OT/IT Convergence in Irish Smart Buildings — Managing the Cybersecurity Risk Under NIS2

Smart buildings are increasingly a cybersecurity liability. The same IP convergence that makes modern Irish commercial buildings intelligent — connecting BMS, HVAC, access control, CCTV and lighting control onto a common network — creates attack surfaces that did not exist when these systems were analogue, isolated and air-gapped. In Ireland in 2025, smart building cybersecurity is no longer a theoretical IT concern. It is an NIS2 Directive compliance obligation for organisations in covered sectors, and it is a design responsibility that falls directly on the ICT and ELV consultants specifying these systems.

This guide covers the OT/IT convergence risk profile in Irish smart buildings, the most common attack vectors, the NIS2 obligations that apply to Irish organisations operating smart building systems, and the design mitigations that ICT consultants in Ireland can apply from specification stage to reduce risk.

Why Smart Building Cybersecurity Has Become an Irish Design Requirement

The convergence of operational technology (OT) — the physical control systems of a building — with information technology (IT) has created attack surfaces across Dublin offices, Cork data centres, Galway healthcare facilities and Limerick manufacturing plants. Three trends have accelerated the risk:

• IP-connected BMS and HVAC controllers are now standard in Irish commercial buildings, with remote management interfaces accessible over the internet for facilities management teams — and for attackers.
• Cloud-managed access control and CCTV platforms — increasingly specified on Irish projects — create direct internet connectivity for physical security systems that were previously entirely local.
• Smart metering and energy management platforms connected to CRU's smart grid infrastructure create bidirectional data flows between building OT and external networks.

OT/IT Convergence — What It Means for ELV and BMS Systems

Traditional ELV and BMS systems operated in physical isolation — a closed-loop proprietary network serving heating, cooling, lighting and life-safety functions, with no connection to the internet or the corporate IT network. Modern smart building cybersecurity challenges arise precisely because this isolation has been eliminated in the pursuit of remote monitoring, cloud analytics, energy management and facilities management efficiency.

The consequence is that a BMS controller running legacy firmware, an access control panel with default credentials, or a CCTV NVR with an internet-exposed management interface can become the entry point for a ransomware attack on the building operator's IT environment, or a denial-of-service attack on the building's operational systems. In Irish healthcare facilities — already a primary ransomware target given patient data value — OT system compromise has direct operational and patient safety implications.

Common Attack Vectors in Irish Smart Buildings

BMS and HVAC Systems — A Target for Ransomware

BMS and HVAC controllers in Irish commercial buildings commonly use BACnet/IP, Modbus TCP or proprietary protocols over standard Ethernet infrastructure. Many were installed before OT security was a consideration, run firmware that has not been patched in years, and have remote management interfaces exposed on public IP addresses for facilities management convenience. An attacker gaining access to a BMS controller can at minimum disrupt heating, cooling and ventilation — at worst, use it as a pivot point into the corporate IT network. The 2023 NCSC Ireland advisory on ICS/OT security specifically cited BMS as a high-risk vector for Irish essential services operators.

Access Control and CCTV as Network Entry Points

Cloud-managed access control platforms — increasingly specified on Irish commercial and healthcare projects — create an outbound connection from the site to the cloud management platform. This connection, if not properly firewalled and monitored, can be exploited to push malicious updates or exfiltrate credential data. IP CCTV cameras are among the most commonly exploited IoT devices globally, with a large proportion of attacks exploiting default manufacturer credentials that were never changed post-installation. Irish building owners specifying cloud-managed access control or IP CCTV without a defined credential management and firmware update policy are accepting significant risk.

Smart Meters and Energy Management System Risks

CRU's National Smart Metering Programme has deployed SMETS2-compatible smart meters across Irish commercial premises, with bidirectional AMI communications to the Distribution System Operator. The integration of smart meter data into building energy management platforms creates a data pathway between the building OT environment and external grid infrastructure. While the AMI communication channel itself is encrypted and managed by the DSO, the building-side integration points — particularly BEMS platforms that aggregate meter data — require specific security design to prevent lateral movement from BEMS to corporate IT.

NIS2 Directive in Ireland — What Building Owners and Operators Must Do

The Network and Information Security (NIS2) Directive was transposed into Irish law by S.I. 322 of 2024. It imposes mandatory cybersecurity risk management and incident reporting obligations on Irish organisations in essential sectors (energy, transport, health, digital infrastructure, water) and important sectors (manufacturing, food, postal, digital services). For these organisations, smart building OT systems — BMS, access control, CCTV, HVAC controls — must be included in their NIS2 cybersecurity risk management framework.

NIS2 Technical Requirements for OT Systems

NIS2 requires covered Irish organisations to implement: risk analysis and information security policies; business continuity and crisis management for OT systems; supply chain security (including BMS vendor security assessments); access control policies for OT systems; encryption and multi-factor authentication where appropriate; and incident handling procedures with 24-hour NCSC notification for significant incidents. These are not building design requirements per se, but they are requirements that the ICT and ELV design consultant should consider when specifying OT-connected systems that will fall within the organisation's NIS2 compliance scope.

Design Strategies for Secure Smart Buildings in Ireland

Network Segmentation — Isolating OT from IT

The primary technical mitigation for smart building cybersecurity in Ireland is network segmentation. BMS, HVAC, access control and CCTV systems should be placed on dedicated OT VLANs with firewall enforcement at the boundary between OT and IT segments. Direct routing between OT and IT VLANs should be blocked, with specific protocol exceptions documented and managed. Remote management of OT systems should be via a jump server in a DMZ, with multi-factor authentication, rather than direct internet exposure of OT management interfaces.

Zero-Trust Architecture for Building Networks

Zero-trust network architecture — in which no device or user is inherently trusted, and access is verified continuously rather than assumed based on network position — is increasingly relevant for Irish smart buildings in 2025. For OT systems, zero-trust means: per-device authentication for BMS controllers and field devices; continuous monitoring of OT system communications for anomalous behaviour; and microsegmentation that limits the blast radius of any single compromised device to its immediate network segment rather than the entire OT environment.

How ICT Consultants Can Help Irish Building Owners Meet NIS2

ICT consultants specifying smart building systems for Irish organisations in NIS2-covered sectors have a direct role in reducing cybersecurity risk through design decisions. The most impactful design choices are: specifying only systems with documented secure-by-default configurations and active firmware support; requiring cloud-managed platforms to demonstrate ISO 27001 certification; specifying OT network segmentation requirements in the ICT design documentation; and including OT credential management requirements in the commissioning specification. These are not optional extras — they are the difference between a smart building that enhances operational efficiency and one that introduces systemic cybersecurity risk.

See our ICT consultant Ireland page for the full ICT infrastructure design scope, and our physical security consultant Ireland page for access control and CCTV design.