BMS Network Segmentation: A Practical Guide for UK Organisations

BMS network segmentation means placing building management systems (HVAC controllers, lighting, access control, metering and their supervisors) in their own controlled network zones, and allowing only documented traffic between those zones and corporate IT. Done well, a compromise on an office laptop, a guest Wi-Fi device or a vendor connection cannot reach the controllers that run heating, ventilation and power. This guide explains how to plan the zones, which controls to use between them, what UK guidance expects, and how to keep the design working once the building is live.

TL;DR

• Segment the BMS into its own zones, separate from corporate IT, guest access and other building systems, and control every path between them.
• Group assets by security need, define the permitted flows as conduits, and document each decision. This is the zones and conduits model from IEC 62443, which the NCSC describes.
• Use static filtering (ACLs) as a minimum between zones, add firewalls or deep packet inspection where risk justifies it, and put remote access through a DMZ.
• UK guidance from the NCSC, NPSA and IET is risk-based good practice rather than a single mandatory rule, but ETL-listed energy management systems have specific requirements.
• Keep a definitive record of the architecture, test that the rules block what they should, and review third-party access regularly.

Table of Contents

• What network segmentation means for a BMS
• Why the BMS should not share a network with corporate IT
• Planning zones and conduits
• Controlling traffic between BMS zones
• Securing remote and vendor access
• UK guidance and standards: what applies, and is it mandatory?
• A practical sequence for a BMS segmentation project
• Testing and maintaining segmentation
• Our perspective
• How Re-Solution can help
• FAQ
• Sources

What network segmentation means for a BMS

A building management system connects field devices, controllers, supervisory servers and often cloud dashboards. On many sites these all sit on the same flat network as printers, laptops and visitor devices, because that was the cheapest way to commission them.

Segmentation divides that estate into functionally isolated segments. The NCSC identifies a zoned or segmented network as one of the most effective strategies for reducing the impact of a compromise in operational technology (OT), because threats are contained within the zone where they started.

For a BMS this usually means separate zones for:

• Field-level controllers and sensors (for example BACnet or Modbus devices)
• Supervisory servers and engineering workstations
• Corporate IT users and servers
• Guest and tenant networks
• Other connected building systems such as CCTV, access control, lifts and metering
• A DMZ for remote access and vendor connections

Segmentation can be logical (VLANs, subnets, firewall policy) or physical (separate switches and cabling). Most sites use a combination, and the right balance depends on the risk the building carries. Our guide to OT network segmentation covers the wider operational technology picture.

Why the BMS should not share a network with corporate IT

Corporate networks face more exposure than most building networks: email, web browsing, remote workers, guest devices and a constant flow of new software. Schneider Electric’s guidance on cybersecure BMS architecture points out that corporate networks are often less secure than well-managed OT networks, and that connecting the two without adequate controls expands the OT network’s attack surface and raises risk significantly.

The practical consequences on a flat network are easy to picture:

• Malware or an attacker who lands on any workstation can scan for and reach building controllers.
• Many building protocols were designed for closed networks and have limited or no built-in authentication, so a device that can reach a controller may be able to send it commands. Our pages on BACnet secure networks and Modbus TCP security explain how each protocol behaves and what to add around it.
• Broadcast-heavy building traffic can degrade the office network, and the reverse can disrupt building control.
• A fault or breach in one building system, such as a camera or a smart meter, can become a route into the rest.

The NPSA adds that physical access to building automation equipment and networks is itself a vulnerability, since it can enable unauthorised connectivity, foreign device insertion or local reprogramming. Segmentation should therefore be paired with controls on switch ports, cabinets and plant rooms.

Planning zones and conduits

The most useful planning model is the one the NCSC points to: IEC 62443 zones and conduits. A zone is a group of assets with similar security needs. A conduit is a defined, controlled communication path between zones. The NCSC describes this as a way to group assets and define controlled communication paths, and advises that OT connectivity decisions are documented in a business case.

A workable planning sequence:

1. Inventory every asset. Controllers, supervisors, gateways, IP cameras, meters, lighting gateways, lift interfaces, and any device with a cloud connection.
2. Group by function and criticality. Life-safety and plant control sit in a higher-protection zone than general metering or room displays.
3. Map the required flows. List which systems must talk to which, on which ports and protocols, and in which direction.
4. Define conduits. Each permitted flow becomes a documented conduit with an owner and a reason.
5. Deny everything else by default.

