Building Systems Security for Property Managers: BACnet/IP, Access Control, Cameras and Vendor Remote Access

Why a property manager should care

A modern building runs on small computers. Controllers open dampers and start chillers, readers unlock doors, recorders store video, and a gateway ties them to a dashboard that a vendor can also open from home. If those devices share a network with the office or a tenant, an attacker who gets into one can try the rest. They also keep running for years without updates, which makes them popular targets. CISA publishes advisories on this kind of equipment in its industrial control systems advisory feed, and the Commercial Facilities Sector is one of the sectors CISA recognizes as critical infrastructure.

Plain terms

• BACnet is the protocol many building controllers use to talk to each other. BACnet/IP carries it over normal networks, on UDP port 47808 by default.
• Access control means card readers, door controllers and the server that holds who may enter where.
• Camera systems are cameras plus a network video recorder (NVR) or cloud service.
• A vendor remote-access gateway is the tool (a VPN, remote-desktop product or cloud portal) that lets a maintenance company reach your equipment.

Step 1: Make a list

Walk the building and list every networked device: controllers, thermostats, meters, elevator and fire-panel gateways, readers, recorders, cameras, and the servers behind them. Note the make, model, firmware, IP address, switch port, and the vendor who supports it. You cannot segment what you have not found, and the same list tells you what to ask each vendor.

Step 2: Separate the networks

Give each system its own VLAN and subnet at least: building automation, access control, cameras, tenants, guests, and your own office. Put a firewall between them and allow only the specific flows that are needed. CISA's operational-technology guidance recommends segmenting IT and OT networks and, where control data must reach enterprise systems, using a demilitarized zone for that passing of data.

Practical rules for BACnet/IP: keep the building automation VLAN off the internet and off tenant networks; block UDP 47808 at the edges; allow broadcast traffic (BACnet discovery uses it) only inside the VLAN, and where a BACnet network spans subnets use a BACnet broadcast management device (BBMD) that you have documented. Never port-forward a controller to the internet; search engines that index internet-connected devices make such controllers easy to find.

For cameras, use a recorder VLAN that cameras can reach but that cannot reach the rest of the network, and do not let cameras initiate connections to the internet unless a documented cloud service needs it. For door controllers, the access-control server is worth as much protection as a domain controller: it decides who can enter.

Step 3: Use secure protocols when you can

Classic BACnet/IP does not authenticate the sender, so anyone on that network can send commands. The ASHRAE BACnet committee has addressed this with BACnet Secure Connect, which sets up encrypted, authenticated connections. When you specify a new system or a major upgrade, ask whether the controllers and workstations support BACnet/SC and whether the product is certified by the BACnet testing laboratories. Do not assume older equipment can be upgraded; in many cases the answer is a gateway in front of it, with the network segmentation above.

Step 4: Control vendor remote access

Vendors need access, and they are a leading path in. CISA's fact sheet on primary mitigations for operational technology advises, in its own words, to reevaluate risk-based tradeoffs on remote access: if remote access is essential, move the assets off the public internet onto a private network connection, use VPN functionality with a strong password and phishing-resistant multi-factor authentication, apply least privilege for the specific asset, user role or scope of work, and disable dormant accounts. For a building, that means:

• One managed entry point (a VPN or privileged-access gateway) that all vendors use, not each vendor's own remote tool.
• Named accounts per technician, with multi-factor authentication, never a shared login.
• Access that you turn on for a scheduled job and off afterward, or that needs your approval each time.
• Logs of who connected, when and to what, kept by you rather than only by the vendor.
• Accounts removed when a technician leaves a vendor or the contract ends.

CISA also publishes a guide to securing remote access software, which is useful when you review the tools a vendor wants to install.

Step 5: Passwords, updates and contracts

• Change every default password, on controllers, cameras and recorders. CISA's mitigation list puts changing default passwords near the top.
• Ask each vendor how security fixes are delivered, how long they support a product, and who applies them.
• Put security terms in the contract: remote-access method, account handling, incident notice, and the right to see their access logs.
• Make sure the building can run manually if the control system is down; CISA lists the ability to operate manually as a mitigation, so plan how doors, HVAC and life-safety systems behave on failure.

When something goes wrong

Write down in advance who to call if a vendor account is misused or a camera or controller behaves oddly: the vendor, your IT provider, and the building engineer. Keep configuration backups of controllers so you can restore a known-good state. If tenants' data could be affected, your leases and insurance may have notice obligations, so check them with your counsel.

We help property managers map building systems, set up segmentation and a single vendor-access path, and review contracts for security terms, as scoped and authorized work. We do not take over your building control systems or replace the vendors that maintain them.

Sources

• CISA, Primary Mitigations to Reduce Cyber Threats to Operational Technology (fact sheet)
• CISA, Guide to Securing Remote Access Software
• CISA, Industrial Control Systems Advisories
• CISA, Commercial Facilities Sector
• NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (CSRC)
• BACnet Committee (ASHRAE SSPC 135)
• BACnet International

This article is general information, not engineering or legal advice. Building systems vary; confirm settings, ports and protocol support with your equipment vendors before changing a live network. Last reviewed November 9, 2026.

Next article

Next · SecurityA Teams and SharePoint Sharing-Links Audit: Anyone Links, Guest Access, Expiry and Sensitivity LabelsEvery shared link in Microsoft 365 is a door someone opened. Over a few years the doors pile up, and some are open to anyone with the address. Here is how to find them, decide which to close, and set defaults that stop the pile growing.7 min read

Related reading

• InfrastructureAn Intune Compliance Policy Baseline for Small Fleets: Windows, macOS, iOS, Android and Grace Periods9 min
• InfrastructureWi-Fi Segmentation for Small Offices: Guest, IoT and Staff Networks, WPA3 and Isolation7 min