IT and OT in buildings
A building runs on two kinds of technology. IT processes data. OT controls the installations, such as climate, lifts and access. Here you can read what the difference is, which terms belong to it and which rules apply.
What are IT and OT?
IT stands for Information Technology. It is about managing digital data, computers and networks: laptops, servers, the office network, Wi-Fi and the cloud.
OT stands for Operational Technology. It is the hardware and software that monitor and control physical processes. In a building, that includes the climate system, the lighting, the lifts, access control, fire alarms, charging points and solar panels.
IT and OT used to be separate. Now OT is more and more often connected to the same network as the computers. This is called IT/OT convergence. It makes buildings smarter and more efficient, but also more vulnerable.
IT and OT side by side
The main differences in one overview.
| Topic | IT | OT |
|---|---|---|
| Purpose | Processing and sharing data | Monitoring and controlling physical processes |
| Examples | Laptops, servers, Wi-Fi, office network, cloud | Building management system, climate, lifts, access, fire alarms, charging points |
| What matters most | Keeping data confidential | Keeping the installation running and safe for people |
| Lifespan | Usually 3 to 5 years | Often 15 to 25 years or more |
| Updates | Frequent, usually automatic | Rare, often only through the supplier |
| Who manages it | The IT department or an IT partner | The installer, facility services or the technical manager |
| Language of the devices | Standard internet protocols | Own protocols, such as BACnet, KNX and Modbus |
Which OT is there in a building?
- Building management system. The central system (BMS) that controls heating, cooling, ventilation and often lighting.
- Climate, lighting and sun shading. Installations that respond to time, temperature, light or occupancy.
- Lifts and escalators. More and more often with remote monitoring and maintenance.
- Access and security. Card readers, smart locks, barriers, access gates and cameras.
- Fire safety. The fire alarm and evacuation system.
- Energy. Smart meters, charging points, solar panel inverters and batteries.
- Logistics and industry. Cold stores, sorting systems, dock doors and production lines.
Terms
- OT. Operational Technology: hardware and software that monitor and control physical processes.
- IT/OT convergence. IT and OT growing together. Installations are connected to the network so they can be managed remotely and share data.
- Building management system (BMS). A central system that controls and monitors the installations in a building.
- BACS. Building automation and control systems. The European name for the systems that automatically control and monitor the installations in a building.
- PLC. A small industrial computer that directly controls a machine or installation.
- SCADA. Software to monitor and operate installations remotely, often across several sites.
- BACnet. An open protocol for building automation, for example for climate and lighting. The older form has no encryption. The newer form, BACnet/SC, adds security.
- KNX. A standard for building automation, such as lighting, sun shading and climate. KNX Secure adds encryption.
- Modbus. An old and simple protocol from 1979, widely used for meters and installations. It has no password and no encryption.
- Network segregation. Building systems, guests and the office network each in their own part of the network, so a problem in one part does not affect the other.
- Remote access. A connection that lets an installer or supplier log in to an installation from outside.
- IEC 62443. An international series of standards for the security of industrial automation and control systems. Also used for building automation.
What do the rules say?
Cybersecurity law. In the Netherlands, the Cyberbeveiligingswet (Cybersecurity Act) has applied since 15 August 2026. It implements the European NIS2 directive. Organisations that fall under it have a duty of care and a reporting obligation for their network and information systems, and OT is part of that. In Belgium, the NIS2 law has applied since 18 October 2024.
Building automation. The European Energy Performance of Buildings Directive (EPBD) requires building automation in larger non-residential buildings. In the Netherlands, this applies to buildings with a heating or cooling system of more than 290 kW. From 2030, it also applies from 70 kW. So more buildings will have OT connected to a network.
Standards. For OT security, IEC 62443 is the best-known international series of standards.
What the IT-Label and the Security Audit do
The IT-Label assesses the digital infrastructure of a building. The IT-Label does not measure the OT itself. The inspector does check whether the building management system is connected to the IT network. Whether the networks are properly segregated is something we examine in the Security Audit. You receive a report and advice on how to segregate the networks.
The series on IT and OT
Every Wednesday, a new article on IT and OT in buildings is published. Below you will find the parts that have already appeared. All articles are also on the page IT and OT in buildings under Articles.
Frequently asked questions
Do you know how your network is segregated?
In the Security Audit, an auditor checks on site whether your office network is separated from guests, other tenants and the building systems. You receive a report with advice.
Related information
Smart Building technology
Climate control, access control and booking systems don't make a building smart on their own. Integration does, and that's what the IT-Label assesses.
Cybersecurity in real estate
Every system connected to the network is a possible entry point. What cybersecurity means for a building, and how the IT-Label looks at it.
Glossary: IT-Label and digital infrastructure
From audit to Wi-Fi coverage: the key terms about the IT-Label, digital infrastructure and real estate, explained briefly and simply.
IT-Label Security Audit
An on-site physical audit of your Wi-Fi, network and server room, from €750. A report with the risks and clear advice, on its own or with a pre-inspection.