BMS

What is a BMS?

A BMS (Building Management System) is the central software that a facility manager uses to monitor, operate, log and optimise the technical installations of a building from a single place. The BMS is the top layer of building automation: the control loops themselves run in controllers throughout the building, while the BMS provides the overview, alarms, trends and reports. Typical installations under a BMS include:

• HVAC (heating, ventilation, air conditioning)
• Lighting and solar shading
• Security and access control
• Energy management and metering
• Fire detection and alarming

BMS systems deliver comfort, safety and energy efficiency in offices, hospitals, airports, data centres and industrial facilities. Because a modern BMS runs on the IP network and talks to office systems and the cloud, it is also a full OT system that deserves attention within OT convergence.

🧠 What does a BMS do?

A BMS has five core tasks that closely resemble those of SCADA, but applied to buildings:

• Real-time monitoring - shows the current state of air handling units, pumps, boilers, chillers and rooms
• Central operation and visualisation - through an HMI with floor plans and plant schematics; the operator changes setpoints and time schedules
• Alarm handling - prioritised fault notifications, forwarded to the on-call service by email, text message or app, following the principles of alarm management
• Historical data storage - trend logs of temperatures, positions and consumption for analysis and handling complaints
• Energy management - logging, comparing and reporting consumption, and shaving peaks

Note the difference in the last column. A fire alarm system and an intrusion alarm system are separate, certified systems (in the Netherlands, fire alarm systems follow NEN 2535). The BMS may monitor them and can, for example, show the ventilation in fire mode, but the safety function must never depend on the BMS. Likewise, the voice or evacuation alarm system (NEN 2575 in the Netherlands) and fire controls such as closing fire dampers are driven by the fire alarm system, not by the BMS.

🔧 How is a BMS structured?

A BMS consists of software and servers on top of a network of controllers. The common breakdown:

📡 A BMS communicates with field equipment and controllers via protocols such as BACnet, Modbus, KNX, LON, DALI or M-Bus.

BACnet has been ANSI/ASHRAE Standard 135 since 1995 and ISO 16484-5 since 2003. The standard defines device profiles, so a specification can state exactly what is needed: a B-AWS (Advanced Workstation) or B-OWS (Operator Workstation) for the BMS software, a B-BC (Building Controller) for programmable controllers and a B-ASC (Application Specific Controller) for, say, a room-level terminal unit controller. Products carrying the BTL mark from BACnet Testing Laboratories have been independently tested for conformance and interoperability. A key design principle: the control loops run in the controllers and keep working if the BMS server fails.

🔄 What is the difference between a BMS, GACS, EMS and SCADA?

These terms are often used interchangeably. The distinction:

On industrial sites a BMS and SCADA often run side by side: SCADA controls production, while the BMS handles the climate of halls, offices, cleanrooms and server rooms.

🏭 Which BMS platforms will you come across in practice?

The building management market is dominated by a handful of large vendors, complemented by integrators who build on open platforms:

• Siemens - Desigo CC as the management platform above Desigo controllers
• Johnson Controls - Metasys, widely used in large commercial buildings and healthcare
• Honeywell - its own building management products and, through its subsidiary Tridium, the Niagara Framework, an open integration platform used by many smaller manufacturers and integrators
• Schneider Electric - EcoStruxure Building Operation
• Priva - Dutch manufacturer of climate and building management systems, traditionally strong in horticulture and commercial buildings

Vendor choice shapes building operation for many years. A closed system with proprietary protocols and licences makes you dependent on a single installer. Ask for open protocols, BTL-certified products, handover of all passwords, the source code of control programs and a complete documentation set at handover.

🌐 How does a BMS integrate with OT and IT?

A modern BMS exchanges data with other systems:

• SCADA systems - for a single plant-level overview
• MES or ERP - energy use per production order or cost centre, and maintenance management
• Historians - long-term storage of sensor data alongside process data
• Cloud platforms - energy analytics, fault detection and diagnostics, and predictive maintenance, often via MQTT or OPC UA
• Digital twins - a virtual model of the building and its installations

A practical problem with these integrations is the naming of data points: every installer uses its own codes. Open initiatives such as Project Haystack (semantic tagging) and Brick (an ontology for building assets and their relationships) standardise that description, so analytics software can recognise points automatically.

The pharmaceutical industry adds an extra separation. The BMS controls the cleanroom climate, but the GMP-relevant monitoring of temperature, humidity, differential pressure and particles is often done in a separate, validated environmental monitoring system following GAMP 5. That way the whole BMS does not need to be validated.

Every integration is a conduit between zones in the zones and conduits model. Record which data flows in which direction and, where possible, choose one-way traffic upwards.

🧭 How do you specify and manage a BMS?

