Infrastructure

Introduction

A building encompasses all the stationary workstations and installed information technology on the premises, as well as the information processed there. It thus ensures protection against external influences. This is why both the building itself (i.e. walls, ceilings, floors, roof, windows, and doors) and all the infrastructure facilities and utilities it contains (such as electricity, water, gas, heating, and cooling) should be considered.

This module is based on an example in which a building is used by one or more units of an organisation. These units may have differing security requirements. Furthermore, all related considerations must include the fact that almost every building is also entered by persons not belonging to the respective organisation, such as citizens, customers, or suppliers. If a building is used by various parties, its design and equipment must match the building's usage concept. An optimal environment should be ensured for the persons working there. Unauthorised persons should not be allowed access to areas where they could compromise security. It should also be possible to operate the technology installed in the building safely and efficiently.

Objective

This module describes the requirements to be met in order to ensure optimal protection of a building in terms of information security. The safeguards resulting from the requirements depend on the type and size of both the organisation and the building in question. Requirements from this module may also be applied to large properties including several buildings, or to the use of individual sections of buildings used by multiple entities.

Scoping and Modelling

Module INF.1 Generic Building must be applied once to each building.

This module considers technical and non-technical security aspects of the planning and use of typical buildings designed for companies and public authorities. This includes consideration of the entire lifecycle of buildings from the perspective of information security—from the creation of a requirements catalogue to conceptual design, furnishings, building usage, alterations, and eventual departure.

The cabling in a building is examined separately in module INF.12 Cabling, and special rooms such as server rooms or archive rooms are examined in the corresponding modules of the INF Infrastructure layer.

The topic of working with third-party personnel is covered in module ORP.1 Organisation.

Useful Resources

The International Organization for Standardization (ISO) provides guidelines for the physical and environmental security of buildings in annex A.11 of ISO/IEC 27001:2013.

In "The Standard of Good Practice for Information Security", the Information Security Forum (ISF) provides guidelines for the physical and environmental security of buildings in section CF19.

The National Institute of Standards and Technology (NIST) has published NIST Special Publication 800-53, “Assessing Security and Privacy Controls for Federal Information Systems and Organizations”, which provides specifications on the physical and environmental security of buildings in appendix F-PS.

Introduction

Today, almost all strategic and operative functions and tasks are substantially supported by (if not entirely dependent on) information technology. As a consequence, the requirements for the performance and availability of IT systems and their network connections are constantly increasing. To meet these performance requirements, ensure that adequate reserve capacity is available, and operate IT in economical ways, organisations of all sizes concentrate their IT landscapes in data centres.

A data centre is defined as follows:

• If an organisation that uses IT has only one central area of IT operations, this, together with the required support areas, must generally always be treated as a data centre in terms of its protection needs. The term “area of IT operations” refers to rooms in which hardware is installed and operated to provide services and data. In addition to its area of IT operations, a data centre comprises all other technical support areas (e.g. power supply, cold air supply, extinguishing technology, security technology) that facilitate the correct operation and security of the area of IT operations.
• If an organisation’s IT operations are distributed over several areas within a building or a given premises and these areas are connected both to one another and to IT users by internal LAN connections, the most functionally significant of these areas (at minimum) must be treated as a data centre. In addition, areas in which proper operations are crucial for 50% or more of the users at hand or from which 50% or more of the services and data (proportionate to all areas) are provided must be treated as a data centre.
• If an organisation that uses IT is located at several physically separate sites and these are connected to each other by means other than internal LAN connections, each of the sites must be considered and treated separately according to (1) above.
• An area of IT operations that houses IT required for critical business processes (i.e. processes whose disruption or failure would significantly impair the fulfilment of an organisation’s primary tasks) must always be treated as a data centre, independent of the size or the proportion specified in (2) above.
• Areas of IT operations from which services for third parties are performed must always be treated as part of a data centre. Here, it is irrelevant whether these services are subject to fees.
• If there is a justifiable interest in treating an area of IT operations (together with its support areas) as a server room contrary to the above regulations, reasons must be provided for the resulting reduction of security requirements.

An area does not need to fulfil all six of the points listed here to be considered a data centre. The list merely describes different scenarios in which an area is to be considered a data centre. If an area of IT operations deviates from these definitions, it is referred to as a server room. This designation is solely based on how significant the IT structure in question is to the respective organisation's ability to fulfil its tasks, and thus corresponds to the methodology specified in DIN EN 50600.

If a server room is to be protected, the requirements in this module can be reduced accordingly. However, substantial and comprehensible reasons must be given for this in accordance with (6) above and the Basic Requirements must be implemented at minimum.

Objective

On the one hand, this module is directed towards organisations that operate a data centre and want to check if suitable security safeguards have been implemented in the framework of an audit. On the other, the module can also be used to estimate the security safeguards that will need to be implemented if IT is to be centralised in a data centre. The primary goal of the requirements described in this module is to ensure the secure operation of data centres.

Scoping and Modelling

INF.2 Data Centre and Server Room must be applied to every data centre and every server room.

It is not suitable for small information domains with, for example, only one or a very small number of servers or IT systems. This might involve a small organisation with a few IT workstations and a server that is located in a separate room, for example. In such cases, it is often sufficient to implement module INF.5 Room or Cabinet for Technical Infrastructure.

