Externalization and Ownership of Cybersecurity for (Smart) Buildings

Building Automation Systems and Smart Buildings are increasingly more common due to energy efficiency or occupant comfort requirements. Whereas Buildings were early adopters of networked automation, we see that cybersecurity, across its components, has been lagging, which is made more challenging with the fast convergence with conventional IT technologies such as the Cloud. The central problem seems to be that the rich set of products and services offered in the IT market are not mirrored for Buildings. This paper revisits cybersecurity for Buildings from the perspective of stakeholders so to identify the ownership processes. After holding interviews, we identify the key stakeholders involved in Building Management and lay out the key relationships. From there, we use Responsible-Accountable-Consulted-Informed (RACI) matrices to map out ownership and roles for Cybersecurity. Our key conclusion is that we find ownership unclear, a problem that may be hindering the maturity of the sector.