HVAC

What is HVAC?

HVAC (Heating, Ventilation and Air Conditioning) is the set of installations that heats, cools, refreshes, filters and humidifies or dehumidifies the air in a building or technical space, so that temperature, air quality and air pressure stay within defined limits. Where refrigeration plays a major role, such as in cold stores and freezer warehouses, the term HVAC-R is used. In Dutch building services, HVAC belongs to the mechanical (‘W’) installations, alongside plumbing and drainage.

In offices, HVAC is mainly about comfort and energy. In data centres, cleanrooms, hospitals and production halls it is a business-critical system: if cooling fails, servers shut down, a batch is lost or an operating theatre has to close. That is why HVAC is increasingly treated as OT that deserves the same protection as a production line.

🔧 What are the components of an HVAC installation?

An HVAC installation consists of generation, distribution, delivery and control:

A small installation has one controller per unit. In large buildings, dozens to hundreds of controllers report to a central building management system.

🧠 How is an HVAC installation controlled?

Most HVAC functions run as a closed control loop. A sensor measures, for example, the supply air temperature, the controller compares it with the setpoint, and a PID algorithm adjusts the control valve of the heating or cooling coil. Typical control functions are:

• Temperature control - per room or per zone, often with day, night and weekend schedules
• Demand-controlled ventilation - a CO₂ sensor determines how much outdoor air is needed, so an empty meeting room is not ventilated at full capacity
• Pressure control - fans keep duct pressure or the pressure difference between rooms constant
• Humidity control - humidifying in winter, dehumidifying in summer by cooling the air below its dew point and then reheating it
• Free cooling - using cold outdoor air or cold groundwater instead of the chiller

In buildings, the domain of building automation, this logic usually runs in DDC (direct digital control) controllers from vendors such as Siemens, Honeywell, Johnson Controls or Priva. In industry and in cleanrooms, control more often sits in a PLC connected to SCADA. The BMS, a Building Management System, collects alarms, trends and energy data and lets the operator change setpoints and schedules.

🏭 Where is HVAC business-critical?

In the pharmaceutical industry, HVAC is part of GMP validation. The revised EU GMP Annex 1 was published on 25 August 2022 and has applied since 25 August 2023. Adjacent rooms of different grades are normally kept at a pressure difference of at least 10 Pa, so that air flows from clean to less clean. In data centres, cooling is the largest energy consumer after the IT equipment itself; under the EU Energy Efficiency Directive, data centres with at least 500 kW of installed IT power must report indicators including their PUE every year. DCIM platforms therefore link cooling and power data to the IT load.

🔄 How does HVAC fit into the Purdue Model?

An HVAC installation maps well onto the Purdue Model, even though that model was originally designed for the process industry:

• Level 0 - sensors for temperature, CO₂, pressure and humidity, plus actuators such as valves, dampers and fans
• Level 1 - DDC controllers and PLCs that execute the control loops
• Level 2 - the BMS or SCADA system with operation, alarming and trends
• Level 3 and above - energy management, maintenance systems and the link with the office network

At levels 1 and 2, devices communicate through building protocols. BACnet (ASHRAE 135, also ISO 16484-5) is the main standard for HVAC; Modbus, KNX and LON are also common. BACnet/IP uses UDP port 47808 by default. The classic variants have no encryption and hardly any authentication. That is why BACnet Secure Connect (BACnet/SC) was added through addendum 135-2016bj: BACnet over WebSockets with TLS and X.509 certificates.

🔐 Why is HVAC a cyber risk?

For a long time HVAC sat outside the view of the IT department. Contractors supplied the controls, managed them remotely and sometimes connected the BMS straight to the internet. Well-known examples:

• Target (2013) - attackers got in with credentials stolen from Fazio Mechanical, an HVAC contractor that had supplier access to Target’s network. Because of weak segmentation they reached the point-of-sale systems and stole data from around 40 million payment cards.
• DIVD research (2022) - the Dutch Institute for Vulnerability Disclosure used Shodan to find almost 30,000 systems with an open BACnet port, more than 12,500 of them vulnerable. Owners were notified in two rounds.

