BAS Cybersecurity Hardening Acceptance Checklist

It covers the controls that should be verified before a building automation system is handed over to the owner. The checklist walks through account hardening, network segmentation, firmware and patch baseline, remote access controls, and turnover documentation. It is designed to capture observable acceptance evidence, not just a general security review.

Use it at commissioning, substantial completion, or any owner turnover event where the BAS/BMS is being accepted into service. It also works well after a major controls upgrade, controller replacement, or remote access change. If the system is already in operation, it can be used as a baseline hardening audit, but it is written for acceptance.

A commissioning agent, controls integrator, BAS technician, or cybersecurity-aware facilities representative can complete it, with the owner’s responsible contact reviewing the results. The best practice is to have the person verifying the controls also confirm the evidence, such as screenshots, network diagrams, and account lists. For critical items, the owner or commissioning lead should sign off on any exceptions.

It aligns with common cybersecurity and building-systems expectations from owner specifications, ANSI/ASSP-style risk management practices, and general security guidance used in industrial and facility environments. It is not tied to one mandatory code section, because BAS cybersecurity acceptance is usually driven by project requirements, owner standards, and vendor hardening guidance. If your site has a formal cybersecurity program, this checklist can be adapted to match it.

The most common issues are unchanged vendor passwords, shared admin accounts, flat networks with no segmentation, and remote access paths that bypass the intended jump host or VPN controls. Teams also miss outdated firmware, open unused services, and undocumented firewall rules. Another frequent gap is turnover documentation that does not match the actual installed topology.

At minimum, review it at turnover and again after any major BAS change, firmware update, or remote access modification. Many owners also re-run it on a scheduled basis, such as annually or during periodic facilities audits, to confirm the baseline has not drifted. If the system supports critical operations, review frequency should be tied to risk and change activity.

Yes. It is meant to be adapted for the specific BAS/BMS vendor, controller family, and site architecture. You can add platform-specific items for Niagara, BACnet, Modbus gateways, cloud portals, or proprietary front-end servers, while keeping the same acceptance structure. The key is to preserve the observable evidence fields and the deficiency tracking.

This checklist is focused on building automation acceptance, where controllers, field devices, vendor access, and lifecycle constraints are different from standard office IT. It checks items like firmware baselines, remote vendor paths, and BAS network topology that general IT forms often miss. It is intended to confirm the BAS is hardened enough for turnover, not to replace enterprise cybersecurity governance.

Attach the current network diagram, approved firmware baseline, account or access list, remote access method description, and any screenshots or logs that prove the control is in place. If there are deficiencies, include corrective action notes and target closeout dates. Those attachments make the acceptance record usable later during audits, incidents, or warranty reviews.