A secure BACnet network combines three things: building systems separated from the corporate network, encrypted and authenticated communication (BACnet Secure Connect, or BACnet/SC) where devices support it, and ordinary IT controls around the edge, such as firewalls, strong authentication and monitoring. Standard BACnet/IP was designed for function, not defence, so the network around it has to do the protecting. This guide explains how to build that network, what to check before moving to BACnet/SC, and what to keep running afterwards.
TL;DR
- Classic BACnet/IP has no built-in authentication or encryption, so segmentation and boundary controls carry most of the protection.
- BACnet/SC adds mutually authenticated TLS 1.3 connections and removes the need for broadcasts, BBMDs and static IP addressing.
- Certificates and time synchronisation become operational dependencies: an expired certificate can take a connection down.
- Mixed BACnet/IP and BACnet/SC estates need isolating and a migration plan, not a switch-over weekend.
- Treat security as a continuous process owned jointly by facilities and IT, not a feature of one product.
Table of Contents
- Why BACnet needs a secure network around it
- Segmentation: the first control to put in place
- BACnet/SC: what it changes
- Before you deploy BACnet/SC: the checks that matter
- Migrating from BACnet/IP without breaking the building
- Operating BACnet/SC: certificates, time and monitoring
- Other controls around the BACnet segment
- Our view on securing building networks
- How we can help
- FAQ
- Sources
Why BACnet needs a secure network around it
BACnet is the protocol that ties together heating, ventilation, lighting, access control and metering in a large share of commercial and public buildings. On a standard BACnet/IP installation, devices talk over UDP port 47808 and use broadcast messages such as Who-Is and I-Am for discovery. The base standard has no authentication and no encryption, so any host that can reach an exposed device can enumerate it and, in many deployments, change its objects.
That is a different risk profile from office IT. A compromised controller does not leak a spreadsheet, it can alter temperatures, ventilation or access behaviour. For schools, factories, warehouses, hotels and managed workspaces, the consequences are operational: lost teaching time, spoiled stock, comfort complaints, safety implications.
The UK’s National Cyber Security Centre makes the underlying point in its guidance on operational technology: many OT systems are hard to update, so the network boundary becomes the main defence against external threats, and the boundary assets should be modern and easy to replace. Building automation fits that description exactly. Controllers installed a decade ago will often outlive several generations of firewalls and switches.
ASHRAE describes a layered approach for BACnet systems. Its defence in depth can include physical and virtual network isolation, IT firewalls, switch and router monitoring, endpoint authorisation, and user authentication on servers and workstations. No single layer is expected to do everything.
Segmentation: the first control to put in place
Segmentation is the most practical step for an estate that cannot be replaced overnight. The NCSC notes that logical or physical separation can isolate obsolete devices from the wider OT network, limiting lateral movement and reducing exposure. It also states that segmentation and segregation remain key controls where built-in device or protocol protections are limited, which is precisely the case for BACnet/IP.
What a sensible BACnet segment looks like
A workable design usually has these properties:
- A dedicated VLAN or VRF for building systems, separate from user, guest and server networks. Where the risk justifies it, physically separate switching.
- A single controlled boundary between that segment and everything else, enforced by a firewall rather than by routing alone.
- Explicit allow rules. Only the supervisory servers, engineering workstations and named integration points may reach controllers, and only on the ports the system needs.
- No direct internet exposure. ASHRAE experts stress that moving BACnet into standard IP security practice removes risky habits such as placing unprotected devices directly on the internet.
- Separate segments for different risk levels. Legacy BACnet/IP devices sit apart from newer, secured equipment, and third-party contractor access lands in its own zone.
Because BACnet/IP relies on broadcast discovery and often on BACnet Broadcast Management Devices (BBMDs) to cross subnets, segmentation needs care. Flattening everything into one wide broadcast domain to make discovery work defeats the purpose. Plan the BBMD placement deliberately and keep it inside the building segment.
Our separate guide on OT network segmentation for cybersecurity and OT teams covers zone design in more depth, and the principles carry over to other protocols. The same logic applies if your estate also runs serial-derived protocols, as discussed in our article on Modbus TCP security.
Shared network fabrics
Many sites run building systems over the same switches as everything else. ASHRAE’s mitigation list for shared fabrics includes disabling unused switch ports, using RADIUS for authentication, and physically or virtually isolating BACnet devices. Port-level authentication matters in buildings because controllers sit in plant rooms, ceiling voids and corridors where a spare wall socket is easy to reach. A network access control layer, covered in our network access controller guide, lets you decide which device may join which segment instead of trusting the cable.
