Building Management System (BMS) and OT Security for Data Centers

Two Networks, One Facility

Most data center security conversations center on the IT network: the switches, firewalls, and access controls protecting client compute, storage, and connectivity. That network is only half of what keeps a facility running. A parallel network, generally called the building management system (BMS) or operational technology (OT) network, controls the physical infrastructure the IT network depends on: chillers and CRAC and CRAH units, generators and automatic transfer switches, fire detection and suppression, lighting, and access control hardware. These two networks require different security models, and treating OT security as a subset of IT security, or ignoring it because "it's just the building," is a common and avoidable gap.

The distinction matters because the consequence profile is different. A compromised IT switch risks client data and availability. A compromised BMS controller can, in the worst case, disable cooling to a hall full of equipment, interfere with fire suppression, or unlock a secured space, risks that are physical and immediate rather than purely informational.

What Actually Runs on the OT Network

A typical data center's OT environment includes chiller and CRAC/CRAH controllers, building automation controllers for lighting and general HVAC, generator and transfer-switch controls, fire detection and suppression panels, access control panels and door hardware, and increasingly, the sensors and gateways feeding environmental monitoring and DCIM dashboards. These devices commonly speak industrial protocols such as BACnet, Modbus, and SNMP, alongside vendor-proprietary protocols for specific equipment lines, and connect through a mix of dedicated controller networks, building-wide Ethernet, and in older installations, serial connections bridged onto IP.

Why This Network Is Often Under-Protected

Several factors combine to make OT networks a weaker link than the IT network they sit beside:

• Protocol design predates network-level threats. BACnet and Modbus were designed decades ago for reliable operation on isolated, trusted networks. Neither protocol requires authentication or encrypts its traffic by default; any device that can reach the network segment can generally read data from, and issue commands to, the controllers on it. The security has to come from the network architecture around the protocol, not the protocol itself.
• Ownership sits outside the security team. BMS and OT infrastructure is frequently specified, installed, and maintained by mechanical and electrical contractors or facilities engineering, teams whose expertise is HVAC and electrical systems, not network security. Without deliberate coordination, the OT network can end up configured for convenience rather than for the same security posture the IT team applies to the data network next door.
• Vendor remote access is routine. Chiller, generator, and fire-system manufacturers commonly want remote access for diagnostics, firmware updates, and warranty service. Each vendor connection is a potential entry point, and a facility with several mechanical and electrical subsystems can accumulate several such access paths, each configured by a different vendor at a different time.
• Convergence creates bridge points on purpose. Modern DCIM and environmental monitoring tools pull live data from the OT network to display on dashboards the IT team, and sometimes tenants, can see. That convergence is operationally useful and increasingly standard, but every bridge between the OT and IT networks is also a path an attacker on one side could potentially use to reach the other, which is exactly why the bridge needs to be deliberately controlled rather than left as an open route.

Segmentation: The Foundational Control

The starting point for OT security in a data center is segmentation: keeping the BMS and OT network physically or logically separate from the IT and tenant networks, with a defined, narrow gateway for the traffic that legitimately needs to cross. In practice this means VLAN separation or physically distinct switching for OT devices, firewall rules that permit only specific protocols, ports, and source addresses between the OT segment and anything else, and no direct path from the public internet or tenant-facing networks to an OT controller. Where a DCIM platform needs live BMS data, that connection should run through a single, monitored, access-controlled interface rather than general network reachability between the two environments.

This is the same zero-trust principle our IT network security guide applies to client-facing infrastructure, extended to the OT side: assume any given segment could be compromised, and limit what that compromise can reach rather than relying on the network perimeter alone.

