- Teams swept over 40 million square feet nationwide, tallying nearly 10,000 devices for the Army Reserve
- The focus is on building systems like heating and cooling, alarms, and cameras
- The inventory exposed unmanaged switches and aging operating systems
The U.S. Army Engineering and Support Center in Huntsville, Alabama, has finished cataloging operational technology at Army Reserve facilities, closing out the first phase of a program to bring building control systems under cybersecurity requirements. The Army announced the milestone Friday.
Contractors working under the Huntsville Center covered more than 40 million square feet nationwide and logged nearly 10,000 devices for the Army Reserve alone. Final inventory products for the Defense Logistics Agency are nearing delivery and assessments for the Army National Guard continue.
Why Are Building Systems Now a Cybersecurity Concern?
Building systems are now a cybersecurity concern because operational technology encompasses the equipment that operates and monitors facilities. These include heating and cooling systems, fire alarms, access control systems, surveillance cameras, building management platforms and medical devices.
Connecting these facility-related control systems to enterprise networks brought them under requirements that once applied only to IT networks. Many of these systems now fall under the Risk Management Framework and authority to operate requirements because they carry network connectivity or digital components.
Kevin Miller, project manager for the center’s operational technology branch, said the systems have digital identities and communicate over networks and that securing them starts with knowing what an organization owns and where it sits.
What Did the Inventories Turn Up?
In the first phase of the effort, inventory teams logged unmanaged commercial network switches and decades-old operating systems in quantity. A large share of that equipment fails current accreditation standards and a portion cannot be protected by other means, the Army said.
Some of this equipment cannot be scanned safely and some cannot run security software built for modern systems. Agencies compensate with physical safeguards, tighter limits on network access, segmented architecture and formal remediation plans.
What Happens in the Next Phases?
The second phase turns to remediation plans, specifying for each system whether compliance comes through software updates, hardware refreshes, compensating controls or outright replacement. After that, the program will move to ongoing oversight, with inventories updated as equipment changes and cyber posture tracked on a continuing basis.
The Army Reserve data gives commanders and facility managers a risk register and a replacement road map covering the next five to 20 years. Ron Brook, chief of the center’s operational technology branch, said the point is to give leaders what they need to make investment decisions, rather than simply documenting equipment.
