GRCLibrary.ai

Annex

Building Management Systems (BMS) Overlay Annex

This annex provides BMS-specific security considerations that overlay the OT/ICS Security Standard (operations/ot/standard-ot-ics-security.md). BMS are a subset of OT and are governed by that standard; this annex identifies where BMS environments need additional or differentiated controls due to life-safety integration, tenant impact, regulatory authority oversight, and the characteristic vendor and integration patterns of modern smart-building deployments.

Type
Annex
Version
1.0.4
Date
2026-10-27
Owner
Chief Information Security Officer
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
Operations: Operational Technology
Review frequency
Annual and upon material change to ISO 16484, ASHRAE 135 (BACnet), IEC 62443, or applicable fire and life-safety codes
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • 1. Purpose
  • 2. Scope
  • 3. Why BMS differs from process-control OT
  • 4. Life-safety integration
  • 5. Authority Having Jurisdiction (AHJ) coordination
  • 6. BMS protocol governance
  • 7. Multi-vendor coordination
  • 8. Tenant and occupancy data
  • 9. Smart-building cloud integration
  • 10. Asset, change, and incident overlay specifics
  • 11. Framework alignment
  • 12. Cross-reference summary

Frameworks it maps to

Related documents