Data Center Critical-Facility Cybersecurity: Power, Cooling and BMS

01Key takeaways

1. 01

   Data center critical-facility OT covers the power chain (UPS, switchgear, generators, PDUs) and the cooling plant (CRAC/CRAH, chillers), tied together by DCIM, EPMS and BMS.

2. 02

   These systems speak industrial protocols such as Modbus, BACnet and SNMP that usually have no authentication, so reachability is the dominant risk.

3. 03

   The defining stake is uptime and thermal safety: a bad command to power or cooling can drop load or overheat a hall, not just expose data.

4. 04

   Segment the facility OT network into IEC 62443 zones, isolate the management plane, and remove inbound paths that exist only to pull telemetry into IT or DCIM.

5. 05

   Power and cooling telemetry usually needs to flow out to DCIM, monitoring and corporate dashboards, but those destinations rarely need a path back, which is where one-way transfer fits.

02What critical-facility OT means in a data center

Inside a data center, critical-facility OT is the set of control systems that keep the white space powered and cooled. It is distinct from the IT load it serves. The servers, switches and storage are the product; the facility OT is the life support. When people say a data center is "down," the cause is frequently a facility-side event rather than an IT-side one.

This layer breaks into three domains. The power chain moves utility or generator power through switchgear, uninterruptible power supplies (UPS), automatic transfer switches and power distribution units (PDUs) to the rack. The cooling plant rejects heat using computer room air handlers (CRAC/CRAH units), chillers, pumps and cooling towers. The management systems, DCIM, EPMS and BMS, monitor and coordinate the first two.

DCIM

Data Center Infrastructure Management. Tracks assets, capacity, power and environmental data across the facility, often bridging IT and facility domains.

EPMS

Electrical Power Monitoring System. Aggregates metering and status from switchgear, UPS and PDUs across the power chain.

BMS / BAS

Building Management System. Controls cooling, airflow, leak detection and environmental conditions, usually over BACnet or Modbus.

PLC and controller

Programmable logic controllers and unit controllers that execute the actual sequences of operation for chillers, pumps and switching.

03Why the stakes are different from IT or smart buildings

Most cybersecurity attention in a data center goes to the IT estate, where the worst case is usually a data breach or service outage that can be recovered from backups. Facility OT is different. Its failure modes are physical and immediate, and the design goal of the whole business, often expressed as Tier or availability targets, depends on it staying healthy.

A malicious or mistaken command can trip a UPS to bypass, open a breaker under load, or change a chiller setpoint so the hall overheats within minutes. High-density racks shrink the thermal margin further: a cooling interruption that was survivable a decade ago can now push servers past their limits before staff react. The consequence is not only downtime but possible equipment damage and safety risk to people working in switchrooms.

This is what separates data-center facility OT from generic smart-building OT: the same protocols and devices, but the load is mission-critical and the acceptable interruption can be measured in seconds, not hours. Uptime is the security objective, not an afterthought.

04How the facility network is actually built

The facility network usually sits parallel to the IT network and uses industrial protocols. UPS and PDUs commonly expose SNMP and Modbus/TCP. Switchgear and metering often speak Modbus or IEC 61850 in larger sites. Cooling and BMS devices typically use BACnet/IP or Modbus. These protocols were designed for reliability on trusted networks, not for authentication, so any device that can reach a controller can usually read and often write to it.

On top of that sits the management layer. DCIM and EPMS poll thousands of points for dashboards and capacity planning. BMS head-end stations run sequences of operation. Increasingly these head-ends connect upward to corporate networks, cloud monitoring, and vendor remote-support portals so a single team can watch a fleet of sites. Each of those upward links is a potential inbound path into the facility OT zone if it is not designed carefully.

The result is a network where a flat or loosely segmented design lets an attacker who lands on a BMS workstation or a remote-access jump host reach a UPS controller or a chiller PLC. The architecture, not any single device, is what determines blast radius.

05The threat picture for power and cooling

The realistic threats are a mix of targeted intrusion, ransomware spillover, and remote-access misuse. MITRE ATT&CK for ICS describes the relevant techniques in concrete terms: adversaries use Remote Services and exposed engineering interfaces for initial access, then Modify Parameter or Unauthorized Command Message to change setpoints, and Denial of Control or Loss of Availability to degrade the facility.

• Remote-support and vendor portals that reach the BMS or UPS fleet and become a standing inbound route.
• Ransomware crossing from a compromised corporate or DCIM network into flat facility segments.
• Unauthenticated Modbus or BACnet writes from any host that can reach a controller, changing a setpoint or breaker state.
• Internet-exposed BMS or DCIM web interfaces discoverable through scanning, with default or shared credentials.
• Engineering laptops and removable media that move between sites and carry malware into the facility zone.

Note the pattern: most of these depend on reachability into the facility OT zone. The telemetry the business needs almost always flows outward, but the network paths built to carry it frequently allow traffic back in. Closing that asymmetry is the highest-leverage move available.

06Practical controls that hold up under uptime pressure

The controls that work in a 24/7 facility are the ones that do not depend on patch windows that never come or on interrupting live load. Start with the network and the management plane, because those changes can be made without touching the critical equipment itself.