A BMS only delivers value when it is specified properly and then actively managed. The systems a BMS controls account for a large share of energy use: US research estimates about 40% of building consumption, and close to 70% when lighting is included. A badly tuned BMS therefore costs money directly. A practical approach:

1. Check legal requirements - in the Netherlands, non-residential buildings with a heating or air-conditioning capacity above 290 kW have had a GACS obligation under the Buildings Decree (Besluit bouwwerken leefomgeving) since 1 January 2026, extending to systems above 70 kW from 1 January 2030. This follows from the EU Energy Performance of Buildings Directive. The system must continuously monitor, log and analyse energy use; NEN-EN-ISO 52120-1 provides the energy classes A to D as the yardstick.
2. Create a points list and naming convention - record per installation which measurement, control and alarm points the BMS receives and what they are called.
3. Require open protocols - specify BACnet device profiles, BTL certification and BACnet/SC where possible.
4. Secure ownership - administrator rights, licences, control software and documentation belong to the building owner, not the installer.
5. Design an alarm philosophy - only alarms that require someone to act, each with a priority and an owner.
6. Test at handover - verify functions, alarms and integrations in a FAT and SAT, and record the configured values.
7. Manage actively - review trends and energy reports periodically; control performance drifts over time through refurbishments, manual overrides and replaced components.

🔐 How do you secure a BMS?

A BMS is attractive to attackers: it runs on standard servers, often has a web interface and a permanent connection for the installer. In 2019 researchers Gjoko Krstic and Sipke Mellema published more than a hundred vulnerabilities in various BMS and access control products, and CISA regularly issues advisories for building management software from major vendors. The best-known incident remains the 2013 breach at US retailer Target, where attackers got in using credentials of an HVAC supplier. Measures:

• Defense in Depth - multiple layers instead of a single barrier
• Segmentation - the BMS in its own zone with VLANs and firewalls, separated from office IT and production
• No direct internet access - check for internet exposure of web interfaces and BACnet ports
• Managed supplier access - remote access via VPN with MFA and logging instead of a permanent connection
• Patching and hardening - include the BMS server and clients in patch management and replace default passwords
• Secure protocols - BACnet/SC (encrypted with TLS), KNX Secure and products certified to IEC 62443-4-2

If the organisation falls under the Dutch Cybersecurity Act, in force since 15 August 2026, the BMS is covered by the duty of care as soon as the service depends on it, as in hospitals and data centres.

❓ Frequently asked questions

What is the difference between a BMS and building automation?

Building automation covers the entire system of sensors, controllers, networks and software that controls building installations automatically. A BMS is its top layer: the management software for monitoring, operation, alarms and reporting. The control loops run in the controllers and keep working if the BMS fails.

Is a BMS mandatory in the Netherlands?

A BMS as such is not mandatory, but non-residential buildings with a heating or air-conditioning capacity above 290 kW have needed a building automation and control system (GACS) since 1 January 2026. From 1 January 2030 the threshold drops to 70 kW. In practice, a BMS with energy monitoring fulfils that GACS role.

Which protocols does a BMS use?

A BMS mainly uses BACnet to connect to HVAC controllers, usually as BACnet/IP over the building network. KNX and DALI are also common for lighting, M-Bus and Modbus for meters, and LON in older installations. For integration with the cloud and IT, MQTT, OPC UA and REST APIs are increasingly used.

Does a BMS control the fire alarm system?

A BMS does not control the fire alarm system, but receives its alarms and shows its status. The fire alarm system is a separate, certified system (NEN 2535 in the Netherlands) that independently operates fire dampers and evacuation. This keeps fire safety intact if the BMS or the network fails.

Why is a BMS a cyber risk?

A BMS is a cyber risk because it runs on standard IT servers, usually has a web interface and is often permanently reachable remotely by installers. An attacker can use the BMS to disrupt climate and access or to move on into the office network. Segmentation, managed supplier access and patching reduce that risk considerably.

What does it cost to manage a BMS properly?

The cost of managing a BMS depends on building size and contract type, but the largest cost is often a badly tuned system. The installations under a BMS use most of a building’s energy, so control loops that drift or remain in manual override waste a lot of energy every year. Periodic trend analysis and a maintenance contract with performance requirements are therefore often cheaper than letting that waste continue.

📌 In summary

A BMS is the management software on top of building automation: it monitors and operates HVAC, lighting and energy, and shows alarms from security and fire detection, all from one place. It communicates through open protocols such as BACnet, KNX and M-Bus, integrates with SCADA, MES, historians and the cloud, and helps commercial buildings meet the GACS obligation. Because it runs on the network, it deserves the same segmentation, access control and patching as any other OT system.

A BMS is the central nervous system of a smart building: specify it openly, manage it actively and secure it as an OT system, and you gain comfort, safety and energy savings without opening a new door for attackers.