Managing Vendor Remote Access

Because vendor remote access is one of the more common entry points into OT environments, it deserves explicit controls rather than an open, always-on connection: access brokered through the operator's own VPN or remote access gateway rather than a vendor-installed backdoor device, multi-factor authentication on any remote session, time-boxed access granted for a specific maintenance window rather than standing credentials, and session logging so that remote activity on OT systems is auditable after the fact. A facility running several mechanical and electrical vendor contracts should maintain an inventory of who has remote access, to what systems, and under what authorization, the same discipline already applied to physical access under a facility's physical security program.

Isolating Life-Safety Systems

Fire detection and suppression deserves particular care in OT network design. These systems are safety-critical by definition, and the design goal is to ensure that a cyber incident elsewhere on the OT network, or even within general building automation, cannot interfere with fire detection or suppression function. In practice, that generally means fire and life-safety controls sit on their own more tightly isolated segment, separate from general-purpose building automation such as lighting or non-critical HVAC scheduling, even though both may technically fall under the broader "BMS" label. The principle is the same one that governs fire suppression system design more broadly: redundancy and independence of safety-critical function from everything that is merely convenient.

Monitoring for Anomalies

Segmentation limits what an incident can reach; monitoring is what catches the incident in the first place. OT network monitoring looks different from IT monitoring because the traffic patterns are far more predictable: a chiller controller issuing the same categories of commands on a regular cycle, a fire panel reporting periodic status checks, an access control panel logging badge reads. That predictability is useful. A baseline of normal OT traffic makes unusual activity, an unexpected command, a device communicating with an address it has never contacted, a burst of traffic outside the pattern, considerably easier to flag than on a highly variable IT network. Facilities with a security operations function should extend that monitoring to the OT segment rather than treating it as a blind spot outside the data network's visibility.

What This Means for Colocation Customers

For a customer evaluating a colocation provider, BMS and OT security is rarely visible from a tour of the data hall, which is exactly why it belongs in due diligence rather than being assumed. Reasonable questions include whether the OT network is segmented from tenant-facing networks, how the operator manages vendor remote access to mechanical and fire systems, and whether environmental and fire systems are monitored for anomalous activity. These sit alongside the operational and contractual questions already covered in our colocation contract negotiation guide, since a facility's physical and operational resilience depends on this layer as much as on its power redundancy or cooling capacity.

Frequently Asked Questions

What is the difference between IT network security and BMS or OT security?

IT network security protects the servers, storage, and compute infrastructure that generate and process client workloads. BMS and OT security protects the operational technology that keeps the building running: HVAC and chiller controls, fire and life-safety systems, access control panels, generators, and power monitoring. These systems often run older industrial protocols without built-in authentication or encryption, so they require a different threat model and a different set of controls than the IT network, even though both sit inside the same facility.

Why are BACnet and Modbus considered a security risk?

BACnet and Modbus are industrial control protocols designed decades ago for reliability on isolated networks, not for operating on networks exposed to external access. Neither protocol requires authentication or encrypts its traffic by default, so any device that can reach a BACnet or Modbus network segment can generally read and issue commands to it. The risk comes from how the network is segmented and who can reach that segment, not from a flaw unique to either protocol.

How should a data center segment its BMS and OT network from the IT network?

The common approach is physical or VLAN-based separation between the OT network carrying building controls and the IT and tenant networks, with a tightly controlled gateway, typically a firewall or a data diode, for the limited traffic that needs to cross, such as a DCIM dashboard pulling environmental readings. OT devices should not be directly reachable from the internet or from tenant-facing networks, and any cross-network traffic should be restricted to specific protocols, ports, and source addresses rather than an open route between segments.

What should a colocation customer ask about BMS and OT security during due diligence?

Customers evaluating a facility can reasonably ask whether the BMS and OT network is segmented from the IT and tenant networks, how vendor remote access to building controls is managed and logged, whether fire and life-safety systems are isolated from general building automation, and whether the operator monitors OT network traffic for anomalies. These questions sit alongside the broader due diligence covered in a colocation buyer's checklist and contract negotiation, since OT security posture is rarely visible from a tour of the data hall alone.