• Inventory every facility OT asset: UPS, switchgear, PDUs, chillers, CRAH units, controllers, BMS and DCIM servers, and the protocols each one speaks.
• Segment the facility OT network into zones (power, cooling, management) with controlled conduits between them and the IT side.
• Isolate the management and engineering plane so BMS and DCIM workstations cannot be reached directly from corporate or the internet.
• Eliminate standing vendor remote access; replace it with brokered, time-limited, monitored sessions that are off by default.
• Make outbound telemetry one-way wherever a destination only needs to read, removing the inbound path entirely.
• Log and monitor facility OT traffic for unexpected writes, new sessions, or commands outside maintenance windows.

Patching matters but is constrained, so compensating controls carry more weight here than in IT. A chiller controller may run for years between firmware updates; reducing what can reach it is more reliable than racing to patch it. This mirrors the guidance in NIST SP 800-82 Rev. 3, which treats exposure reduction and segmentation as primary OT controls rather than fallbacks.

07Standards and compliance mapping

No single standard targets data center facility OT specifically, so practitioners combine general OT and IT frameworks. The useful ones map cleanly onto the power, cooling and management domains.

NIST SP 800-82 Rev. 3

The reference for OT security. Drives the zone-based segmentation, least-functionality and monitoring approach used for power and cooling networks.

ISA/IEC 62443

Zones-and-conduits model and security levels. Directly applicable to separating power, cooling and management into defined zones with governed conduits.

NIST SP 800-53 / CSF 2.0

Control catalog and outcome framework used to express facility OT controls in the same language as enterprise IT governance.

Uptime Institute Tier and EN 50600

Availability and infrastructure design references. Not security standards, but they define the uptime obligations that security controls must not undermine.

For operators in scope of regulation such as the EU NIS2 directive, data centers above defined thresholds are treated as important or essential entities, which raises the bar for risk management, incident reporting and supply-chain assurance across both IT and facility systems. Mapping facility OT into the same governance as IT is no longer optional for these sites.

08Common pitfalls and false comfort

Several mistakes recur across data center programs. They share a theme: assuming the facility OT layer is either out of scope or already protected by the IT controls around it.

• Treating the BMS as "just a building system" and leaving it off the asset inventory and the risk register.
• Assuming an IT firewall at the corporate edge protects facility OT, while the BMS and DCIM sit on flat internal networks.
• Leaving vendor remote access permanently enabled because disabling it feels operationally risky.
• Believing redundant power and cooling (N+1, 2N) provides cyber resilience, when a logical command can affect redundant units at once.
• Connecting DCIM to cloud dashboards without confirming the link is read-only from the facility's perspective.
• Skipping monitoring on the facility network because "nothing ever talks to those devices," which is exactly why anomalies would be invisible.

Physical redundancy and cyber resilience are not the same thing. A second chiller does not help if one malicious BACnet write reaches both controllers through the same flat network.

09Where one-way transfer and exposure reduction fit

Look at how facility data actually needs to move. Power metering, environmental readings, alarms and capacity data flow out to DCIM, to monitoring platforms, to corporate dashboards, and increasingly to vendor analytics. In the overwhelming majority of these flows, the destination only needs to read. It does not need to command a UPS or change a chiller setpoint.

That asymmetry is exactly what one-way data flow is built for. A firewall can be configured to allow only outbound polling, but the path remains technically bidirectional and reversible by misconfiguration, credential theft or rule drift. Enforcing direction at the boundary removes the inbound route as an architectural fact rather than a policy promise. For the publication-only links between the facility OT zone and IT or cloud, one-way hardware enforcement can be evaluated alongside firewall segmentation and brokered remote access.

Exposure reduction is broader than any single device. Scheduled disconnection of links that are only needed periodically, strict segmentation between power and cooling zones, and keeping the management plane off routable corporate networks all shrink what an attacker can reach. A data diode is one control among these, best applied precisely where the data flow is genuinely one-way.

10A practical roadmap and closing thought

A workable program does not start with hardware. It starts with knowing the estate and shrinking the obvious exposure, then layering enforcement where the data flow justifies it. The sequence below keeps live load untouched while steadily reducing risk.

• Build and maintain a facility OT asset inventory across power, cooling and management, including protocols and external links.
• Map every connection that crosses the facility OT boundary and classify each as needing two-way, outbound-only, or no connectivity.
• Segment into IEC 62443 zones and isolate the BMS, DCIM and EPMS management plane.
• Replace standing remote access with brokered, monitored, default-off sessions.
• Convert publication-only flows to enforced one-way transfer and add monitoring for unexpected writes.
• Fold facility OT into incident response, change control and compliance reporting alongside IT.

The closing point is simple. A data center earns its reputation on uptime, and uptime now depends on the cyber health of the same power and cooling systems that have always defined the building. Treat that facility OT layer as critical infrastructure, reduce what can reach it, and make the safe direction of data flow a property of the architecture rather than a line in a firewall rule.

FAQFrequently asked questions

SRCSources of record