The NPSA recommends a security-minded approach to building automation and control systems that starts with assessing risk, then developing a security strategy and architecture. A security audit or risk assessment is a sensible first step because it tells you which zones deserve the strongest controls.

Bring IT and building teams to the same table

Segmentation projects often stall because facilities and IT teams work from different priorities. The NCSC stresses that harmonising risk management between IT and OT teams is critical so that policies apply consistently across the estate. A practical way to do this is to bring IT a concrete list of required traffic flows rather than a general request to open the network.

Controlling traffic between BMS zones

Once zones exist, the controls between them decide whether segmentation holds. The NCSC says traffic between OT zones should be strictly regulated, using controls such as ACLs, stateful filtering or deep packet inspection. It also treats static filtering and routing controls, including ACLs, as a minimum level of control between zones, particularly where simplicity, performance and predictability matter.

The NPSA describes micro-segmentation as a granular approach that applies controls at workload, application or device level, reducing the attack surface and limiting lateral movement. It tends to make sense for the most critical devices rather than the whole estate.

For identity-based control of what joins each segment, see our guides to network access control and NAC for enterprise networks. For the firewall layer, the role of firewalls in business sets out how to place and manage them, and a firewall audit checklist helps you confirm the rules still match the design.

Choose the lightest control that meets the risk

Building systems value predictability. A rule set that is too complex can cause an outage in plant control, which is a safety and comfort issue. Start with VLANs and ACLs for stable, well-understood flows, then add stateful inspection where the BMS meets corporate IT or the internet.

Securing remote and vendor access

Most BMS suppliers need remote access for support and monitoring. This is often where segmentation is undone: a vendor VPN or cloud gateway is plugged straight into the controller network.

The NCSC recommends that external access to OT assets uses a secure gateway in a separate, security-controlled segment such as a DMZ, so a compromise of the external-facing system does not directly expose critical assets. The NPSA also notes that system telemetry is an inherent vulnerability, and organisations should consider how telemetry is used and how remote access is granted and managed.

In practice:

• Terminate vendor connections in the DMZ, not on the BMS segment.
• Use named accounts and multi-factor authentication, and time-limit access where possible.
• Log sessions and review which suppliers still have access.
• Check default services on building devices. The NCSC warns that IT policies against Telnet may not extend to OT, leaving services enabled by default.

The same discipline applies to smart building and IoT devices that connect to the cloud. Our IoT security overview for IT decision-makers covers how to profile and contain them.

UK guidance and standards: what applies, and is it mandatory?

There is no single UK rule that says every BMS must be segmented in a particular way. What exists is a body of official and professional guidance, plus specific requirements for certain products and contracts.

• NCSC operational technology guidance. Recommends a zoned or segmented architecture to contain threats in their zone of origin, as described in the secure connectivity principle on segmentation.
• NPSA guidance on building automation and control systems. Sets out the risk-led, security-minded approach described above.
• IET Code of Practice for Cyber Security in the Built Environment. Lists network segmentation, segregation and separation as a technical security topic for building-related systems and their connections to the wider environment. The IET frames it as risk-based good practice in which the measures needed depend on the building, its use and its occupants.
• Energy Technology List (ETL). For building energy management systems seeking ETL eligibility, the listing criteria state that products must, where appropriate, be designed for compatibility with IEC 62443, and IP-connected systems must comply with ETSI TS 303 645, notably around software updates. See the ETL requirements for BEMS.

Contract and client requirements can make IEC 62443 effectively mandatory for suppliers even where the law does not. Our IEC 62443 compliance roadmap for UK asset owners explains how to prepare for procurement.

A practical sequence for a BMS segmentation project

1. Discover and baseline. Run a network audit that finds every device, VLAN, route and firewall rule. Our network audit checklist shows the evidence to collect.
2. Assess risk by zone. Decide what a compromise of each system would mean for safety, comfort, energy and continuity.
3. Design the target zones and conduits. Use proven patterns from secure network design examples.
4. Check the physical layer. Cabling, switch capacity and port security, especially where you are modernising an older building. See how to upgrade building network infrastructure.
5. Migrate in stages. Move one plant area or floor at a time, in agreed windows, with a rollback plan and the BMS contractor present.
6. Enforce and document. Turn on deny-by-default rules once the permitted flows have been confirmed, and record each conduit.
7. Test and hand over. Verify and then hand operations teams a clear diagram and change procedure.