General requirements for buildings and cabling are also not part of this module. These can be found in the modules INF.1 Generic Building and INF.12 Cabling.

To make this module easier to understand, technical details and planning variables have deliberately been avoided. The relevant standards and other BSI publications provide more detailed information.

Useful Resources

The BSI makes the documents “Redundanz Modularität Skalierbarkeit” [Redundancy, Modularity, Scalability] and “Kriterien für die Standortwahl von Rechenzentren” [Criteria for the Siting of Data Centres] available on its website.

The German Institute for Standardisation (DIN) describes general principles for the design of data centres in the standard DIN EN 50600-1:2019-08, "Information Technology – Data Centre Facilities and Infrastructures – Part 1: General Concepts”.

The German Institute for Standardisation (DIN) deals with the topic of lightning protection in the standard DIN EN 62305-4:2011-10, "Protection Against Lightning – Part 4: Electrical and Electronic Systems Within Structures”.

Germany's digital association, Bitkom, provides assistance in planning and setting up a data centre in its guide "Betriebssicheres Rechenzentrum” [Reliable Data Centre].

The German Insurance Association (GDV) describes perimeter security safeguards in the publication “Sicherungsleitfaden Perimeter” [Perimeter Security Guide], which can be used as an aid in securing properties.

Introduction

A technical infrastructure room contains technical components that only rarely need to be operated directly on site. However, they are indispensable to building infrastructure, and thus also to IT infrastructure. This can include, for example, power supply distributors, fuse boxes, ventilation systems, telecommunications components, patch panels, switches, or routers. A technical infrastructure room is not a continuous workplace and is usually only entered or opened for maintenance.

If the technical infrastructure to be protected cannot be housed in a separate room or if the room cannot be set up according to the requirements described herein, the technical infrastructure can also be placed in a cabinet specially equipped for this purpose. This can also make sense if a cabinet is the most economical alternative for housing technical infrastructure. The requirements for such rooms should then be transferred as effectively as possible to the cabinet and its shell.

Objective

The objective of this module is to protect a room or cabinet for technical infrastructure structurally, mechanically, and electronically in terms of information security. In principle, a "room" in this context is a room or cabinet within a building, but it can also be a container outside a building or a tent housing technical infrastructure. A room's protective safeguards should be designed to prevent the functional impairment of the technical components located in it to the greatest possible extent.

In this module, only the term “room” will be used for technical infrastructure. However, the requirements of this module can also be applied to cabinets.

Scoping and Modelling

Module INF.5 Room or Cabinet for Technical Infrastructure must be applied to rooms that are used to operate technical infrastructure. The module must also be applied if stationary containers (in the sense of large cabinets) are operated.

As a rule, rooms for technical infrastructure contain only technical components that are typically not housed in a data centre itself (see module INF.2 Data Centre and Server Room). In contrast to server rooms, they only contain IT systems that provide IT services in justified exceptional cases. One such exception relates to small information domains with, for example, only one or a very small number of servers or IT systems. This might apply to a small or medium-sized company with a small number of IT workstations and a server which is located in a separate room. In such cases, it is often sufficient to fulfil the requirements of this module instead of those detailed in module INF.2 Data Centre and Server Room. Requirements for cabling are dealt with in module INF.12 Cabling.

Useful Resources

In “DGUV Vorschrift 4 Unfallverhütungsvorschrift, Elektrische Anlagen und Betriebsmittel” [DGUV Regulation 4, Accident Prevention Regulation, Electrical Installations and Equipment], the German Social Accident Insurance (DGUV) provides guidelines for the correct handling of equipment.

The German Institute for Standardisation (DIN) provides specifications for floor coverings in the standard DIN EN 14041:2018-05.

The German Institute for Standardisation (DIN) provides specifications for physical security in buildings and rooms in the standard DIN EN 1627:2011-09.

The German Institute for Standardisation (DIN) provides specifications for the fire behaviour of building materials and building components in the standard DIN EN 4102:2016-05.

The International Electrotechnical Commission provides notes on lightning protection standards in BS EN/IEC 62305.

In the guideline VdS 2311:2017-04, the VdS provides specifications for the use of intrusion systems.

Introduction

Storage media archives are closed rooms within an organisation that are used to store of all kinds of storage media. In addition to storage media used for digital information, this includes paper documents, film, and other media.

Objective

This module describes the typical threats and requirements regarding the information security of a storage media archive. The aim is to protect the information stored there and on other types of media.

Scoping and Modelling

Module INF.6 Storage Media Archives must be applied to all rooms that are used as archives for storage media.

This module deals with technical and non-technical security requirements for storage media archives. It does not cover recommendations related to proper archiving. These are included in module OPS.1.2.2 Archiving.

Within the IT-Grundschutz framework, no increased requirements are placed on archive rooms with regard to fire protection. However, additional fire protection requirements can be met by the containers in which storage media are stored.

Useful Resources

The German Institute for Standardisation (DIN) provides specifications for physical security in buildings and rooms in the standard DIN EN 1627:2011-09.

Introduction

An office room is an area within an organisation where one or several employees perform their tasks. This module describes the typical threats and requirements regarding the information security of an office room.

Objective

The aim of this module is to protect information processed in office rooms.

