BMS and OT cybersecurity: protecting the control system of your building or plant
BMS cybersecurity means protecting the controllers, supervisory system and communications that run the HVAC, energy and other building services of a building or plant. At ACIPro we segment the control network, set up secure remote access, harden Niagara and the controllers, and review existing systems, delivering a vulnerability report and an improvement plan.
Reply within 24 working hours · Across Extremadura and neighbouring provinces in Spain
Why a BMS is a target
For years, a BMS was designed with only one aim: to make it work. Controllers in the panel, a supervisory workstation in the maintenance room and, at most, a modem for dialling in from outside. Today that same equipment is connected to the building network and, very often, to the internet. OT cybersecurity (security for operational technology, as opposed to office IT) has reached many installations late, and the same failings keep cropping up:
- Equipment exposed to the internet. Supervisory systems and controllers published through an open port on the router so that someone can log in from home. They are easy to find with specialised search engines.
- Default passwords. The factory username and password are still active years after commissioning, or there is a single account shared by everyone.
- Flat networks. Controllers, cameras, office computers and guest WiFi all sit on the same network. Whoever gets in at one point can reach everything.
- Outdated software. Supervisory software and firmware versions that nobody has touched since handover.
- Protocols without authentication. In their classic form, BACnet and Modbus do not check who is sending a command.
The consequences are far from theoretical: an attacker could shut down the HVAC in an operating theatre, disable alarms, change setpoints or use the BMS as a gateway into the corporate network.
ISA/IEC 62443: the reference framework for industrial cybersecurity
The ISA/IEC 62443 series is the benchmark set of international standards for the security of industrial automation and control systems, and its principles apply just as well to a BMS. It is not a single document: it has parts for the asset owner, for the integrator who designs the system and for the equipment manufacturer. Its core ideas are simple:
- Zones and conduits. The installation is divided into zones that group together equipment with similar security needs (for example, HVAC controllers, the supervisory system, the corporate network). Communications between zones pass only through defined, controlled conduits.
- Security levels. Each zone is assigned a target security level according to what it needs protecting from, ranging from accidental error to a well-resourced attacker. That level determines which technical measures are required.
- Defence in depth. No single measure is enough on its own; segmentation, access control, hardening, event logging and procedures are combined.
- Shared responsibilities. Security depends on the product, on how it is integrated and on how it is operated and maintained.
We apply these principles to the design and remote monitoring of every installation. You do not need to certify anything to get started: good zone separation and properly designed access remove most of the real-world risk.
We will reply within 24 working hours with an initial assessment.
NIS2 and the Cyber Resilience Act: what changes
The NIS2 Directive (Directive (EU) 2022/2555) extends cybersecurity obligations to many more sectors than the previous legislation: energy, transport, healthcare, water, public administration, the manufacture of certain products and others. It requires organisations to manage risks, report incidents and monitor their supply chain, which includes the suppliers who maintain control systems.
The transposition deadline expired on 17 October 2024. At the time this page was published, Spain had not yet passed its transposing law: in January 2025 the Government approved the draft Ley de Coordinación y Gobernanza de la Ciberseguridad (Cybersecurity Coordination and Governance Bill), and in July 2026 the European Commission decided to refer Spain to the Court of Justice of the EU for failing to notify transposition. In the meantime, Real Decreto-ley 12/2018 (Royal Decree-Law 12/2018 on the security of networks and information systems) remains in force. It makes sense to prepare now: the technical measures the law will require are the same ones that make sense today.
The Cyber Resilience Act (Regulation (EU) 2024/2847) applies to manufacturers of products with digital elements, including controllers and supervisory software. From 11 September 2026 they must report actively exploited vulnerabilities and severe incidents, and the remaining obligations apply from 11 December 2027. For you as an owner, this means it is worth choosing equipment that comes with support and security updates, and having someone to apply them.
ACIPro is not a compliance consultancy and does not issue certifications. If your organisation works with a NIS2, ISO 27001 or ENS (Spain's National Security Framework) consultant, we provide the technical support on the OT and controls side: inventory, network architecture, access and evidence.
What we do: four specific services
- Control network segmentation. We separate the OT network from the IT network using VLANs and firewalls, define which zones exist and what traffic may pass between them, and keep guest WiFi, cameras and office equipment off the controller network. Our team is Cisco CCNA-trained, so we design and configure the network side ourselves.
- Secure remote access. Encrypted connections, individual users with their own passwords and no ports open to the internet. Every access is identified and can be revoked when a technician or company stops working on the installation. It is the same approach we use for our remote monitoring of installations.
- Hardening of Niagara and controllers. We remove default passwords, create named accounts with roles (view, operate, administer), install certificates for encrypted communications, disable unused services and leave an update plan in place. We are an official Honeywell partner and work with Niagara 4 every day.
