only the specific ports and protocols required for BMS operation are permitted through the firewall.
• All other traffic between IT and OT is blocked by default.
• Traffic within the DMZ is logged and monitored for anomalies.
• No direct access from a less-secure IT device to a BMS controller is permitted without passing through the firewall.

Security practitioners consistently point to robust network segmentation as the control that can prevent a cyberattack from moving beyond the IT network into OT systems - containing the incident before it reaches critical building infrastructure.

The BMS Cybersecurity Checklist

Network segmentation is the priority - but it does not stand alone. A complete BMS cybersecurity checklist addresses the full attack surface.

Credential and Access Controls

Default credentials are among the most common and most easily exploited vulnerabilities in BMS installations. Many platforms - including older versions of Trend controllers, Siemens Desigo CC, Schneider EcoStruxure, and Honeywell Niagara - have shipped with published default usernames and passwords. If those credentials were not changed during commissioning, which is depressingly common, anyone who can reach the device on the network may be able to log in with full administrative access.

• Change all default credentials on every controller and supervisory platform during commissioning.
• Assign individual user accounts rather than shared logins, enabling access to be audited and revoked when staff leave.
• Document credentials securely in a password manager or encrypted store - not in a spreadsheet on the facilities drive.
• Implement a password rotation policy with defined review intervals.

Secure Remote Access with MFA

Remote access to building systems expanded rapidly during and after the COVID-19 period, often as a temporary measure that became permanent. Port-forwarded RDP connections and cloud platforms configured without proper controls are now a significant and widespread vulnerability. Implementing multi-factor authentication (MFA) for all remote access to BMS significantly reduces the risk of unauthorised entry through compromised credentials - even if a password is stolen, the second factor blocks the attacker.

• Replace port-forwarded RDP or exposed web interfaces with a properly configured VPN.
• Enforce MFA on all remote access sessions.
• Log all remote sessions and set automatic timeouts for inactivity.

Patch and Software Maintenance

BMS head-end software running on Windows servers often goes years without security updates because facilities teams fear that patching will break the BMS application. The result is servers running outdated operating systems - Windows Server 2012 R2 is still found in operational buildings - with known, exploitable vulnerabilities and no endpoint protection. A structured patching programme, coordinated between the facilities team and the BMS vendor, removes a large portion of the known attack surface.

• Audit the operating system version on every BMS server and confirm it is still receiving security updates.
• Apply outstanding security patches on a scheduled cycle.
• Include BMS servers in the organisation's wider vulnerability management programme.

Standards That Set the Bar: IEC 62443 and BACnet/SC

IEC 62443 is the primary international standard for industrial automation and control systems cybersecurity, and it applies directly to BMS. It defines security levels from SL1 (protection against casual or coincidental violation) to SL4 (protection against state-sponsored attack). Most commercial BMS installations should be targeting SL2 as a minimum - protection against intentional violation using simple means - but very few have even been formally assessed against it.

BACnet/SC (Secure Connect), defined in Addendum bj to ASHRAE 135-2016, addresses the core security limitations of standard BACnet/IP by introducing TLS 1.3 encryption and X.509 certificate-based authentication. It is the right specification for new installations where controller hardware supports it. For existing installations running standard BACnet/IP, network-level controls - segmentation, firewalls, and monitoring - compensate for what the protocol itself cannot provide. The NIST Cybersecurity Framework offers further structured guidance applicable to building automation environments, particularly for organisations managing critical infrastructure.

If You Cannot Answer These Questions, Act Now

A BMS cybersecurity assessment does not need to begin with a full penetration test. It begins with a structured review of the basics. If the following questions cannot be answered confidently, the risk is real and remediation should begin:

• Have default credentials been changed on every BMS controller and supervisory platform?
• Is the BMS network segmented from corporate IT, with a firewall enforcing traffic rules?
• Does all remote access to the BMS require MFA and pass through an encrypted VPN?
• Is the BMS supervisory server running a supported operating system with current security patches?
• Does the cyber insurance policy ask about operational technology - and can those questions be answered?

The cost of a BMS cybersecurity review is typically a fraction of the cost of a single cyber incident. Operational disruption, data breach notification, regulatory fines, and insurance excess from a building system compromise can run into hundreds of thousands of pounds - a business case that is not difficult to make to any senior leadership team.

Network segmentation, credential management, secure remote access, and regular patching will address the majority of the risk without requiring a full BMS replacement. The vulnerabilities are already present. The fixes are well understood. The starting point is knowing where the gaps are.

For facilities managers looking to take the next step, Success Click Ltd provides expert guidance on building management system security strategy and operational technology risk.