Premier Provider of Building Automation & Energy Management Systems Integration in California
Protocol

BACnet/SC: The Critical Security Feature Owners Need to Know

by |Published

BACnet/SC: The Critical Security Feature Owners Need to Know

BACnet has been the dominant open protocol in building automation since 1995. Today it’s also ISO 16484-5 [1]. If your building has controls from this century, BACnet is almost certainly somewhere in your network.

The cybersecurity problem with classic BACnet

Here’s what nobody likes to discuss. Classic BACnet — BACnet/IP, BACnet MS/TP, BACnet Ethernet — was designed for a different era. Back then, building networks were isolated from corporate IT.

There’s no native encryption. There’s also no native authentication. If an attacker reaches your BAS network, they can read and often write BACnet objects directly. For most of BACnet’s history, this was fine because the network was air-gapped. However, almost no building network is truly air-gapped in 2026.

Enter BACnet/SC

BACnet/SC stands for BACnet Secure Connect. It’s ASHRAE’s response to this problem. Specifically, it’s defined in Addendum 135-2016bj and later updates [2].

BACnet/SC replaces the data link layer. Instead, it uses WebSockets and TLS. As a result, you get peer authentication, message encryption, and reliable connection-oriented links between devices. It runs over any IPv4 or IPv6 network [3].

Where BACnet/SC fits best

The standard is most useful in cybersecurity-sensitive environments [4]. Examples include:

  • Military and government installations
  • Hospitals and clinical facilities
  • Water treatment plants
  • High-value manufacturing
  • Other critical infrastructure

How migration actually works

BACnet/SC doesn’t replace BACnet. Instead, it sits underneath it. The application layer — objects, services, BIBBs — stays the same. A device that speaks BACnet/SC still speaks all the BACnet you know.

What changes is the network behavior. There’s no longer broadcast-based discovery on the local subnet. Instead, you get a hub-and-spoke topology with certificate authentication.

Practical guidance

For new projects, specify BACnet/SC capability in the controllers. You don’t need to activate it on day one. But you want the option as your cybersecurity posture matures.

For retrofits, deploy BACnet/SC selectively. Often you do it through a gateway. Otherwise, you upgrade firmware on the more capable controllers. The migration isn’t all-or-nothing.

This is where your integrator’s skill matters. You need to get certificate management right. You need to integrate cleanly with your IT team’s PKI. Done badly, it’s brittle. Done well, it’s the foundation for OT/IT convergence that won’t worry your CISO. Learn more on our OT cybersecurity page.

Talk to Signet Controls. Planning a BAS install, retrofit, integration, or service contract in California? We work across Los Angeles, Orange County, the Inland Empire, the Central Coast, and Kern County. Reach our team at info@signetcontrols.com or call (877) 874-4638.

References

[1] ANSI Blog — BACnet/ASHRAE 135 — https://blog.ansi.org/ansi/bacnet-building-automation-ansi-ashrae-135/

[2] BACnet International — BACnet Secure Connect — https://bacnetinternational.org/bacnetsc/

[3] ASHRAE — BACnet Secure Connect Whitepaper — https://www.ashrae.org/File%20Library/Technical%20Resources/Bookstore/BACnet-SC-Whitepaper-v15_Final_20190521.pdf

[4] ASHRAE — Protecting BAS with BACnet Secure Connect — https://www.ashrae.org/news/esociety/protecting-building-automation-systems-with-bacnet-secure-connect

You may also like