If you’ve worked in building automation for very long, you’ve probably seen a conversation like this unfold. 

The IT department wants to tighten network security. The facilities team worries that a new security policy could interrupt building operations. The system integrator is somewhere in the middle, trying to explain why the controller that has worked flawlessly for fifteen years may not behave like the servers sitting down the hall in the data center. 

Nobody in the room is trying to create a problem. In fact, everyone is working toward the same goal: protecting the organization. 

So why do these conversations sometimes feel like everyone is speaking a different language? 

The answer has less to do with cybersecurity than it does with perspective. 

For decades, IT and operational technology developed along separate paths. IT systems were built to manage information. Building automation systems were built to manage physical environments. Today those worlds are increasingly connected, but they haven’t suddenly become the same thing. Each still carries different priorities, different constraints, and different definitions of what success looks like. 

Understanding those differences is one of the most important steps an organization can take toward building a stronger cybersecurity strategy. 

It’s Easy to Assume Every Network Works the Same Way 

The more connected our buildings become, the easier it is to think of building automation as simply another network that should follow the same cybersecurity playbook as everything else. 

After all, today’s BAS often communicates over IP networks, exchanges data with enterprise applications, supports remote access, and connects to cloud-based services. From a distance, it can look remarkably similar to other business systems. 

But once you move beyond the network diagram, the similarities begin to fade. 

A file server exists to store information. An email server exists to move information. Even if one of those systems goes offline unexpectedly, business may slow down, but the physical environment around us usually doesn’t change. 

Building automation is different. 

The network isn’t simply carrying information from one place to another. It’s helping maintain temperatures in patient rooms, managing ventilation in laboratories, controlling humidity in museums, and keeping occupants comfortable in schools, offices, airports, and manufacturing facilities. Every command sent across that network has the potential to affect something tangible in the real world. 

That’s why cybersecurity decisions in OT often carry operational consequences that don’t exist in traditional IT environments. 

Different Priorities Don’t Mean Lower Standards 

One of the biggest misconceptions about OT cybersecurity is that it’s simply “behind” IT cybersecurity. 

In reality, it’s solving a different problem. 

Imagine a hospital where an IT team schedules a routine security update for overnight hours. On most business systems, that’s a perfectly reasonable maintenance window. But what if that same update unexpectedly disrupts communications with equipment responsible for maintaining airflow in operating rooms or isolation areas? Suddenly, the question isn’t just whether the network is secure. It’s whether the building can continue operating safely while that security work takes place. 

That’s why the building automation industry often talks about cybersecurity through a framework known as S/AIC: Safety, Availability, Integrity, and Confidentiality. Traditional IT security has long emphasized confidentiality because protecting information is its primary mission. OT certainly cares about protecting information too, but it begins by asking a different question: How do we keep the systems people depend on operating safely and reliably? Only then do we work outward to the other elements of security. 

That shift in perspective doesn’t lower the standard for cybersecurity. If anything, it raises it. The challenge isn’t simply preventing unauthorized access; it’s strengthening security without compromising the very systems you’re trying to protect. 

Where the Best Cybersecurity Programs Get It Right 

The organizations making the most progress in BAS cybersecurity have discovered that the solution isn’t asking IT to think like facilities—or asking facilities to think like IT. 

It’s getting both groups to understand each other’s priorities. 

IT brings deep expertise in identity management, governance, monitoring, and network architecture. Facilities teams and system integrators understand how buildings actually operate, where the operational risks exist, and why certain changes require careful planning and testing before they’re introduced into a live environment. 

When those perspectives come together early, the conversation changes. 

Instead of arguing over whether a security recommendation is “right,” teams begin asking better questions. 

• • Who owns remote access to the BAS? 

• • How will new devices be approved before they’re connected? 

• • Who maintains network diagrams and system inventories? 

If something unusual happens at two o’clock on a Saturday morning, who responds first—and how will they know whether they’re dealing with an equipment failure or a cybersecurity event? 

Those aren’t glamorous questions, but they’re often the ones that determine how resilient an organization will be when something eventually goes wrong. Technology is only part of the equation. Clear ownership, good communication, and shared expectations are what allow technology to do its job. 

Building Resilience Instead of Choosing Sides 

Perhaps the most encouraging thing about the growing focus on OT cybersecurity is that it has changed the conversation. 

A few years ago, discussions often centered on whether IT or facilities should “own” building automation security. 

Today, more organizations recognize that neither group can do it alone. 

As buildings become smarter, more connected, and more integrated with enterprise systems, cybersecurity becomes a shared responsibility. IT provides essential expertise in securing networks and managing digital risk. Facilities and OT professionals provide equally essential expertise in keeping buildings operating safely and reliably. 

The strongest cybersecurity programs don’t force one discipline to adopt the other’s priorities. 

They build a common understanding of why both perspectives matter. 

That’s ultimately what the S/AIC framework is trying to accomplish. It reminds us that cybersecurity isn’t just about protecting data or preventing intrusions. In building automation, it’s about protecting the people, spaces, and operations that depend on those systems every day. 

Ready to strengthen your BAS security? 

Understanding the difference between IT and OT priorities is one of the first steps toward building a more resilient building automation system. 

Download the full white paper, S/AIC: Balancing Safety & Availability of Operational Technology, to explore the S/AIC framework in greater depth and learn practical ways to align cybersecurity with the operational realities of today’s buildings. 

If you’d like help evaluating your building automation cybersecurity posture, KMC Secure Connected Solutions provides practical assessments, guidance, and recommendations tailored to your building and operational needs. Whether you’re beginning to address cybersecurity or planning a broader OT security strategy, our team can help you understand your current risks and identify practical next steps. 

Learn more about KMC Secure Connected Solutions or contact KMC Controls to start the conversation.