Scoping and Modelling

Module INF.7 Office Workplace must be applied to every room used as a place of work in the information domain under consideration.

This module deals with technical and non-technical security requirements for office rooms. It does not deal with recommendations on how to configure and safeguard the IT systems in such rooms. Information on this is included in SYS.2.1 General Client, as well as in the operating-system-specific modules.

General requirements for buildings are also not part of this module. These are included in module INF.1 Generic Building, which should be used in addition to this module. The present module also does not cover the cabling of office rooms. Module INF.12 Cabling must be implemented in this regard.

Useful Resources

In “The Standard of Good Practice for Information Security”, the Information Security Forum (ISF) provides guidelines for the physical security of buildings, rooms, and their surroundings in section CF19.

The German Institute for Standardisation (DIN) provides specifications for physical security in buildings and rooms in the standard DIN EN 1627:2011-09.

In its regulation on workplaces (Arbeitsstättenverordnung), the Federal Ministry of Labour and Social Affairs sets out requirements for setting up and operating workplaces to protect the health and safety of employees.

Introduction

Teleworkers, freelance employees, and the self-employed typically work from home. In contrast to a company office, these employees use a workplace on their own property. They thus need to be able to sufficiently separate their occupational and private environments. If employees work from home on an ongoing basis, various legal requirements must also be fulfilled; for example, their workplaces must meet the requirements regarding occupational health and ergonomics.

Meanwhile, a home workplace cannot be expected to meet the same infrastructural security requirements as the office rooms of an organisation. A home workplace is often also accessible to visitors or family members, for example. That is why safeguards must be taken to achieve a security level that is comparable to an office room.

Objective

This module shows how the infrastructure of a home workplace can be established and operated in a secure manner. The core objective of the module is to protect organisations' information when their employees work from home.

Scoping and Modelling

Module INF.8 Working from Home must be applied to all rooms that are used for teleworking.

The module contains basic specifications to be considered and fulfilled to counteract the threats relevant to home workplaces. However, it only defines specific requirements for the infrastructure of a stationary workplace that can be accessed by third parties. Security requirements for the IT systems used (e.g. clients and multifunctional devices) and, in particular, the technical aspects of teleworking (e.g. communication links) are not the subject of this module. They are described in module OPS.1.2.4 Teleworking or in the respective system-specific modules.

Useful Resources

The International Organization for Standardization (ISO) provides guidelines for the physical and environmental security of buildings and rooms in annex A.11 of ISO/IEC 27001:2013.

The German Institute for Standardisation (DIN) provides specifications for physical security in buildings and rooms in the standard DIN EN 1627:2011-09.

The National Institute of Standards and Technology (NIST) has published NIST Special Publication 800-53, “Assessing Security and Privacy Controls for Federal Information Systems and Organizations”, which provides specifications on the physical and environmental security of buildings in appendix F-PS.

Introduction

Good network coverage and powerful IT devices such as laptops, smartphones, or tablets make it possible for employees to work almost everywhere. This often means that work-related activities are not only performed in the rooms and buildings of an organisation, but at changing workplaces in various environments (e.g. hotel rooms, trains, or customer locations). The information processed in this way must be protected appropriately.

On the one hand, mobile working changes the duration, location, and distribution of working hours. On the other, it increases the demands placed on information security because the secure IT infrastructure found in an office environment cannot be assumed in mobile working environments.

Objective

This module describes security requirements for mobile workplaces. The aim is to achieve security conditions in such workplaces that are comparable to those of an office room.

Scoping and Modelling

Module INF.9 Mobile Workplace must be applied to all spaces that are regularly used as a mobile workplace.

This module contains basic specifications that are to be considered and fulfilled when employees work not only within an organisation, but regularly at changing external workplaces, as well.

Above all, it covers the organisational, technical, and personnel requirements that pertain to employees who perform at least part of their tasks in mobile environments. In order to protect IT systems, storage media, and documents used in mobile workplaces, all the relevant modules—such as SYS.3.1 Laptops, SYS.3.2 General Smartphones and Tablets, SYS.4.5 Removable Media, NET.3.3 VPN, and SYS.2.1 General Client—must be considered separately.

Security requirements for workstations that an organisation establishes on a permanent basis outside of its buildings (i.e. teleworking workstations) are not the subject of this module. These are described in module OPS.1.2.4 Teleworking. Security requirements for teleworking infrastructure are also not addressed here. This topic is dealt with in module INF.8 Working from Home.

Useful Resources

In annex A.11.2 of ISO/IEC 27001:2013, the International Organization for Standardization (ISO) specifies requirements for equipment of mobile workplaces.

In annex A.6.2.1 of ISO/IEC 27001:2013, the International Organization for Standardization (ISO) provides guidelines for developing a policy for mobile devices.

The Information Security Forum (ISF) provides guidelines for dealing with mobile devices in section PA2 of “The Standard of Good Practice for Information Security”.

The National Institute of Standards and Technology (NIST) has published NIST Special Publication 800-46, "Remote Access and Bring Your Own Device (BYOD)”, which provides guidelines on remote access technologies.

Introduction

Every organisation usually has one or more rooms for holding meetings, training courses, or other events. Specially equipped rooms are often designated for this purpose. Meeting, event, and training rooms are usually used by different persons and/or groups of persons and visitors, and generally for a limited period of time. IT systems that participants bring along are often operated together with the organisation’s devices, as in the case of external laptops that are connected to overhead projectors. These different usage scenarios result in a particular risk situation that does not exist in the same way in other rooms of the organisation.