The consequences go beyond data theft. An attacker who switches off cooling in a data centre, changes setpoints in a cleanroom or stops ventilation in a hospital affects availability and sometimes safety. A hospital or data centre may also fall under NIS2 and the Dutch Cybersecurity Act, in force since 15 August 2026. Its duty of care covers the systems that support the service, and in such environments the climate installation belongs to them in practice. Even without a legal obligation, HVAC is often part of critical infrastructure.

🧭 How do you secure and improve an HVAC installation in practice?

Start with visibility, then work from the outside in:

1. Inventory - build an asset inventory of all controllers, gateways and BMS servers, including firmware versions and protocols.
2. Take HVAC off the internet - check for internet exposure and close open BACnet, Modbus and web ports.
3. Segment - place building management in its own zone following the zones and conduits model of IEC 62443, separated from office IT and production (network segmentation).
4. Control supplier access - replace permanent contractor connections with managed remote access with MFA and logging, and set requirements in contracts (supplier security).
5. Patch and harden - include controllers and BMS servers in patch management and replace default passwords.
6. Use secure protocols - choose BACnet/SC or encrypted links when replacing equipment.

Regulation pushes in the same direction. Since 1 January 2026, the Dutch Buildings Decree (Bbl) requires existing non-residential buildings with a heating or air-conditioning system above 290 kW nominal output to have a building automation and control system (GACS). The recast EU Energy Performance of Buildings Directive (Directive (EU) 2024/1275) lowers that threshold to 70 kW from 2030. The system must continuously monitor and log energy use, analyse performance and communicate with the technical installations. Existing buildings must reach at least class C under EN ISO 52120-1, the successor to EN 15232. Such a system is connected by definition, so it must also be set up securely. BMS data is also useful for predictive maintenance of fans, pumps and chillers.

❓ Frequently asked questions

What is the difference between HVAC and a BMS?

HVAC is the physical climate installation with boilers, chillers, air handling units and fans. A BMS (Building Management System) is the software system that centrally monitors, alarms and adjusts HVAC and other building services. The BMS supervises the HVAC controllers, but the control loops themselves usually run in separate DDC controllers.

Which protocol does HVAC usually use?

HVAC installations usually communicate via BACnet, the open ASHRAE standard that is also published as ISO 16484-5. Modbus, KNX and LON are also common, especially for peripheral equipment such as heat pumps and energy meters. For new projects, BACnet/SC is the more secure option because it uses TLS encryption and certificates.

How warm can a data centre be?

For HVAC in data centres, the ASHRAE TC 9.9 guideline is the reference, recommending a server inlet temperature of 18 to 27 °C. ASHRAE also defines wider allowable ranges per equipment class, for example 15 to 32 °C for class A1. Running at a higher inlet temperature within that band significantly reduces the energy used for cooling.

Is a GACS mandatory for my building?

In the Netherlands, a GACS for the HVAC installation has been mandatory since 1 January 2026 for existing non-residential buildings whose heating or air-conditioning system exceeds 290 kW nominal output. The recast EU EPBD lowers that threshold to 70 kW from 2030. Residential buildings are excluded, and the municipality supervises compliance.

How can an HVAC installation become a way in for attackers?

An HVAC installation becomes an entry point when controllers or the BMS are directly connected to the internet, keep default passwords or give a contractor permanent remote access. At Target in 2013, the intrusion began with stolen credentials from an HVAC supplier. Segmentation, managed supplier access and monitoring largely close that route.

Does IEC 62443 apply to HVAC?

IEC 62443 was written for industrial automation, but its principles fit HVAC and building automation well. Many organisations use the zones and conduits model and the requirements of IEC 62443-3-3 to design the BMS network. Building controller vendors are also increasingly certifying their products against IEC 62443-4-2.

📌 In summary

HVAC controls temperature, ventilation, humidity and air pressure, and in data centres, cleanrooms and hospitals it is a business-critical OT system. The installation consists of generation, air handling, distribution and controls, driven by DDC controllers, PLCs and a BMS over protocols such as BACnet and Modbus. Regulation such as the Dutch GACS obligation makes HVAC smarter and more connected, and therefore also more exposed.

HVAC stands for Heating, Ventilation and Air Conditioning and maintains the indoor climate that people, processes and IT depend on; treating it as a full OT system that is inventoried, segmented and managed protects comfort, product quality and uptime at the same time.