- Security review of an existing BMS. We analyse your current system, whatever the brand, and provide you with a vulnerability report with prioritised recommendations.
Tell us about your building and what concerns you. We'll tell you where to start.
What a BMS security review involves
The review is designed so as not to put a live installation at risk. We always follow these steps:
- Inventory. Supervisory systems, controllers, gateways, software and firmware versions, protocols and existing remote access. Often it is the first time the owner has had this complete list.
- Architecture review. How the control network is connected, which other networks it shares infrastructure with and where it can be accessed from outside.
- Passive, non-intrusive scanning. We observe traffic and review configurations without launching aggressive tests against live controllers, which can lock up when faced with a badly executed scan.
- Prioritised report. Each finding with its risk, its cause and the recommended measure, ranked by urgency and cost. First come the things that can be fixed in a morning, such as default accounts or open ports.
- Improvement plan. A phased proposal for segmentation, access and updates, which can be carried out with us or with your maintenance contractor.
If the review uncovers a system with no support and no possible updates, we explain the options, including a migration to Niagara that reuses the existing wiring and field devices.
Sectors where control security is critical
- Hospitals and healthcare centres. Operating theatre HVAC, room pressures, medical gases and heating and cooling plant. A shutdown has clinical consequences. More in BMS for hospitals.
- Industry. Auxiliary plant, cleanrooms, industrial refrigeration and energy, where the BMS coexists with process automation.
- Public administrations. Dispersed buildings remotely monitored from a single workstation, often with legacy access left behind by several maintenance contractors. We cover this in services for public administrations.
- Infrastructure. Pumping stations, wastewater treatment plants and remote installations communicating over mobile or radio links, often unmanned.
If your installation also needs new networking, cabling or WiFi, we handle it within the same project through our networks, WiFi, CCTV and fibre optics service.
Call us or message us on WhatsApp on +34 634 456 471 and we'll go through it with you.
Security that does not get in the way of maintenance
A security measure that stops people working ends up being switched off. That is why we design every change with the maintenance team involved: access that works from a mobile phone, roles that let everyone do their job, backups of the programming and a clear procedure for granting and revoking permissions. We document everything and, if needed, train maintenance staff and users.
We work in Cáceres, across Extremadura and neighbouring provinces, and once set up, much of the review and subsequent follow-up can be done remotely over a secure channel.
Frequently asked questions
What is BMS cybersecurity?
It is the set of measures that protect a building management system against unauthorised access and tampering: separation of the control network, encrypted remote access with individual users, removal of default passwords, updates and logging of who does what. Its aim is to keep the installation running and stop outsiders from changing it.
What is the difference between OT and IT cybersecurity?
IT security mainly protects office information. OT cybersecurity protects equipment that acts on the physical world, such as air handling units, pumps or boilers, where the top priority is that they keep running. That is why OT systems are not scanned aggressively, updates are carefully planned and availability carries as much weight as confidentiality.
Does NIS2 apply to my company?
It depends on your organisation's sector and size. As of today, Spain has not passed its transposing law and Real Decreto-ley 12/2018 remains in force, so it is best to check with your legal adviser or consultant. What we can say for certain is that technical measures on the control system will be needed in any case.
Do you provide ISO 27001, ENS or NIS2 consultancy?
No. ACIPro is not a compliance consultancy and does not certify management systems. What we do is provide technical support to your organisation's consultant on the OT and controls side: equipment inventory, network architecture, remote access, hardening and evidence of the measures applied.
Could a security review shut down my installation?
It should not. We work with an inventory, configuration reviews and passive, non-intrusive scanning, with no aggressive tests against live controllers. Any later change, such as modifying the network or updating firmware, is planned with you and carried out in an agreed window, with a backup taken beforehand.
Is it safe to access the installation from a mobile phone?
Yes, if it is done properly: an encrypted connection, a separate user account for each person, no open ports on the router and permissions matched to what each person needs. What is insecure is the usual setup in older installations: a port published on the internet and a single shared password.
Do you review systems from other brands?
Yes. Security reviews and network segmentation can be carried out on any BMS. We work with Niagara 4 and Honeywell equipment every day, have technicians certified in Schneider Electric's EcoStruxure Building Operation and integrate Siemens Desigo, as well as other manufacturers.
Call us or message us on WhatsApp on +34 634 456 471 and we'll go through it with you.
You may also be interested in
- Networks, Wi-Fi, CCTV and fibre optics for buildings and industry
- Remote monitoring and management of installations in Cáceres, Badajoz and across Extremadura
- BMS for hospitals: controlled, documented HVAC
- Migrating Honeywell CARE, Eagle and Excel 5000 to Niagara 4
References and manufacturers
Do you have a control system that nobody knows how to maintain?
We review your installation and tell you what can be reused, what should be replaced and how much you could save.