Objective

The aim of this module is to protect the information processed in meeting, event, and training rooms, along with the IT systems operated in such rooms. Moreover, it addresses the recommended procedure for visitors who use these rooms.

Not in scope and modelling

Module INF.10 Meeting, Event, and Training Rooms must be applied to all rooms used for meetings, events, and training.

This module addresses all the technical and non-technical security aspects of using meeting, event, and training rooms. It does not deal with detailed recommendations on how to configure and safeguard the IT systems in such rooms. Information on this is included in SYS.2.1 General Client, as well as in the operating-system-specific modules. Further security aspects relevant to meeting rooms, such as WLAN or video conferencing systems, are addressed in the modules of the layers NET.2 Radio Networks and NET.4 Telecommunication. Cabling in these rooms is specifically considered in module INF.12 Cabling. Requirements for fire prevention are included in module INF.1 Generic Building. Requirements for monitoring visitors are included in module ORP.1 Organisation.

Useful Resources

The International Organization for Standardization (ISO) provides guidelines for the physical and environmental security of buildings and rooms in annex A.11 of ISO/IEC 27001:2013.

In "The Standard of Good Practice for Information Security", the Information Security Forum (ISF) provides guidelines for the physical and environmental security of buildings and rooms in chapter CF19.

The German Institute for Standardisation (DIN) provides specifications for physical security in buildings and rooms in the standard DIN EN 1627:2011-09.

Introduction

Organisations use a wide variety of vehicles in many different situations to cover short and long distances. In the context of this module, vehicles are generally classified as motorised means of land, air, or water-based transport that have a vehicle cabin or similar enclosure. Some examples include passenger cars, lorries, aircraft, or ships. In this module, only the generic term "vehicle" is used unless a specific type of vehicle is meant.

Almost all modern vehicles have integrated IT components (e.g. infotainment systems or internal analysis systems) which must be considered holistically in the context of information security. In addition, official tasks are often carried out not only in the rooms and buildings of an organisation, but also within vehicles, which may move between different locations and environments. A vehicle is thus also a mobile working environment in its own right which must be adequately secured by the organisation in question.

Objective

This module describes specific hazards that must be considered when organisations use vehicles with IT components or use vehicles in general as IT workstations. On this basis, the module defines the requirements that must be fulfilled by vehicle users and owners in order to ensure optimal vehicle operation from an information security perspective.

Scoping and Modelling

Module INF.11 General Vehicle must be applied once to each land, air, and water vehicle used by the organisation in question.

It is designed for users and operators of vehicles. Autonomous or remote-controlled vehicles, rail vehicles, and space vehicles are excluded from this module.

The type, equipment, place of use, and field of activity of a given vehicle may differ depending on the organisation at hand. In module INF.11 General Vehicle, only the typical operational scenarios of vehicles are considered; special operational purposes, such as those pertaining to rescue helicopters or military vehicles, must also be considered on a case-by-case basis.

For this reason, there is no conclusive discussion of retrofitted, mission-specific IT systems or vehicle-specific specialised applications, such as those that are common in emergency vehicles or command vehicles. The equipment and the associated specialised applications of these vehicles must be dealt with individually.

Furthermore, in-vehicle networks (IVNs) established via communication buses such as CAN, LIN, or Flexray are not considered because they are usually not changed by the user.

In order to secure IT components that are carried by users or installed at a later point in time, all the relevant modules—such as SYS.3.1 Laptops, SYS.3.2 General Smartphones and Tablets, and NET.3.3 VPN, as well as the module layers NET.4 Telecommunication and NET.2 Radio Networks—must be considered separately.

In addition, before a vehicle is disposed of, the CON.6 Deleting and Destroying Data and Devices module must be applied to ensure that no sensitive information remains in the vehicle.

Since this module deals with all the relevant infrastructure aspects, there is no need to model INF.9 Mobile Workplace.

Useful Resources

The scientific article “IT-Sicherheit und Datenschutz im vernetzten Fahrzeug” [IT Security and Data Protection in the Networked Vehicle] by the Fraunhofer Institute (DOI: 10.1007/s11623-015-0434-4) provides a general overview of networked vehicles, possible applications, the required data, and the resulting threats.

The scientific article "Security Issues and Vulnerabilities in Connected Car Systems" from the 2015 IEEE Conference highlights threats that arise from vehicle networking.

Introduction

The proper and standards-compliant installation of cabling is part of the basis for secure IT operations. A fundamental distinction must be made between electrical cabling and IT cabling in this regard.

The electrical cabling of IT systems and other devices includes all cables and distributors in a given building, from the feed-in point of the distribution network operator to the connections of end devices.

The IT cabling in an organisation includes all communication cables and passive components such as patch panels or marshalling panels/splice distributors. It therefore forms the physical basis of the internal communication networks. IT cabling ranges from the transfer points from an external network to the connection points of the network users at hand. Transfer points include the connection of a telecommunications provider or the DSL connection of an Internet provider, for example.

Despite this distinction, the fundamental requirements for both types of cabling are identical. The cabling within an organisation should thus always also be considered as a whole.

