Building Management System Cyber Security UK Guide

Building management system cyber security UK property operators can rely on begins with controlled connectivity. Identify every connected controller, remove unnecessary internet exposure, separate building controls from office networks, restrict supplier access and maintain a tested manual route for essential operations.

The objective is to prevent remote convenience becoming uncontrolled authority over physical services.

What happened to US water-control systems

Coordinated incidents affected more than 30 Minnesota water systems on 26 and 27 July 2026. The FBI alert on the incidents says water and wastewater utilities in at least seven states reported incidents from 27 July, and some activity degraded operations.

The FBI said malicious actors were targeting internet-facing programmable logic controllers. Its recommended actions included removing affected devices from direct internet access, changing passwords, reviewing logs and contacting the manufacturer.

CISA issued its operational-technology alert on 30 July. A Guardian report published on 4 August described pressure disruption and manual operating responses at some affected facilities. No responsible actor had been formally identified at the time of that report.

These incidents concern US water infrastructure, not UK commercial buildings. The practical lesson is still relevant because building automation also connects software to physical equipment.

Why building management system cyber security UK matters

The UK National Protective Security Authority explains that building automation and control systems can manage heating, cooling, ventilation, lighting, energy, access and monitoring. Greater connectivity offers operational benefits but also creates more routes for hostile or unauthorised access.

Remote support can become permanent exposure

A maintenance supplier may need temporary access to diagnose a fault. If that connection remains open, uses a shared account or reaches several sites through one route, the access exceeds the original operational need.

Facilities teams may not own the full network picture

Controls can be installed by different contractors over many years. IT may manage the corporate network while facilities manages physical equipment and suppliers retain remote accounts. Nobody holds one current record of devices, connections and owners.

A single connection can cross operational boundaries

A poorly separated environment can allow access from an ordinary business network into building controls. One compromised credential or maintenance device can then reach functions unrelated to the original task.

The manual route may exist only on paper

Teams may assume a controller can be operated locally, but the current staff have not practiced the procedure, the override requires a specialist or essential instructions are unavailable during an outage.

Response authority is unclear

When unusual behavior appears, staff may hesitate to disconnect a supplier or isolate a controller because nobody has defined who can make the decision without additional approval.

A seven-control building management system cyber security UK plan

1. Build a definitive asset and connection register: Record each controller, gateway, management server, sensor group and remote-access route. Include its location, purpose, software or firmware, owner, support supplier, business consequence and connection to other networks. The UK NCSC’s secure-connectivity guidance says effective controls depend on an accurate understanding of the operational-technology environment and its connections.
2. Remove unnecessary direct exposure: Confirm why each device needs internet connectivity. Remove direct access where it is not required. Where remote support is necessary, place a controlled gateway between the external user and the building system. Do not assume a device is safe because its web address is difficult to find.
3. Separate operational and business networks: Create boundaries between building controls, corporate systems, guest networks and supplier connections. Permit only the communication required for a defined operational purpose. Separation should limit both incoming access and movement between control areas if one device is compromised.
4. Control supplier access by person and task: Replace shared supplier accounts with named identities. Use strong authentication where supported, limit permissions, approve the access window and remove access when the work ends or the person’s role changes. Record which supplier accessed which system, why and what changed.
5. Monitor operationally meaningful events: Review failed sign-ins, password changes, configuration changes, unusual operating commands and connections outside approved times. Send important alerts to people who understand both the technical event and its building consequence. An alert has little value if nobody knows whether it could affect access, temperature, ventilation or another service.
6. Design and test manual fallback: Identify which functions must continue if remote or automated control is unavailable. Document safe local procedures, required competence, equipment and escalation contacts. Test the route under realistic conditions. Confirm that staff can isolate the connection, operate the essential service and preserve evidence without creating a new safety risk.
7. Connect incident response to service continuity: Define who can isolate a device, notify occupants, call specialist support and decide when automation returns. Include contractor availability, spare equipment, access keys and customer communication.

Organizations reviewing connected property operations can use real estate technology solutions to map how physical services and digital workflows interact. An IT consulting review can define responsibilities and connection risks. Where an agreed design requires a controlled integration or monitoring layer, custom software development may be considered after safety and access requirements are clear.

An illustrative property-management example

Consider a property manager using one building-management supplier to monitor heating across six residential blocks. Engineers use a shared remote account because it is quicker during winter callouts.

A review finds that the account can reach every block at any time and that nobody in the property team receives a record of configuration changes. Local caretakers know how to reset individual boilers but have not tested operation when the remote gateway is unavailable.

The improved design gives each supplier engineer named, time-bound access to the affected site. Building controls are separated from office systems, significant changes create an alert and the local fallback process is tested before winter.

This is an illustrative scenario, not a Don-Clem Technology customer result. It shows how secure connectivity supports service delivery rather than blocking legitimate maintenance.

What technology should and should not do

Technology should enforce network boundaries, named access, limited permissions and useful logging. It should identify unexpected connections and help responsible people isolate a compromised route without losing the complete operational record.

Technology should not expose a controller directly for convenience, assume every supplier device is trusted, grant access to an entire portfolio for one repair or automate a shutdown without considering the physical consequence.

Cyber security does not replace engineering, safety or facilities judgement. The system must support qualified decisions about the building and the people using it.

Frequently asked questions

• Is a building management system operational technology?: Yes. It monitors or controls physical building functions and therefore needs security that considers safety, reliability and continued operation.
• Should all remote access be removed?: Not necessarily. Keep access that has a defined business need, but route it through controlled connections with named users, limited permissions and monitoring.
• Who should own BMS cyber security?: Facilities, IT, security and specialist suppliers all contribute. One accountable leader should own the complete operating risk and ensure responsibilities join together.
• What should be tested manually?: Test the safe local operation of essential services, isolation of remote connections, escalation, supplier response and communication with affected occupants.
• How often should the asset register be updated?: Update it whenever a device, connection, supplier, account or configuration changes, and verify it through a scheduled review.

Conclusion

Building management system cyber security UK property operators can trust combines secure connectivity with operational resilience. Know every connection, restrict authority, monitor meaningful events and test the manual route before an incident removes remote control.