Building automation cybersecurity for BACnet and control networks
For building automation vendors, integrators and facility operators running BACnet, Modbus or proprietary HVAC, access-control and lighting controllers. These controllers increasingly sit on IP networks and, often, the internet, which brings them into scope for the EU Cyber Resilience Act and general OT security practice. SoftWSP's OT Snapshot maps what is actually on a building's control network and the published vulnerabilities that affect it, from a passive traffic recording.
Regulations and standards that apply
- EU Cyber Resilience Act — Regulation (EU) 2024/2847. General cybersecurity requirements (SBOM, vulnerability handling, Article 14 reporting) for connected products with digital elements placed on the EU market; building controllers are not on the regulation's exclusion list, so most that are sold as standalone products fall in scope.
- IEC 62443-2-1 — asset owner security program. ANSI/ISA-62443-2-1-2024 sets expectations for the operator running the building automation network: a documented security program, risk assessment and patch management, not a technical standard for the controllers themselves.
- NIST SP 800-82 Rev. 3 — OT security. A widely used, vendor-neutral baseline for operational technology networks, including network segmentation, asset inventory and monitoring, applicable to building automation networks as much as plant OT.
- RED delegated act / EN 18031. Where a controller includes radio equipment (Wi-Fi, Zigbee, LoRaWAN sensors and the like), Commission Delegated Regulation (EU) 2022/30 and the EN 18031 harmonised standards add mandatory requirements under the Radio Equipment Directive.
Typical device and firmware risks
- A flat network with no separation between building-automation controllers and the corporate IT network.
- Default or hard-coded credentials on building controllers, as found in a real 2026 advisory on a Johnson Controls building controller.
- Unauthenticated web services exposed on the controller's management interface, as found in a real 2026 advisory on Siemens building-automation controllers.
- No current inventory of which controllers, vendors and firmware versions are actually connected.
- Remote-access tools or modems left on the network by an integrator or vendor, unmanaged after installation.
Which SoftWSP service fits
OT Snapshot analyses a passive recording from a mirror port on your building's network switch and returns a device inventory, the published vulnerabilities affecting those devices, and a map of remote access — without installing sensors or connecting to a running controller. If you manufacture the controller's firmware yourself rather than operate the network it sits on, Device & Firmware Security is the better fit.
Related
Frequently asked questions
Does the EU Cyber Resilience Act apply to building automation controllers?
A BACnet, HVAC, access-control or lighting controller placed on the EU market as a standalone connected product falls under Regulation (EU) 2024/2847's general cybersecurity requirements unless a specific exclusion applies; the regulation's exclusion list (Article 2) covers categories such as medical devices and motor vehicles, not building automation, so check the current text for your exact product.
Does the RED delegated act apply to building controllers?
If the controller includes radio equipment, such as Wi-Fi, Zigbee or LoRaWAN sensors, Commission Delegated Regulation (EU) 2022/30 and the harmonised EN 18031 standards add mandatory cybersecurity, privacy and fraud-prevention requirements under the Radio Equipment Directive.
What does IEC 62443-2-1 ask of a building operator?
ANSI/ISA-62443-2-1-2024 sets out a security program for the asset owner running an industrial or building automation network: policies, risk assessment, patch and configuration management and incident response, rather than technical requirements on the controllers themselves.
What does NIST SP 800-82 recommend for a building automation network?
NIST SP 800-82 Rev. 3 recommends network segmentation between IT and OT/building systems, an accurate asset inventory, monitoring of the control network, and managed remote access — the same gaps an OT Snapshot is built to surface.
Does an OT Snapshot connect to or test our building controllers?
No. It analyses a passive traffic recording your own engineer takes from a switch mirror port; nothing is sent into the building's control network and no controller is tested directly.
Sources
- Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal text, EUR-Lex (read 29 Oct 2026)
- ISA: ANSI/ISA-62443-2-1-2024 — official product page (read 29 Oct 2026)
- NIST CSRC: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security — final publication page (read 29 Oct 2026)
- Commission Delegated Regulation (EU) 2022/30 (RED delegated act, EN 18031), EUR-Lex (read 29 Oct 2026)