Objective

The aim of this module is to protect all electrical cabling and IT cabling from failure, manipulation, and malfunction.

Scoping and Modelling

Module INF.12 Cabling must be applied once to the cabling in buildings and rooms as a supplement to module INF.1 Generic Building. The requirements of the present module should always be applied to both IT and electrical cabling.

Useful Resources

The German Institute for Standardisation (DIN) publishes specifications that apply to cabling. The following standards are relevant in this regard:

• DIN 4102, "Fire Behaviour of Building Materials and Elements"
• DIN IEC 60364, "Erection of Low-Voltage Installations"
• IEC 62305, Lightning Protection Standard DIN EN 62305 / VE 01805-305:2006
• IN VDE 0100, "Erection of Low-Voltage Installations"
• DIN VDE 0105-100, "Operation of Electrical Installations"
• DIN 41494-8, "Mechanical Structures for Electronic Equipment"
• DIN EN 50173, "Information Technology – Generic Cabling Systems"
• DIN EN 50174, "Information Technology – Cabling Installation"
• DIN EN 50310:2017-02, "Telecommunications Bonding Networks for Buildings and Other Structures"
• DIN EN 50346:2010-02, "Information Technology – Cabling Installation – Testing of Installed Cabling"
• DIN IEC 60297, "Mechanical Structures for Electrical and Electronic Equipment"

The German Social Accident Insurance Institution for the health and welfare services (BGW) has published further regulations for electrical cabling in DGUV Regulation 3, “Electrical Installations and Equipment, Accident Prevention Regulation”.

The International Organization for Standardization (ISO) provides guidelines for IT cabling in the standard ISO/IEC 11801:2002-09, “Information Technology – Generic Cabling for Customer Premises”.

Introduction

Facility management (FM), which is also known as building management, is responsible for all services that arise in the planning and utilisation phases of buildings, building complexes, properties, or property portfolios. The term "building" is used in this module as a blanket term. Exceptions to this are highlighted explicitly.

FM focuses on specific sites and objects. It can be subdivided into technical, infrastructural, and commercial FM.

According to DIN 32736, technical building management (TBM) comprises all services that maintain the technical function and availability of a building. These services include, among others:

• Operational management
• Documentation
• Energy and environmental management
• Information management
• Modernisation
• Refurbishment
• Conversion
• Monitoring of technical warranties

The fundamental technical functions of a building are provided by its building services, which are operated, maintained and further developed by TBM. According to VDI 4700 Sheet 1, building services comprise all the technical and use-specific equipment installed in a building and connected to it, as well as technical equipment in outdoor facilities and fittings (see also section 4.1, TBM-Specific Terminology Used). If building services are to be automated and applied across trades, additional technical infrastructure for building automation and control systems (BACS) is used. BACS is thus a central tool of TBM. A building can also be operated by TBM without BACS, but BACS is always supported by TBM. Certain components of BACS, such as real-time-capable industrial Ethernet switches, can also be attributed to building services.

While building services in the past were usually operated independently of IT and process control and automation technology (operational technology, OT), network transitions are increasingly being established to these areas today. In addition, aspects of building services are used around the clock. Therefore, changes often have to be carried out parallel to productive use.

The basic values of information security must also be taken into account in TBM because the loss of system availability, confidentiality, and integrity can have far-reaching effects in TBM, even to the point of dangers to life and limb.

Objective

The objective of this module is to establish information security as an integral component of planning, implementation, and operation within the framework of TBM.

Scoping and Modelling

INF.13 Technical Building Management (TBM) is to be applied to every organisation's TBM as soon as buildings with building services are planned, constructed, or operated.

This module encompasses the tasks and processes required for the planning and operation of building services systems (see section 4.1, TBM-Specific Terminology Used). Technical infrastructure for the automated operation of buildings is dealt with in module INF.14 Building Automation and Control Systems (BACS). This module must be applied in addition to INF.13 Technical Building Management (TBM) if the building services to be operated are automated and controlled across all systems. In this sense, TBM also includes BACS processes.

Furthermore, it is possible that the systems to be managed also include those that are modelled by modules from the IND Industrial IT and SYS IT Systems layers (e.g. IND.2.1 General ICS Components or SYS.4.4 General IoT Devices). The aspects of the ORP and OPS layers that are relevant to TBM must also be taken into account, in particular the sub-layers OPS.1 In-house Operation and OPS.2 Operation through Third Parties, as well as the modules ORP.2 Personnel and ORP.4 Identity and Access Management. If cloud services are used for TBM, module OPS.2.2 Cloud Usage must be taken into account for the selection of these services.

The modules OPS.1.2.5 Remote Maintenance and IND.3.2 Remote Maintenance in Industry must be used to secure remote access in TBM.

INF.13 Technical Building Management (TBM) does not deal with the physical safety of buildings; this is dealt with in module INF.1 Generic Building. Similarly, the aspect of safety does not play a prominent role in this module, but is covered in module IND.2.7 Safety Instrumented Systems.

TBM-Specific Terminology Used

Automation level

The automation level is located between the field level and the management level in the automation pyramid. It brings together the data supplied by the field level and the specifications handed down by the management level. This is where the control and regulation of building services systems takes place, but also the monitoring of thresholds, switching states, and meter readings.

