Which OT is in your building? All the systems at a glance

More OT than you think

Ask an owner which OT is in their building, and the answer is often silence. That is not surprising. OT is hidden in technical rooms, in ceilings, on the roof and in the lift shaft. You only notice it when it stops working.

In the first part of this series we explained what OT is: the hardware and software that measure and control physical processes. Now we go through the systems one by one: what they do, who usually manages them and how they are often connected. At the end you get a tip for making your own overview.

The systems at a glance

This is a general picture. In your building, things may be arranged differently.

The building management system: the heart of the installations

The building management system (BMS) is the central system that controls the climate installation. It usually consists of control cabinets in the technical rooms, sensors throughout the building and a computer or web page where the manager can see and adjust everything.

The BMS is usually supplied and maintained by the installer. The installer wants to see faults quickly, so they often have remote access. The devices talk to each other using their own protocols, such as BACnet and Modbus. Older versions of these have no password and no encryption. That is the subject of a later part of this series.

The BMS is often the first system to be linked to the office network, for example to show energy consumption. So make sure you know what it is connected to.

Climate, lighting and sun shading

Heating, cooling and ventilation are usually controlled by the BMS. Lighting and sun shading often have a system of their own. In many buildings in Europe this is KNX: a standard that lets switches, sensors, lamps and blinds talk to each other. DALI is also used for lighting.

These systems are usually installed by the electrical installer. After handover, it is often unclear who manages them. Sometimes they are linked to the BMS or to an app for users. Every link is a connection you need to know about.

Lifts and escalators

A lift has an alarm button and a voice connection. Anyone who gets stuck can call for help. That connection usually goes to a control room run by the lift supplier or another party.

More and more lifts are also monitored remotely. The supplier can then see faults and wear, and plan maintenance better. This often runs via a separate modem with a SIM card, sometimes via the building network. Ask which connection your lifts use and who has access to it.

Access and cameras

Badge readers, smart locks, barriers and entrance gates decide who may enter the building. Cameras record what happens. Both are often supplied by a security company.

These systems almost always use the network. Cameras send their images to a recorder. Access systems are increasingly managed via an app or the cloud. This can make them reachable from outside. Many attacks on smart devices started with cameras and recorders that still had a default password. Read more in How secure is the smart building?

Fire alarm and evacuation

The fire alarm system detects smoke or heat, raises the alarm and starts the evacuation. In many buildings, an alarm is also sent automatically to a control room. This system must meet strict requirements and is maintained by a specialised company.

The fire alarm system is usually separate from the other systems. However, there is often a link: in a fire, the ventilation stops or doors are unlocked. Know how those links work and who is allowed to change them.

Energy: meters, charging points, solar panels and batteries

This is the fastest growing group. Smart meters measure consumption. Charging points charge cars and record who charges how much. Inverters convert the power from solar panels. Batteries store energy.

These devices are often installed by different parties, each with its own app or portal. Many have their own internet connection, via a SIM card or via the building network. As a result, they often appear in no overview at all.

Do not forget the tenants

Tenants bring OT too. Think of extra cooling for a server room, their own access system, or machines and cold stores in a business unit. These systems belong to the tenant, but they may be connected to the same network. So agree on what the tenant may connect and where. Logistics property is the subject of a separate part of this series.

Tip: make an overview of your OT

What is not on a list does not get updated or secured. So it starts with an overview, also called an inventory. It does not have to be a complicated document. A simple table is enough. For each system, write down:

1. The name of the system and where it is located.
2. The supplier and the party that manages it, with a contact person.
3. Whether the system belongs to the owner or the tenant.
4. How it is connected: standalone, on its own network, on the office network or to the internet.
5. Who can access it remotely, and how that access is secured.
6. When the software was last updated.
7. What happens if the system fails, and how serious that is.

Ask your installers and suppliers for the details. Also walk through the technical rooms yourself: you will often find devices that nobody remembers. Agree who keeps the overview up to date, and update it whenever something changes.

What the IT-Label and the Security Audit do here

The IT-Label assesses the digital infrastructure of a building: the connection, the cabling, the Wi-Fi and the technical room. The IT-Label does check whether smart building systems are present, such as climate, access and cameras, but it does not assess how secure that OT is. The inspector does check whether the building management system is connected to the IT network. That helps you see where IT and OT meet.

Do you want to know whether your building systems are properly separated from the office network? In the Security Audit, an auditor checks on site whether your network is separated from guests, other tenants and the building systems. You receive a report with the risks and advice on how to segregate the networks.

Your next step

Start with the free IT-Label Self-Scan. In a few minutes you will see how well you know your building and where the points for attention are. Then use the list above to map your OT.

This is part 2 of a series on IT and OT in buildings. A new part appears every Wednesday. Next week you can read why IT and OT are growing together, and what that asks of you. All terms and parts can be found on the page IT and OT in buildings.

Frequently asked questions

What is operational technology in a building?

Operational technology (OT) is all the technology in a building that measures, controls or operates something. Think of the building management system, climate, lighting, sun shading, lifts, access control, cameras, fire alarms, charging points, solar panels and batteries.

What does a building management system do?

A building management system (BMS) controls and monitors the installations for heating, cooling and ventilation, and often the lighting too. The manager can see on one screen how the installations are running and adjust the settings. The system is usually supplied and maintained by the installer.

Who is responsible for the OT in a building?

That differs per building and per system. Often the installer manages the climate, the lift supplier the lifts and a security company the access control and cameras. Make sure one party oversees the whole, usually the owner or the property manager. Make agreements and put them in writing.

How do I make an overview of the OT in my building?

Make a table with, for each system: the name, the location, the supplier and manager, whether it belongs to the owner or the tenant, how it is connected, who can access it remotely and when it was last updated. Ask your suppliers for the details and walk through the technical rooms yourself.

Does the IT-Label look at the OT in my building?

The IT-Label does check whether smart building systems are present, such as climate, access and cameras, but it does not assess how secure that OT is. It assesses the digital infrastructure. The inspector does check whether the building management system is connected to the IT network. Whether the networks are properly separated is what we examine in the Security Audit, with advice.