BACnet/SC: what it changes
BACnet Secure Connect is the part of the BACnet standard that brings encryption and authentication into the protocol itself. ASHRAE’s white paper explains that it uses TLS 1.3 and Secure WebSockets, removes the need for static IP addresses, broadcasts and BBMDs, and provides a mechanism for devices to be authenticated and authorised to use the network.
BACnet/IP compared with BACnet/SC
| Area | BACnet/IP | BACnet/SC |
|---|---|---|
| Transport | UDP, default port 47808 | TLS 1.3 over Secure WebSockets |
| Authentication | None in the base standard | Mutual, certificate-based |
| Encryption | None in the base standard | Built in |
| Discovery | Broadcast messages | No dependency on broadcasts |
| Crossing subnets | BBMDs | Hub-based connections, no BBMDs |
| Remote access | Usually needs VPN or tunnelling | Can use shared IP networks without separate VPN equipment |
| Ongoing upkeep | Firewall and ACL rules | Certificates, time sync, plus firewall rules |
The design aim is to meet IT teams halfway. The ASHRAE white paper says BACnet/SC is meant to bridge the gap between building automation needs and IT policy, so facilities managers can cross complex network layouts without creating extra burden for IT. Devices can protect themselves through built-in, mutually authenticated TLS 1.3 connections, which removes the need for separate VPN equipment for secure remote connectivity.
It also fits zero trust thinking. ASHRAE notes that BACnet/SC supports zero-trust principles by enforcing authorisation of network requests at the endpoint rather than relying only on server-side policy. If you are building a zero trust model for the rest of the network, our article on Cisco Access Manager and zero trust shows how identity-based access can sit alongside it.
One point of caution: BACnet/SC does not make segmentation redundant. Encryption protects the conversation, but it does not stop a compromised workstation with valid credentials, or an unrelated device, from being on the same network as your controllers. Keep both.
Before you deploy BACnet/SC: the checks that matter
Most BACnet/SC problems arise from the supporting infrastructure, not the protocol. ASHRAE’s guidance says organisations should verify that devices support the necessary TLS 1.3 cipher suites and that certificate management processes are robust. The site infrastructure should also deliver consistent certificate authority trust and secure time synchronisation for validation.
A pre-deployment checklist:
- Inventory every BACnet device. Record make, model, firmware and whether it supports BACnet/SC natively, by firmware upgrade, or not at all.
- Confirm TLS 1.3 cipher support on controllers, routers and supervisory software.
- Decide who runs the certificate authority. Define who issues, stores, renews and revokes certificates, and who is accountable when one lapses.
- Give every device its own certificate. ASHRAE is clear that devices require unique certificates.
- Set up reliable time sources. Certificate validation depends on devices agreeing what time it is.
- Map the connection paths. Decide where hubs sit, which firewall rules allow outbound WebSocket connections, and which segment each hub lives in.
- Run a risk analysis. In the UK, the BSI publication PD CLC/TS 50491-7:2024 guides installers and integrators in assessing security risks and choosing products that meet the required security level for connected building automation. It classifies BACS networks as managed or unmanaged, with device-level risk analysis for both and system-level analysis for managed networks.
Migrating from BACnet/IP without breaking the building
Migration is usually staged, because very few estates can change every controller at once. The ASHRAE white paper describes BACnet/SC as backward-compatible with existing BACnet deployments, with routers able to connect it to legacy BACnet networks. One manufacturer’s IT guide describes the supervisory upgrade as a driver configuration change and certificate loading, with no re-engineering of trends or alarms. Results depend on your platform, so confirm with your supplier.
A staged route often looks like this:
- Contain what you have. Put legacy BACnet/IP in its own segment behind a firewall before touching anything else.
- Pilot BACnet/SC on one floor, plant room or building with a rollback path.
- Connect through routers where old and new must interoperate, and keep those routers as the only bridge.
- Retire legacy devices as they reach end of life, replacing them with BACnet/SC-capable equipment.
Manufacturers are cautious about mixing. Johnson Controls says that combining BACnet/IP and BACnet/SC compromises network security and recommends BACnet/SC across the site where possible. Where BACnet/IP devices must stay, its guidance is to minimise them and isolate them to one engine. That is a sensible transition principle for any vendor: a mixed estate is a stage in the journey, not the destination.
Migration also overlaps with wider plant work. If you are replacing air handling or controls at the same time, HVAC upgrade planning steps help line up the mechanical programme with the controls change so the network work is not an afterthought.
Operating BACnet/SC: certificates, time and monitoring
BACnet/SC shifts effort from firewall rules to certificate lifecycle. ASHRAE highlights that failure to replace certificates before expiry can cause a denial of service, and that improperly synchronised clocks create the same risk. Managing signing and operating certificates adds complexity, so monitoring tools should track expiry and connection status.
