Building Cybersecurity Is a Procurement Problem, Not a Hiring One

Originally posted on Mann Report

Ask your facility manager how many vendors currently have remote access to your building. Most cannot answer. That is not negligence. The list was assembled one purchase order at a time over 15 years, and nobody has ever been asked to compile it.

A typical Class A property runs somewhere between eight and 15 connected systems — HVAC controls, access control, elevators, lighting, submetering, cameras, leak detection — each from a different vendor, and most with some form of remote connection for support.

That is your security posture. But resist the urge to call this a facilities failure. Every one of those systems was bought on operational criteria: because it worked, the price was competitive or simply because the incumbent had installed the last one.

Back then, security teams, where they existed, sat in an appendix nobody read. A building’s cyber exposure, in other words, is an accumulation of procurement decisions — not a lapse in operations.

This is why the industry’s current answer misdiagnoses the problem. The prevailing advice is to hire facility managers who also understand cybersecurity — professionals fluent in chiller sequences and in vendor remote access architecture.

Those people barely exist anymore, and the ones who do are employed and not applying to run your portfolio. You will not staff your way out of this.

The footprint keeps expanding regardless, for reasons unrelated to technology strategy. Local Law 97 compliance requires measurement. Measurement requires metering, which, in turn, requires connectivity.

Every decarbonization pathway adds connected equipment to the building, and owners are enlarging their attack surface for carbon reasons while booking it as a sustainability decision.

The federal government reached this problem first and at a greater scale. Its answer centered on specification rather than a hiring plan. Software that operates federal building systems must now meet FedRAMP High — the same security baseline applied to systems handling Controlled Unclassified Information (CUI).

This is no longer theoretical. KODE OS recently became the first smart building platform cleared to run federal buildings from the cloud at FedRAMP High — under a $14.55 million contract with the General Services Administration’s Public Buildings Service, now operating across 150 GSA-managed buildings in the National Capital Region.

The milestone means there is now a public, auditable definition of secure building software, one that anyone can point to.

And as a result, three things follow, none of which require a hire.

Inventory what’s remotely accessed: Every vendor, every connection, every credential, every system. Most owners cannot produce this list on request, and the inability to produce it is itself the finding. This is a week of work, and it will change what you do next.

Move security into procurement: Facility managers cannot fix what they did not buy. Security posture belongs in the request for proposal as a scored criterion alongside functionality and price, evaluated by the same people who evaluate everything else — again, a policy change issue rather than a staffing one.

Borrow the federal standard: You do not need to require FedRAMP High for a Class A office building, but you do need a defined benchmark you can reference rather than a security questionnaire you have to write yourself. The federal baseline is published, free and specific to exactly this problem.

There is a deeper point underneath all three. Every one of these disconnected systems is a separate door — its own vendor, its own remote connection, its own credentials no one is watching. Consolidating them onto a single, monitored, access-controlled building operating system does not just simplify operations; it shrinks the attack surface itself. That is the real security argument, and it is why the federal model centers on the platform, not the person.

None of this produces the multidimensional facility manager the industry keeps calling for. That professional is not arriving in sufficient numbers to matter, but what is available is the ability to buy differently — and building security has always been a procurement outcome anyway. Now, it’s finally being treated as one.