Building

This term is used synonymously to refer to buildings, building complexes, properties, and property portfolios in module INF.13 Technical Building Management (TBM) and the associated Implementation Guidance. Furthermore, the term “building” describes not only houses and halls, but structures like television towers or oil rigs, as well.

Building automation and control systems (BACS)

According to VDI 3814-1, building automation and control systems (BACS) comprise all products and services designed for the target-oriented operation of building services.

Building complex

A building complex is a group of buildings that are structurally connected to each other and are perceived as an overall unit.

Building information modelling (BIM)

According to VDI 2552 Sheet 2, BIM is a methodology for the planning, execution, and operation of buildings in a collaborative approach based on a digital information model.

Building services (BS)

According to VDI 4700 Sheet 1, building services (BS) include all technical facilities and use-specific facilities installed in a building and those connected to them, as well as technical facilities in outdoor facilities and equipment. Certain components of BACS can also be attributed to building services, such as real-time-capable industrial Ethernet switches.

Building services system

A building services system describes the totality of all technical components that interact to fulfil certain functions. According to DIN 276 (“Building costs”), examples include heating systems, ventilation systems, and lighting systems.

Computer-aided facility management (CAFM)

According to VDI 3814 Sheet 2.1, CAFM serves as a tool for collecting, processing, preparing, and archiving data and information with the aim of supporting the operating processes and tasks in the operational phase of a building.

Control centre

A control centre (along with operating and observation units) is a technical tool for visualising current processes, states, and situations of processes, including TBM and especially BACS processes.

Demand organisation

According to DIN EN ISO 41011, a demand organisation is an organisational unit within or outside a given organisation that is authorised to make demands of building services, BACS, or TBM for its requirements and to bear the costs of meeting these demands.

Examples: a tenant within a building, an owner of a building, or a service provider within an organisation, such as a canteen.

Field level

The field level represents the lowest level of the automation pyramid and comprises different components of BACS or OT. As a rule, sensors and actuators are operated here. Sensors record information (e.g. movement, brightness, temperature) and send it to the automation level. Actuators receive control information and convert it into switching signals (e.g. for lighting, heating, air conditioning and ventilation systems).

Property

A property comprises a plot of land and the building(s) developed on it. This development includes all immovable property—that is, buildings and other things that cannot be easily removed from the land.

Property portfolio

A property portfolio is the totality of the properties owned by a given entity.

System

In module INF.13 Technical Building Management (TBM) and the associated Implementation Guidance, this term not only refers to an IT system in the traditional sense (cf. modules of the SYS layer), but also includes all BACS components, including all field-level components (such as sensors and actuators).

Technical Building Management (TBM)

According to DIN 32736, Technical Building Management (TBM) comprises all services that maintain the technical function and availability of a building. TBM thus takes over the operation, maintenance, modernisation, and documentation of components for building services and defines all the necessary processes.

Trade

In construction, a trade generally comprises the work that can be assigned to a self-contained construction service area. It is a functional area that can include, in particular, various building services systems.

Example: air-conditioning systems (cost group 430 in DIN 276), which include ventilation systems, air-conditioning systems, and refrigeration systems.

Abbreviations

Useful Resources

Standards and documents cited:

• AI Cloud Service Compliance Criteria Catalogue (AIC4), Federal Office for Information Security, February 2021, available at https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/CloudComputing/AIC4/AI-Cloud-Service-Compliance-Criteria-Catalogue_AIC4.html
• BSI-CS 108—Remote Maintenance in Industry, BSI publication on cyber security, July 2018, available at https://www.allianz-fuer-cybersicherheit.de/SharedDocs/Downloads/Webs/ACS/DE/BSI-CS/BSI-CS_108.pdf
• DIN 276—Building Costs, German Institute for Standardization (DIN), December 2018, available from Beuth-Verlag
• DIN 32736—Facility management—Terminology and scope of services, German Institute for Standardization (DIN), August 2000, available from Beuth-Verlag
• VDI 4700 Sheet 1—Terminology of civil engineering and building services, The Association of German Engineers (VDI), October 2015, available from Beuth-Verlag

Introduction

Building automation and control systems (BACS) automate the operation of buildings fully or partially across all trades and provide the technical infrastructure for this purpose. The fundamental technical functions of a building are provided by its building services, which are operated, maintained, and developed further by Technical Building Management (TBM) services. BACS are thus a central tool of TBM for implementing the operating objectives set for a given building. They include all the products and services involved in the automated operation of building services across various areas. Some of the criteria followed in setting related objectives might include functionality, energy efficiency and sustainability, security, availability, or convenience. BACS can be scaled to services for buildings, building complexes, properties, or property portfolios. In this module, the general term “building” is used to refer to all these things. Any exceptions to this are explicitly cited.

Among other things, BACS perform automation tasks such as automated measurement, control, and regulation, as well as tasks for the monitoring, service and diagnosis, optimisation, operation, and management of building services.

Within a given building, BACS are provided for one or several demand organisations (e.g. tenants). For this purpose, building services are usually controlled separately for different BACS areas—for example, for demand organisations or parts of a building.

In a building, BACS can be implemented by several parallel BACS depending on the building services used. A BACS represents the technical implementation of building automation and control and can also be used for several buildings within a building complex or a property. Different BACS can cooperate, but can also be operated completely independently of each other.

