BMS, EPMS & DCIM — Data Center Control Systems, Engineered as Industrial OT
Threat detection and prevention rate
EuroShield advises data center developers, operators, investors, and hyperscale tenants on the architecture, integration, and security of the control systems that run the facility: the Building Management System (BMS), Electrical Power Monitoring System (EPMS), Data Center Infrastructure Management (DCIM) platform, and the subordinate controllers for chillers, CDUs, UPS, generators, fire-suppression, access control, and environmental monitoring.
These systems are almost always specified as “building services.” They should not be. On an AI-dense data center, the BMS dictates how the hall survives a transient load event; the EPMS determines whether a power anomaly is contained or propagated; the DCIM is the authoritative source for the regulatory disclosures now flowing into EU EED and CSRD reports; and the subordinate controllers — protocol-fluent, network-connected, often internet-reachable — represent the largest unmanaged cyber-physical attack surface on the site. A control system specified as a BMS contract is unlikely to be commissioned as an OT system. That gap is where operational and regulatory risk concentrates.
Why Data Center Controls Demand Industrial-OT Rigour
Three structural realities separate a credible DC-OT programme from a building-services specification:
Process-consequence class. Loss or manipulation of a BMS or EPMS on an AI data center can trip thermal envelopes in seconds, cascade power faults across redundancy domains, and corrupt the evidence trail that feeds regulated sustainability disclosure. The consequence profile is industrial, not commercial.
Protocol and connectivity exposure. BACnet, Modbus TCP, SNMP, LonWorks, KNX, DNP3, IEC 61850, OPC-UA, MQTT, and vendor-proprietary controls are routinely exposed across the facility network, frequently bridged to IT networks, and often reachable from OEM remote-support tunnels. Most are authenticated weakly or not at all.
Regulatory reclassification. NIS2 covers data center operators and trust-service providers as essential or important entities in most member-state transpositions. EU CRA covers in-scope BMS and EPMS components as "products with digital elements." EU EED Article 12 makes the DCIM data trail a regulated disclosure. The building-services treatment is no longer regulatorily defensible.
EuroShield’s position: a data center is an industrial facility with a commercial tenant base. The control systems that run it should be specified, architected, tested, and operated as industrial operational technology — not as facility-management plumbing.
Architecture, Zoning & Specification
- DC-OT architecture design against the Purdue reference model, adapted to DC topology: Level 0 field devices (chillers, CDUs, UPS, generators, sensors), Level 1 controllers, Level 2 supervisory (BMS, EPMS), Level 3 site operations (DCIM), Level 3.5 industrial DMZ, Level 4/5 corporate
- IEC 62443-3-2 zones-and-conduits definition for DC control networks, with documented Target Security Levels per zone
- Controls-network physical infrastructure review against TIA-942 and EN 50600-2-4, including segregation from tenant and IT networks
- Subordinate-controller specification: PLC, RTU, and industrial controller selection against IEC 62443-4-2 component requirements
- Time-synchronisation architecture (PTP, NTP) and its integrity — often overlooked, material for forensic-evidence defensibility
BMS / EPMS / DCIM Platform Selection
- Use-case catalogue and functional-requirement capture: what the control systems must do, measure, and report — before what they must be
- Vendor-neutral shortlisting against scored evaluation criteria: protocol breadth, cyber posture against IEC 62443-4-1/4-2, integration openness, licensing model, data-sovereignty architecture, regional support, AI-workload-awareness, and disclosure-reporting fit
- Structured PoC methodology with procurement-defensible scoring
- Integration architecture: BMS ↔ EPMS ↔ DCIM ↔ SIEM ↔ sustainability-reporting platform, engineered for a single source of truth rather than four competing ones
- Data-sovereignty and cloud-residency review: which platform data leaves site, to which region, governed by which agreement — mapped against GDPR, FINMA, UAE PDPL, KSA PDPL, and DPDP where applicable
Security Architecture for DC Control Systems
- Network segmentation between facility-OT, tenant-IT, corporate-IT, and tenant-OT domains where multi-tenant facilities host industrial or regulated workloads
- Industrial DMZ for DC-OT, engineered to IEC 62443 conduit principles
- Secure remote access for OEM vendors, service contractors, and operations staff — brokered, session-recorded, just-in-time
- Identity and privileged-access architecture for control-system administrators, operators, and vendors
- Authentication, authorisation, and accountability across BMS, EPMS, and DCIM platforms — including the elimination of shared service accounts, a recurring finding across existing DC estates
- Secure protocol implementation: certificate-based OPC-UA where supported, BACnet/SC migration, legacy-protocol mitigation where replacement is not feasible
- Cyber-physical interlock design: the boundaries where a cyber event must not propagate into a thermal or electrical safety action without engineer-in-the-loop confirmation
Integration with Facility-Wide Cyber & Reporting Programmes
- Telemetry aggregation from BMS, EPMS, and DCIM into OT-monitoring platforms (Claroty, Nozomi, Dragos, Defender for IoT — neutral across)
- Alert correlation between control-system events and tenant-network events where multi-tenant cyber visibility is required
- Evidence-chain engineering for EU EED Article 12 reporting, CSRD disclosures, and IEC 62443 audit cycles — the metering data is only defensible if the control-system data path is
- Cyber-incident integration with NIS2 Article 23 reporting workflow
- Backup, recovery, and integrity-verification strategy for BMS, EPMS, and DCIM configurations — including tested offline restore