NIST Publishes New Guidance for BACS Security

Executive Summary

On August 19, 2026, the U.S. National Institute of Standards and Technology (NIST) published new resources designed to improve the cybersecurity of Building Automation and Control Systems (BACS). Recognizing that these critical Operational Technology (OT) systems are increasingly connected to IT networks and the cloud, NIST has provided practical, quick-start guidance for owners and operators, particularly those with limited resources. The recommendations focus on fundamental security hygiene to defend against common cyber threats, including ransomware and unauthorized access, and are part of NIST's broader effort to secure OT environments.

Regulatory Details

The new resources, including a quick-start infographic, are not regulations but are authoritative guidance intended to establish a baseline of security for BACS. These systems control essential building functions such as HVAC, lighting, physical access control, and fire suppression systems. The guidance complements other NIST frameworks, including the Cybersecurity Framework and SP 800-82, "Guide to Operational Technology (OT) Security."

Affected Organizations

This guidance is intended for a broad audience, including:

• Commercial building owners and managers
• Federal, state, and local government facility managers
• Hospitals, universities, and other large campus environments
• Third-party service providers who manage and maintain BACS

Compliance Requirements

While adherence to this specific guidance is voluntary, it represents industry best practice and may be incorporated into future contracts, regulations, or compliance frameworks. The recommendations provide a clear roadmap for organizations to demonstrate due care in protecting their facilities and the people within them.

Key Areas of Guidance:

• System Hardening: Disable unnecessary services like FTP and Telnet, close unused network ports, and update firmware.
• Access Control: Implement role-based access control (RBAC) and the principle of least privilege. Eliminate shared accounts and require multi-factor authentication (MFA) for all remote access.
• Network Security: Physically secure network closets and unused ports. Log all remote access sessions and enable remote connectivity only when actively needed.
• Resilience: Regularly back up BACS configurations and data, storing copies offline and testing recovery procedures.

Implementation Timeline

Organizations are encouraged to implement these recommendations as soon as possible. The guidance is structured to allow for incremental improvements, starting with low-cost, high-impact actions. Facility managers can use the infographic as a checklist to begin hardening their systems immediately.

Impact Assessment

The increasing connectivity of BACS has expanded their attack surface, making them a target for threat actors. A successful attack on a BACS could lead to physical safety risks (e.g., disabling fire alarms), operational disruption (e.g., HVAC failure), unauthorized physical access, and could serve as a pivot point into the corporate IT network. By providing accessible guidance, NIST aims to raise the security posture of a critical but often overlooked area of OT, reducing risk for countless organizations.

Compliance Guidance

To align with the NIST guidance, BACS operators should take the following steps:

1. Inventory Assets: Create a complete inventory of all BACS devices, their network connections, and software/firmware versions.
2. Conduct a Risk Assessment: Identify the most critical systems and prioritize security controls based on impact and likelihood of an attack.
3. Develop a Hardening Plan: Use the NIST infographic as a guide to create a plan for disabling unused services, strengthening access controls, and segmenting the network.
4. Establish a Backup and Recovery Strategy: Define procedures for backing up critical BACS data and configurations and ensure these backups are stored offline and tested regularly.