A focused OT risk assessment for one managed office building
A focused pilot review that gives property and FM teams a clear view of hidden infrastructure risk, practical recommendations and a decision point on managed support or modernisation.
The review is a low-risk way to start with Operational Technology Assurance for Managed Buildings. We look at the networks, servers, remote access and backups behind your critical systems, and show you where the cyber risks and security risks sit before a cyber incident or equipment failure turns into operational disruption.
Before any OT risk assessment, we recommend a short workshop with your property management, asset management and FM teams to identify priority opportunities across your portfolio. Workshop objectives:
Suggested output: a recommended pilot scope for one or more managed office buildings, including objectives, outputs, candidate sites and next steps.
A low-risk starting point is a focused review of one managed office building. The pilot typically takes 2 to 4 weeks, subject to access and information availability. Pilot scope could include:
We review the operational technology infrastructure that supports your building systems, including the landlord network, servers, workstations and remote access routes. Specialist BMS contractors keep responsibility for their applications and field equipment, and we work alongside them. Where contractor access is a concern, the findings link directly to secure contractor access.
Every pilot produces a Building OT Assurance Profile: a radar chart that scores the building across eight review areas, so property teams can see at a glance where the infrastructure is strong and where risk is building up.
The review areas follow the same thinking as the NCSC Cyber Assessment Framework (CAF): managing security risk, protecting against cyber attack, detecting cyber security events and minimising the impact of cyber security incidents. Each area is scored against clear indicators, much like the contributing outcomes behind the CAF’s principles, so the profile shows where existing controls work and where potential risks need attention.
Do you know what infrastructure exists, where it is and which building systems depend on it?
Is it clear who owns the landlord network, servers and workstations, and who responds when something fails?
Is the infrastructure monitored, and does anyone act on alerts before tenants notice a problem?
Do specialist contractors use named accounts with multi factor authentication and logging, or shared VPNs and passwords?
Are critical systems backed up, and has a restore been tested so recovery planning is based on evidence?
How exposed is the building to cyber threats, from default credentials and flat networks to systems that can no longer be patched?
Would one failed switch, server or connection take a building service offline?
Is equipment still supported, and is there evidence to plan replacement and service charge budgets?
The pilot ends with clear evidence and a decision, not just a report. You receive:
From there you can decide whether the building needs managed support, modernisation or both. Either route builds the same three outcomes: Visibility, Control and Assurance.
Tell us about the building you have in mind and we will be in touch to arrange an OT infrastructure assurance workshop or scope a pilot. A short description of the building, its systems and your main concerns is all we need to start.
IT4Automation combines IT infrastructure capability with operational technology and building services experience. We have designed, delivered and supported landlord networks in demanding London office buildings, including a three-building development with two critical national infrastructure tenants, designed to the NCSC CAF and delivered by NPPV3/SC-cleared engineers, and a 12-floor investment management headquarters we have supported for 16 years.
Accreditations: UKAS-accredited ISO 9001, ISO 14001, ISO 45001 and ISO 27001, Cyber Essentials, SafeContractor and Constructionline Gold.
An OT risk assessment identifies the risks in the operational technology that keeps a building running: the networks, servers, workstations, remote access and backups behind systems such as the BMS, access control and CCTV. It looks at what could fail or be attacked, what the impact on essential functions would be, which existing controls work and which gaps to close first.
A typical OT security assessment covers asset discovery, network segmentation, remote and contractor access, monitoring, backup and recovery, and supportability. Our pilot adds stakeholder interviews, a high-level risk register, prioritised recommendations and a managed-service suitability assessment.
The Cyber Assessment Framework (CAF) is published by the National Cyber Security Centre, the UK’s technical authority for cyber security. It is an outcome focused framework built around four objectives: managing security risk, protecting against cyber attack, detecting cyber security events and minimising the impact of cyber security incidents. The CAF objectives are broken down into fourteen principles and a set of contributing outcomes, each with indicators of good practice. Objective B, protecting against cyber attack, covers areas such as identity and access control, data security, system security, resilient networks and staff awareness. The framework is kept up to date by the NCSC, most recently with CAF v4.0.
The CAF is primarily designed for organisations operating essential services and critical national infrastructure, and competent authorities use it to assess organisations subject to the Network and Information Systems (NIS) Regulations. Public sector organisations, local government and other regulated entities use it too, either as a self assessment or through independent audits, and many organisations use it as a sector agnostic benchmark for cyber resilience. Commercial buildings that host CNI organisations or public sector tenants are increasingly asked for evidence against CAF requirements. Our pilot is not a formal CAF audit, but the evidence it produces gives you a strong starting point when tenants or regulatory requirements ask about CAF compliance.
Typically 2 to 4 weeks, subject to access to the building and the availability of information such as existing records and contractor contacts.
You get a decision point. Depending on the findings, the next step is a recurring managed service, a modernisation project or both, and the risk register becomes the baseline for future risk management and lifecycle planning.
IT4Automation visited to perform a network survey and assisted with troubleshooting a network issue… I was very pleased with the service that IT4Automation provided and would certainly contact them again in the future if needed.
Stuart Jolley – S,C&I Engineer, Systems Lead
Great communication, reliable and your team… worked pretty much non stop start to finish. I think this upgrade has made a good improvement to the machine and will improve reliability.
George Voisey – Balfour Beatty Rail
Start with a workshop or go straight to a one-building pilot. Either way, you get a clear view of infrastructure risk and a decision on what comes next.
