IoT Security Checklist for Buildings and Plants: Before Devices Join Your Network

Sensors, energy meters, cameras and controllers now sit on the same networks as laptops and the internet. That makes building and plant data far more useful, and it also turns every device into a possible way in. Many of these devices ship with default passwords, rarely receive updates, and stay in service for a decade, long after the person who installed them has moved on.

This IoT security checklist is for facility, plant and IT managers who are about to add connected devices to a building or site, or who already have them and want to know where they stand. It follows the order you would actually work through: know what you have, separate it, lock down access, keep it updated, control remote access, handle personal data properly, and buy with security in mind. A short version to print is at the end.

1. Know what is on the network

You cannot secure devices you do not know about. Keep an inventory with, for every device:

• Location, make, model and firmware version.
• What it connects to and which data it sends where.
• Who owns it internally and which vendor supports it.
• When it was installed and when the manufacturer stops providing updates.

Include the devices that vendors installed and nobody thinks of as IT: lift monitoring, building management controllers, solar inverters, CCTV recorders, access control panels and smart meters. Unknown devices are usually the biggest risk on a building network. Review the list at least every quarter, and whenever a contractor finishes work on site.

2. Separate devices from the office network

• Put devices on their own network segment, separate from staff laptops and guest WiFi, with firewall rules that allow only the traffic each device needs.
• Keep control systems apart from monitoring. Equipment that controls physical processes belongs in the most protected segment. Monitoring data should flow outward from it, not commands inward.
• Do not let devices browse the internet freely. A meter needs to reach one server, not the whole internet.
• Never share guest WiFi with devices, even temporarily for an installation.

3. Credentials and access

• Change default passwords before a device goes live, with a unique password per device stored in a company password manager.
• Use named accounts for staff and vendors instead of one shared login, so actions can be traced.
• Separate viewing from control. Most people need to see readings; very few need to change setpoints or switch equipment.
• Remove access the day someone leaves, including vendor engineers who no longer work on your site.

4. Updates and end of life

• Ask how long the manufacturer will provide security updates before you buy, and record the date in your inventory.
• Plan updates in maintenance windows, testing on one device before rolling out to the rest.
• Treat devices that can no longer be updated as a risk to manage. Isolate them further or plan their replacement.

5. Remote access

Remote access is where most building and plant incidents begin, because it is set up quickly for one repair and then left open.

• Never expose a device's web interface directly to the internet through port forwarding.
• Route vendor access through one controlled gateway with multi-factor authentication, approved per session, limited in time and logged.
• Review all open remote access every month and close what is not needed.

6. Monitoring and incident response

• Alert when a device goes silent or when its traffic changes sharply. A meter that suddenly sends a lot of data deserves a look.
• Log logins and configuration changes on controllers and gateways.
• Write a one-page incident plan: who isolates a device, who calls the vendor, who decides whether equipment must be shut down, and who handles notifications.

7. Personal data: cameras, access control and occupancy

The PDPA applies when devices collect data that can identify people: CCTV, access cards, vehicle plate recognition, or tracking of phones on WiFi. The PDPC's Advisory Guidelines on the PDPA for Selected Topics include a section on CCTV. In short, people must be notified of the purpose, for example with notices at entrances, recordings must be protected, and footage should not be kept longer than needed.

Not all building data is personal data. Aggregate occupancy counts that cannot identify an individual generally fall outside it. If you are unsure, check the PDPC's guidance on anonymisation before you decide what to collect. In every case, the PDPA's protection obligation means you need reasonable security arrangements for the personal data you do hold, which brings you back to the steps above.

8. Buy with security in mind

Before you buy, ask each supplier:

• How are default passwords handled, and can they be forced to change at setup?
• How long will security updates be provided, and how are they delivered?
• Where do we report a vulnerability, and how fast do you respond?
• Is data encrypted between the device and the server?
• Does the device need the cloud to work, and where is its data stored?

Singapore's Cybersecurity Labelling Scheme for IoT, run by the Cyber Security Agency, rates consumer smart devices on four levels of security provisions. Much building and plant equipment falls outside it, so where no label exists, ask for the supplier's security documentation instead. For industrial control systems, the IEC 62443 series is the usual reference standard. Finally, write security duties into the maintenance agreement: how quickly critical patches are applied and how fast the vendor must tell you about an incident.

A worked example

For example, a commercial building adding energy meters and room sensors would put them on a dedicated network segment, reaching only the monitoring server. The building management controllers stay in a separate, more restricted segment, sending readings outward. Each device gets a unique password at installation, vendor access runs through one gateway with multi-factor login, and the inventory is updated before the contractor leaves site. None of this is expensive. It mostly needs to be decided before installation day rather than after it.

The IoT security checklist, short version to print

1. Every device is in the inventory, with an owner and an update end date.
2. Devices sit on their own network segment.
3. Control systems are separated from monitoring.
4. No default passwords; one unique password per device.
5. Named accounts, with viewing and control separated.
6. Updates are planned and tested.
7. No device is exposed directly to the internet.
8. Vendor remote access goes through one gateway, with multi-factor login and logs.
9. Personal data from cameras and access control follows the PDPA.
10. Security duties are written into supplier and maintenance contracts.

If you are planning a first project, our guide on how to scope an IoT pilot covers what to measure first. At Etzal Group, IoT and Control projects are installed by our own technicians, integrated with the systems you already run, and monitored after handover. To go through your site, book a free consultation.