Introduction

Modern data centres rely on complex operational technology (OT) environments to maintain the physical conditions required for reliable and continuous operation. While traditional cybersecurity programmes often concentrate on servers, applications, endpoints, and corporate networks, the systems controlling the physical environment can also represent an important part of the overall attack surface.

Building Management Systems (BMS) are central to this environment. They can monitor and control cooling, HVAC, temperature, humidity, environmental sensors, alarms, air handling, and other building functions. Increasingly, BMS platforms are connected to enterprise networks, remote-access solutions, cloud platforms, engineering workstations, vendors, and other operational systems.

This connectivity can create cybersecurity risks.

An attacker who gains unauthorised access to a BMS could potentially interfere with monitoring or control functions, exploit connected systems, or use the BMS environment as a pathway toward other networked assets.

The NIS2 Directive includes data centre service providers within the digital infrastructure sector. For relevant entities, Commission Implementing Regulation (EU) establishes technical and methodological requirements for cybersecurity risk-management measures.

An OT cybersecurity assessment based on NIS2 requirements can help organisations identify weaknesses within BMS environments and understand how those weaknesses may affect data centre security, availability, and resilience.

NIS2 Requirements and Data Centre OT Security

The NIS 2 Directive establishes measures intended to achieve a high common level of cybersecurity across the European Union.

For the digital infrastructure entities covered by the relevant provisions, Commission Implementing Regulation (EU) provides more detailed technical and methodological requirements for cybersecurity risk management. Data centre service providers are expressly included among the relevant entities covered by the regulation.

The requirements cover areas including:

• Risk analysis and information-system security
• Incident handling
• Business continuity and crisis management
• Supply-chain security
• Vulnerability handling
• Security in the acquisition, development, and maintenance of network and information systems
• Access control
• Cryptography and encryption where appropriate
• Multi-factor authentication
• Secure communications

The regulation also establishes criteria for determining when incidents involving data centre services are considered significant. These include complete unavailability of a data centre service, availability limitations exceeding one hour, certain compromises affecting the integrity, confidentiality, or authenticity of relevant data, and compromised physical access.

For data centre operators, OT and BMS security can therefore form an important part of a wider cyber-risk management strategy.

Why OT Cybersecurity Assessment Matters for Data Centre BMS

1. BMS Is Part of the Operational Attack Surface

BMS environments can contain a combination of IT and OT technologies, including:

• BMS servers
• Engineering workstations
• Programmable controllers
• Sensors and actuators
• Network gateways
• HVAC systems
• Environmental monitoring systems
• Web interfaces
• Remote-management platforms
• Third-party integrations

Each connected component can introduce potential security weaknesses.

An OT cybersecurity assessment provides visibility into these technologies and helps identify areas requiring additional protection.

2. Protect Critical Environmental Controls

Data centre operations depend on maintaining appropriate environmental conditions.

BMS platforms may monitor or control:

• Temperature
• Humidity
• Cooling systems
• HVAC
• Air handling
• Environmental alarms
• Facility equipment
• Monitoring sensors

A cybersecurity compromise affecting these systems could potentially have operational consequences.

Assessment activities can determine whether unauthorised users could gain access to control functions or manipulate information used by facility teams.

3. Identify IT-to-OT Security Risks

The boundary between corporate IT and operational technology is an important consideration.

A simplified architecture may look like:

Corporate IT → Firewall / DMZ → BMS Network → Controllers → Sensors & Building Equipment

If security controls between these environments are insufficient, an attacker compromising an IT system could potentially attempt to reach OT systems.

An OT cybersecurity assessment can examine:

• Network segmentation
• Firewall configurations
• Communication pathways
• Trust relationships
• Exposed services
• Remote-access routes
• Inter-system dependencies

4. Evaluate Remote and Vendor Access

BMS maintenance may involve internal administrators, facility-management teams, system integrators, and equipment vendors.

Remote connectivity can include:

• VPN
• Remote desktop
• Web portals
• Vendor support platforms
• Cloud management systems
• Engineering applications

The assessment can review whether remote access is appropriately restricted and protected through authentication, authorisation, privileged-access controls, and secure communication.

Supply-chain security is also relevant because NIS2-related implementing requirements address cybersecurity considerations involving suppliers and service providers.

5. Discover Vulnerabilities in Legacy OT Components

Unlike conventional IT systems, some OT and BMS environments may contain equipment with long operational lifecycles.

Older systems can introduce challenges involving:

• Unsupported operating systems
• Legacy protocols
• Older firmware
• Limited authentication
• Insecure services
• Difficulty applying patches
• Vendor dependencies

An assessment can help identify these weaknesses and provide risk-based recommendations that take operational constraints into account.

Our OT Cybersecurity Assessment Methodology

OT security testing requires a different approach from conventional IT assessments because the systems may interact directly with physical equipment.

Testing should therefore be carefully scoped and aligned with operational requirements and approved rules of engagement.

1. Scope and Asset Discovery

The first stage establishes the BMS and OT environment under assessment.

Potential assets include:

• BMS servers
• Controllers
• Engineering workstations
• Network devices
• Gateways
• Sensors
• Remote-access systems
• Management interfaces
• Connected facility systems
• Supporting infrastructure

Asset identification helps establish the attack surface and critical system dependencies.

2. OT Architecture Review

The architecture is reviewed to understand how different systems communicate.

The assessment can examine:

• IT-to-OT connections
• BMS network segmentation
• Controller communication
• Engineering workstation access
• Vendor connections
• Internet-facing components
• Cloud connectivity
• Third-party integrations

This helps identify unnecessary connectivity and potential attack paths.