Whereas building services were often not universally automated in the past, BACS are now increasingly being used for overarching control of building services across trades. For this purpose, technologies are being employed more and more often that were originally only used in information technology (IT) and industrial process control and automation technology (operational technology, OT)—communication via the Internet and cloud services, for instance.

Objective

The objective of this module is to establish information security as an integral component of the planning, realisation, and operation of BACS.

Scoping and Modelling

INF.14 Building Automation and Control Systems (BACS) must be applied to the BACS of an organisation from the point that the building services in its buildings are controlled by BACS. This module is only applicable to BACS interfaces to building services systems; the interfaces of building services systems to internal networks and network structures are not the focus here.

INF.14 Building Automation and Control Systems (BACS) deals with systems and services that must be taken into account when BACS (which may consist of several BACS) are planned, set up, and operated. It also deals with specific conditions that apply to networks and network components of BACS.

The following content is also significant, but dealt with elsewhere:

• The general requirements for BACS and building services, which do not predominantly address aspects for automated measurement, control, and regulation across multiple areas, are dealt with in module INF.13 Technical Building Management (TBM). This module should always be considered along with the present module.
• Requirements for general infrastructure, in particular for buildings and rooms or workplaces, are dealt with in the modules of layer INF Infrastructure (e.g. module INF.1 Generic Building).
• If parts of the BACS an organisation requires are provided by another organisation, such as a service provider in the role of building operator (operator organisation), module OPS.2.1 Outsourcing for Customers must be applied to the provision and operation of the BACS.
• Specific requirements for BACS components that can also be used for the area of industrial IT or OT are addressed in the modules of the IND Industrial IT layer (see e.g. module IND.2.3 Sensors and Actuators or module IND.2.7 Safety Instrumented Systems).
• Module NET.1.1 Network Architecture and Design deals with the basic aspects of networks to the extent that they apply not only to office IT, but also to BACS and industrial IT. General requirements for the protection of network components are dealt with in the module group NET.3 Network Components (see e.g. module NET.3.1 Routers and Switches).
• In addition, all appropriate organisational and technical modules for servers and applications must be applied. For remote access to BACS components, for example, OPS.1.2.5 Remote Maintenance must be applied.
• If the networking of buildings is cloud-based, module OPS.2.2 Cloud Usage must also be applied.

BACS-Specific Terminology Used

Alarm system

Alarm systems are building services systems that can detect and report hazards such as intrusion, fire, and smoke. They detect hazards by interacting with sensors or operating units and generate hazard messages that are sent to a central component.

BACS area

A BACS area comprises one or more rooms intended for similar use (which may be distributed horizontally, vertically, or in a combination of both) and includes several BACS segments.

Examples: a corridor, a floor, a wing of a building, a production hall.

BACS segment

A BACS segment is the smallest spatial unit for which BACS functions are applicable. A BACS segment should not be confused with a network segment, which is separated from the rest of a network by security elements.

BACS-specific networks

A BACS-specific network is a network that uses cabling that is usually not based on Ethernet technology (e.g. the KNX bus system) or uses specific protocols that are not based on IP and Ethernet according to IEEE 802.3 (e.g. BACnet). Specific protocols may be necessary due to real-time communication requirements or a reduced protocol scope.

Building automation and control systems (BACS)

According to VDI 3814-1, building automation and control systems (BACS) comprise all products and services that support the automated, target-oriented operation of building services.

According to VDI 3814-1, a single building automation and control system (also abbreviated as BACS) represents the technical realisation of building automation and comprises the following parts:

• BACS management
• System automation and control
• Room automation

Like in the case of operational technology (OT), system automation and room automation consist of the (functional) automation level (e.g. system controls) and the field level (e.g. actuators and sensors).

Building services (BS)

According to VDI 4700 Sheet 1, building services (BS) include all technical facilities and use-specific facilities installed in a building and any further facilities connected to them, as well as technical facilities in outdoor facilities and equipment. Certain components of BACS can also be attributed to building services, such as real-time-capable industrial Ethernet switches.

Building services system

A building services system describes the totality of all technical components that interact to fulfil certain functions in a building. According to DIN 276 (“Building costs”), examples include heating systems, ventilation systems, or lighting systems. In cases involving automation, systems are integrated into or coupled with BACS.

Control centre

A control centre (see also "control and display device") is a technical tool for visualising current workflows, states, and situations of BACS processes.

Control and display device (CDD)

According to DIN EN ISO 16484-2, control and display devices (also referred to as control centres or control rooms) comprise any user facilities that act as an interface to the operating and management functions of a BACS.

Coupling of systems or installations

According to VDI 3814-2-2, the coupling of systems and installations enables them to send their information to BACS without limiting or losing their self-sufficiency. This means a system or installation coupling generally has no adverse effects.

Examples: a fire alarm system or intruder alarm system.

Demand organisation

According to DIN EN ISO 41011, a demand organisation is an organisational unit within or outside of a given organisation that is authorised to make corresponding demands of building services, BACS, or TBM for its requirements and to bear the costs of meeting these demands.

Examples: a tenant within a building, the owner of a building, a service provider within an organisation (e.g. a canteen)

Integration of systems or installations

According to VDI 3814, the integration of systems or installations enables them to exchange information with M-BACS and thereby influence each other.