Sector context matters. A school or university campus with many buildings, a manufacturing site where plant and BMS meet, a hotel with guest Wi-Fi and a shared workspace with tenant networks all need different zone boundaries. Our guide to network security for shared spaces shows how tenant separation is handled.

Testing and maintaining segmentation

Segmentation degrades quietly. A temporary rule stays in place, a new contractor adds a device, a firmware update changes behaviour. The NCSC advises keeping a definitive record of the architecture, including an asset inventory and documented connectivity mappings, to monitor and audit the network state.

A maintenance routine should include:

• Rule testing. Confirm from each zone that blocked traffic is actually blocked and permitted traffic still works.
• Change control. The NCSC notes that change management and version control of the OT record create an audit trail of changes.
• Patch management. Plan updates with the BMS supplier, using maintenance windows.
• Third-party access review. Remove accounts and routes for suppliers who no longer need them.
• Periodic audit. Repeat the audit when the building, tenants or systems change.

Test in a way that protects operations: use read-only checks and scheduled windows on live plant, and avoid active scanning of fragile controllers unless the supplier has confirmed it is safe.

Our perspective

Most BMS segmentation problems we see are not caused by missing technology. They come from missing information: nobody has a complete asset list, nobody owns the flows between systems, and the vendor connection was added years ago for a one-off fix.

With more than 35 years of Cisco experience, our approach is to start from evidence. We audit what is on the network, agree the zones and conduits with IT and facilities together, then enforce them with the controls the risk justifies, from VLANs and ACLs through to firewalls, NAC and cloud-managed networking.

We believe segmentation works best when it is managed, not just installed. A design that is monitored, reviewed and updated as the building changes will keep delivering protection. That is why we pair design work with managed services for organisations that want continuity after handover.

Jacob

How Re-Solution can help

Re-Solution designs, audits and manages Cisco-based networks for education, manufacturing, logistics, hospitality, shared workspaces and property developers. For BMS segmentation, that starts with a network audit to establish what is connected and how traffic flows today.

From there, our professional services team can design and implement the zones and controls, and our managed services keep the configuration monitored and supported. If you would rather consume the network as a subscription, Network as a Service is also available. To discuss your site, start at re-solution.co.uk.

FAQ

Is BMS network segmentation a legal requirement in the UK?

There is no single law that prescribes it for every building. The NCSC, NPSA and IET all recommend segmentation as part of a risk-based approach. Specific requirements can apply through ETL eligibility for energy management systems, client contracts or sector regulation, so check what applies to your site.

Is a VLAN enough to segment a BMS?

A VLAN separates traffic, but on its own it does not control what crosses between segments. The NCSC treats ACLs and similar static filtering as a minimum between zones. Add stateful firewalling and a DMZ for remote access where the risk is higher.

Can segmentation disrupt building operations?

It can if rules are enforced before the real traffic flows are known. Map required flows with the BMS contractor, migrate in stages, and keep a rollback plan. Done this way, segmentation should not change how the building runs.

Who should own BMS network segmentation, IT or facilities?

Both, with clear roles. IT usually manages the network and firewall policy, while facilities or the BMS contractor understand the required flows. The NCSC highlights the need to align IT and OT risk management so that policies apply consistently.

How often should segmentation be reviewed?

Review it whenever the building, tenants, suppliers or systems change, and on a regular audit cycle. Keep the architecture record and change log current so each review starts from accurate information.

Sources

• NCSC: Operational Technology, secure connectivity principle on segmentation
• NCSC: Secure connectivity principles for Operational Technology
• NCSC: Creating and maintaining a definitive view of your operational technology architecture
• NCSC: CNI system design, secure remote access
• NPSA: Adopting a security-minded approach to building automation and control systems
• NPSA: Network Connected Security Technologies (NCST) guidance
• Energy Technology List: Building Energy Management Systems
• IET: Code of Practice for Cyber Security in the Built Environment
• Schneider Electric: Guidance on implementing a cybersecure BMS architecture

Recommended

• BACnet Secure Networks: Segmentation, BACnet/SC and Controls
• OT network segmentation for cybersecurity and OT teams
• PCI network segmentation: how to make it count for assessors
• Secure network architecture: a practical guide for IT leaders