Cloud-hosted building software can improve accessibility, scalability and performance but it also changes the cyber-risk profile of a building.
Key considerations include:
- where data is stored
- who can access it
- how systems are authenticated
- how software is updated
- how incidents are detected and managed.
Project teams should also consider:
- network segregation
- encryption
- identity management
- backup and recovery
- vendor security practices
- service availability
- the interface between operational technology and corporate IT systems.
The biggest risks are poor configuration, unclear ownership or unmanaged connections between systems. Cybersecurity should be considered from the start, not added after the system is selected.
For buildings, this means aligning cloud software decisions with the broader ICT, security, BMS and smart building strategy.
