The Steward Blueprint
Life Safety Traceability + Proactive Planning · Donnie Moore, FMP
We spend years hardening the front door and forget the building has a nervous system.
This week two stories landed almost on top of each other. Researchers at Claroty reported that nearly 90% of the building management systems running data centers still communicate over insecure, decades-old protocols. That same week, authorities opened an investigation into a coordinated cyberattack against water utilities in Minnesota. Different buildings, different scale, but the same uncomfortable lesson underneath both: the systems that keep our facilities running are on the network now, and most of us have never treated them like it.
For a long time, building automation lived in a comfortable blind spot. The HVAC controller, the access panel, the fire alarm network, the camera system — these were “back of house.” Mechanical. Somebody else’s department. We locked the server room and called our technology secured. But over the last decade every one of those systems quietly grew an IP address. The controller that runs your rooftop unit is a computer. The panel that unlocks your doors at 7 a.m. is a computer. And the moment a life-safety function depends on one of those devices, the security of that device stops being an IT footnote and becomes a life-safety issue.
Here’s the part I want my fellow facilities leaders to sit with: this is not a data-center problem. It is easy to read a headline about hyperscale server farms and decide it doesn’t apply to a church, a school, a clinic, or a small commercial campus. It applies more, not less. The organizations most exposed are the ones running lean — the ones where the building systems were installed by whoever had the low bid, where nobody is quite sure what firmware is on the access controllers, where the “building network” and the guest Wi-Fi may well be the same flat network because that’s how it got set up years ago and it worked.
Your emergency plan quietly depends on those systems. If your access control goes dark, can you still lock down or evacuate the way your plan assumes? If your fire alarm network is compromised or offline, what’s your fallback? We write beautiful life-safety documentation and then hang it on infrastructure we’ve never actually inventoried. That gap is the risk.
So what does good stewardship look like this week? Not panic, and not a five-figure security contract you can’t justify to leadership. It starts with three honest questions.
First: do we have an inventory of every networked building system — with an owner, the firmware version, and the date it was last updated? You cannot protect what you have never listed. This one document is the foundation, and most facilities don’t have it.
Second: is our building network actually separated from guest Wi-Fi and general office traffic? Segmentation is the single highest-value, lowest-drama step most of us can take. If a controller is sitting on the same network a visitor joins to check email, that’s the conversation to have with IT this month.
Third: if a controller failed at 2 a.m., who gets the call — and is that written down? Not “someone would figure it out.” An actual name, an actual number, an actual documented path. If the answer lives only in your head, it isn’t a plan. It’s a hope.
None of that requires you to become a cybersecurity expert. It requires you to extend the discipline you already practice — documentation, traceability, knowing where your proof lives — into a part of the building we’ve historically ignored. That’s the whole job, really. Stewardship isn’t just locks and lights anymore. It’s knowing what’s on your network and being able to prove it, the same way you’d prove your fire extinguisher inspections or your electrical maintenance records.
The buildings got smarter. Our accountability for them has to keep up.
So I’ll ask you what I’m asking myself: what’s on your network — and could you show me the list today?
— Donnie Moore – FMP – MaintenanceOps App – Strategy | Stewardship | Facilities Leadership
Stay excellent. Stay humble. Keep building