System integration in the context of BACS must be distinguished from embedded systems. These are intelligent elements that are embedded in other systems and take over largely invisible monitoring, control, processing, or regulation functions in the surrounding system.

Local override (LOR)

According to VDI 3814-1, a local override is an interface to BACS-relevant components that enables limited operation independent of automation devices with priority display, switching, and/or control. Example: the manual priority operation of fans.

Management building automation and control systems (M-BACS)

Management building automation and control systems (M-BACS), which are also referred to as building management systems, are a component of a BACS that handles information processing tasks for the management of the BACS (e.g. functions for higher-level energy management, maintenance management, fault management, and room booking management).

Non-reaction

A non-reactive connection between a building services system and BACS means that the building services system supplies information to the BACS, but cannot be influenced by it on the basis of this information. The system thus remains autonomous.

Property

According to VDI 3814-1, a property comprises one or more buildings that are usually adjacent.

Room automation and control (RAC)

Room automation (RA) is a BACS component that handles all tasks related to cross-system automation in the room under consideration (e.g. the operation of the technology installed in the room).

System automation and control (SAC)

System automation and control (SAC) is part of BACS. It implements automation for the energy-efficient, economical, and safe operation of building services systems. SAC controls building services system and their status variables via actuators. These are in turn recorded by the sensors of each building services system.

Trade

In construction, a trade generally comprises the work that can be assigned to a self-contained construction service area. It is a functional area that can include, in particular, various building services systems.

Example: air-conditioning systems (cost group 430 in DIN 276), which include ventilation systems, air-conditioning systems, and refrigeration systems.

Technical Building Management (TBM)

According to DIN 32736, Technical Building Management (TBM) comprises all services that maintain the technical function and availability of a building. TBM thus handles the operation, maintenance, modernisation, and documentation of components of building services and defines all the necessary processes.

Abbreviations

Useful Resources

Standards and documents cited:

DIN EN ISO 16484—Building automation and control systems (BACS)

• DIN EN ISO 16484-1—Building automation and control systems (BACS)—Part 1: Project specification and implementation, DIN/EN/ISO, March 2011, available from Beuth-Verlag
• DIN EN ISO 16484-2—Building automation and control systems (BACS)—Part 2: Hardware, DIN/EN/ISO, October 2004, available from Beuth-Verlag
• DIN EN ISO 16484-3—Building automation and control systems (BACS)—Part 3: Functions, DIN/EN/ISO, December 2005, available from Beuth-Verlag
• DIN EN ISO 16484-5—Building automation and control systems (BACS)—Part 5: Data communication protocol, DIN/EN/ISO, December 2017, available from Beuth-Verlag

DIN 32736—Building management—Terminology and scope of services, German Institute for Standardization (DIN), August 2000, available from Beuth-Verlag

DIN EN ISO 41011—Facility management—Vocabulary, DIN/EN/ISO, April 2019, available from Beuth-Verlag

DIN 276—Building Costs, German Institute for Standardization (DIN), December 2018, available from Beuth-Verlag

VDI 4700 Sheet 1—Terminology of civil engineering and building services, The Association of German Engineers (VDI), October 2015, available from Beuth-Verlag

VDI 3814—Building automation and control systems (BACS)

• VDI 3814 Sheet 1—Building automation and control systems (BACS)—System basics, The Association of German Engineers (VDI), January 2019, available from Beuth-Verlag
• VDI 3814 Sheet 2.1—Building automation and control systems (BACS)—Planning— Requirements planning, The Association of German Engineers (VDI), January 2019, available from Beuth-Verlag
• VDI 3814 Sheet 2.2—Building automation and control systems (BACS)—Planning— Planning content, system integration, and interfaces, The Association of German Engineers (VDI), January 2019, available from Beuth-Verlag
• VDI 3814 Sheet 2.3—Building automation and control systems (BACS)—Planning— Concept of operation and user interfaces, The Association of German Engineers (VDI), September 2019, available from Beuth-Verlag
• VDI 3814 Sheet 3.1—Building automation and control systems (BACS)—BACS functions—Automation functions, The Association of German Engineers (VDI), January 2019, available from Beuth-Verlag
• VDI 3814 Sheet 4.1—Building automation and control systems (BACS)—Methods and tools for planning, building, and acceptance tests—Identification, addressing, and lists, The Association of German Engineers (VDI), January 2019, available from Beuth-Verlag
• VDI 3814 Sheet 4.2—Building automation and control systems (BACS)—Methods and tools for planning, building, and acceptance tests—Requirements, content of planning, and system integration, The Association of German Engineers (VDI), January 2019, available from Beuth-Verlag
• VDI 3814 Sheet 4.3—Building automation and control systems (BACS)—Methods and tools for planning, building, and acceptance tests—BACS automation scheme, BACS function list, BACS functional description, The Association of German Engineers (VDI), November 2020, Draft, available from Beuth-Verlag
• VDI 3814 Sheet 6—Building automation and control systems (BACS)—Qualification, roles, and competencies, The Association of German Engineers (VDI), April 2020, Draft, available from Beuth-Verlag

VDMA 24774—IT security in building automation. VDMA, German Engineering Federation, February 2021, available from Beuth-Verlag