Practical habits:
- Keep a register of certificates with expiry dates and owners.
- Alert well ahead of expiry, not on the day.
- Monitor hub and node connection status as you would any critical service.
- Test certificate renewal on a non-critical segment before doing it site-wide.
- Document who can issue certificates, and review that list regularly.
These are IT disciplines that facilities teams do not usually have, which is why the handover between the two groups needs writing down.
Other controls around the BACnet segment
Segmentation and BACnet/SC are the core, but the NCSC’s guidance points to several other layers:
- Application-aware firewalls. The NCSC recommends defence in depth including firewalls with application-layer (Layer 7) inspection. A next-generation firewall at the building boundary can see more than a port number. Our overview of Meraki security and Cisco NGFW outlines the options.
- Phishing-resistant MFA for external services. Contractor and vendor remote access is a common route in. Apply MFA and least privilege to every account that can reach the building segment.
- Updated boundary assets. Firewalls and switches that protect old controllers need patching even when the controllers cannot be patched.
- Current documentation and backups. Network diagrams, device lists and controller configuration backups make incident response faster.
- Cyber-resilient control approaches. A 2024 academic review identifies passive and active cyber-secure resilient control schemes as responses to attacks at the management, automation and field levels of building automation.
All of this needs an owner. ASHRAE maintains that cybersecurity is a continuous process rather than a static feature, and that BACnet systems should support owner-operator processes aligned with the NIST Cybersecurity Framework. For governance, our cybersecurity compliance basics guide shows how to turn that into routine reviews.
Our view on securing building networks
We work with schools, manufacturers, logistics operators, hospitality groups, shared workspaces and property developers, and the pattern is consistent: the building management system was installed by one party, the corporate network is run by another, and nobody owns the join.
Our advice is to start with visibility and containment, not product selection. Know what is on the building network, put it behind a controlled boundary, and only then decide how fast to move to BACnet/SC. In a multi-site estate, consistent segmentation and access policy across sites usually delivers more risk reduction than any single protocol upgrade. Cloud-managed networking helps here, because policy is defined once and applied to every site’s switches, wireless and firewalls.
We would also keep BACnet/SC in perspective. It is a real improvement, and we recommend planning for it when you specify new equipment. But it adds certificate and time dependencies that someone must own. If that ownership is unclear, fix it before deployment, not after the first outage.
— Jacob
How we can help
Re-Solution is a Cisco partner with over 35 years of experience in network infrastructure and security. For building and OT networks, the starting point is usually a network audit that maps what is connected, how it is separated and where the gaps are. From there our managed services team can run the segmented network, firewall policy and access control day to day, or you can speak to us through our main site about a project. Our article on the role of networking in smart buildings gives further context.
FAQ
Is BACnet secure by default?
No. The base BACnet standard has no authentication or encryption, so devices that can be reached on the network can generally be read and often written to. Security comes from segmentation, firewalls and access control, and from BACnet/SC where your devices support it.
What is the difference between BACnet/IP and BACnet/SC?
BACnet/IP sends unencrypted messages over UDP and uses broadcasts and BBMDs to find devices across subnets. BACnet/SC uses mutually authenticated TLS 1.3 over Secure WebSockets and does not depend on broadcasts or BBMDs. In practice it also means managing certificates and time sync.
Can BACnet/SC work alongside existing BACnet devices?
Yes, routers can connect BACnet/SC networks to legacy BACnet networks. Manufacturers advise keeping the mix small and isolated, and moving to BACnet/SC site-wide where possible, because a mixed network weakens the security gain.
Do I still need segmentation if I use BACnet/SC?
Yes. Encryption and authentication protect the BACnet connection, but segmentation limits what else can reach building systems and how far an intruder can move. The NCSC treats segmentation as a key control for OT, and it complements BACnet/SC rather than being replaced by it.
Sources
- ASHRAE: Managing BACnet security (managedbacnet)
- NCSC: Secure connectivity principles for Operational Technology
- ASHRAE: BACnet Secure Connect white paper
- ASHRAE: Protecting Building Automation Systems with BACnet Secure Connect
- Siemens: BACnet Secure Connect Features for IT Professionals
- Johnson Controls: BACnet/SC network and IT guidance
- BSI: PD CLC/TS 50491-7:2024
- PNNL: A Critical Review of Cyber-Physical Security for Building Automation Systems
- Pentestpad: Port 47808, BACnet/IP
Recommended
- OT network segmentation for cybersecurity and OT teams
- Network Access Controller Guide
- Network Access Controller Guide
- Secure network design: proven examples for robust protection