3. Vulnerability Assessment

A controlled vulnerability assessment can identify weaknesses across systems within the approved scope.

Assessment activities may include:

• Asset discovery
• Service identification
• Vulnerability identification
• Firmware and software review
• Configuration assessment
• Authentication review
• Exposure analysis

Findings can be prioritised according to severity, exploitability, asset criticality, and potential operational impact.

4. Controlled Penetration Testing

Where explicitly authorised and technically appropriate, penetration testing can validate selected vulnerabilities.

Potential testing areas include:

• Authentication
• Authorisation
• Privilege escalation
• Network exposure
• Remote access
• Web interfaces
• Segmentation controls
• Lateral movement pathways

For live BMS environments, testing should be carefully controlled to reduce the risk of affecting operational systems.

5. BMS Security Assessment

The BMS layer can be assessed for security weaknesses affecting management applications and control interfaces.

This may include reviewing:

• User roles
• Administrative privileges
• BMS application security
• Engineering access
• Management interfaces
• Authentication mechanisms
• Logging and monitoring
• Communication security

The objective is to understand whether unauthorised users could gain access to functions that should be restricted.

6. Network Segmentation Assessment

Segmentation is an important consideration for environments combining IT and OT.

The assessment can examine whether:

• BMS networks are appropriately isolated
• Firewall rules restrict unnecessary traffic
• Administrative systems have appropriate access
• Vendor connections are controlled
• OT systems are unnecessarily exposed
• Communication between network zones is adequately restricted

This can help reduce the potential impact of a compromise.

7. Configuration and Access-Control Review

Security configurations can be examined across relevant BMS and OT infrastructure.

Areas may include:

• User accounts
• Privileged accounts
• Password policies
• Remote access
• Firewall rules
• System hardening
• Logging
• Monitoring
• Backup mechanisms
• Access permissions

8. Risk-Based Reporting and Remediation

The final assessment report should translate technical findings into actionable security information.

Each finding can include:

• Affected asset
• Vulnerability or weakness
• Technical evidence
• Severity
• Potential operational impact
• Risk context
• Recommended remediation

Following remediation, retesting can help determine whether identified weaknesses have been addressed.

Cyberintelsys OT Security Services

Cyberintelsys supports organisations with cybersecurity assessments across OT, BMS, networks, infrastructure, applications, and connected systems.

1. OT Security Testing

OT Security Testing can help organisations identify vulnerabilities and security weaknesses across operational technology environments.

For data centre BMS environments, assessment areas can include:

• OT network architecture
• BMS infrastructure
• Controllers and gateways
• Remote-access pathways
• Security configurations
• Network segmentation
• Connected operational systems

2. ICS / SCADA Security Assessment

Where a data centre environment incorporates industrial control or SCADA technologies, ICS / SCADA Security Assessment can provide additional security assessment coverage.

The assessment can help identify weaknesses in control-system architecture, access controls, network exposure, and supporting infrastructure.

3. Network Penetration Testing

Network Penetration Testing can assess the network infrastructure supporting BMS and OT environments.

Testing can help identify:

• Exposed services
• Weak network controls
• Segmentation weaknesses
• Insecure communication
• Unnecessary connectivity

4. Infrastructure VAPT

Infrastructure VAPT can assess servers, operating systems, network devices, and other infrastructure supporting the BMS environment.

5. Building Automation System Compliance Services

BMS platforms form part of the wider building automation ecosystem.

Building Automation System (BAS) Compliance Services can support organisations addressing security and compliance considerations associated with building automation systems.

6. IEC 62443 Compliance Services

For applicable industrial and OT environments, IEC 62443 can provide an additional cybersecurity framework for industrial automation and control systems.

Cyberintelsys offers IEC 62443 Compliance Services to support organisations with relevant OT security and compliance requirements.

Why Choose Cyberintelsys?

OT security requires an understanding of both cybersecurity and operational environments. A BMS assessment should therefore consider how technical vulnerabilities could interact with physical processes and critical data centre operations.

Cyberintelsys supports security testing across:

• OT environments
• Building automation systems
• Network infrastructure
• Infrastructure
• Web applications
• APIs
• Cloud environments
• Connected technologies

Cyberintelsys is a CREST-accredited cybersecurity company for Vulnerability Assessment (VA) and Penetration Testing (PT), delivering industry-recognized security testing services for organizations across multiple sectors.

Strengthen Data Centre BMS Security with OT Cybersecurity Assessment

Building Management Systems are increasingly interconnected with the digital and operational infrastructure of modern data centres. This connectivity makes OT security an important consideration for organisations seeking to improve resilience and address applicable cybersecurity requirements.

An OT cybersecurity assessment can provide visibility into vulnerabilities affecting BMS servers, controllers, network architecture, remote-access systems, engineering workstations, and connected operational technologies.

NIS2 applicability and specific obligations depend on the organisation, its activities, entity classification, and applicable national implementation. OT cybersecurity assessment should therefore be considered as one part of a broader security, resilience, and compliance programme.

Contact Cyberintelsys

Strengthen the security of your Data Centre Building Management Systems with an OT cybersecurity assessment for Data Centre Building Management Systems Under the NIS2 Directive.

From BMS and OT architecture to network segmentation, vulnerability management, remote access, and connected operational systems, a structured assessment can help identify weaknesses and support stronger cyber resilience.

Contact Cyberintelsys to discuss your Data Centre BMS OT cybersecurity assessment, NIS2 requirements, and security testing scope.