Building automation and control systems (BACS) are the control networks that manage facility functions such as heating, ventilation, air conditioning, lighting, alarms, and other building services. They sit in the operational technology layer, where software and controllers interact with physical equipment rather than just storing data. Because BACS often connect to enterprise networks or remote management tools, they can become a target for attackers looking to disrupt operations, change environmental settings, or use the systems as a foothold into a wider network.
BACS matter in cyber security because compromises can affect availability, comfort, safety, and in some cases critical physical processes. Common defenses include asset inventory, segmentation, strong authentication, patching where feasible, and close monitoring of controllers and supervisory software. In real attacks, BACS weaknesses may be exploited through exposed remote access, default credentials, vulnerable web interfaces, or misconfigured network paths. A practical security baseline helps operators reduce risk without breaking the reliability that buildings depend on.