A contractor arrives during a busy maintenance window. The guard checks a badge that appears valid, the contractor follows a staff member through a controlled door, and the visit proceeds without unusual attention. Later, the security team discovers that the badge was cloned. The visitor reached a restricted area containing network-connected building equipment, and a physical access lapse has become a cybersecurity investigation.
That scenario is uncomfortable because it doesn't require an exotic attack. It depends on familiar weaknesses, including tailgating, incomplete visitor records, unclear contractor ownership, and systems that Facilities and IT each assume the other team manages. A 2026 survey summary reported that 88% of U.S. business and security leaders said their organizations were experiencing more physical security threats than in 2021, while phishing was involved in roughly 85% of business cyber incidents, showing that threats are rising on both fronts (Security Magazine's survey summary).
For facility managers, cybersecurity and physical security now belong in the same operating conversation. The practical work involves doors, cameras, control panels, contractors, cleaning teams, work orders, credentials, and incident records. It also involves knowing when a technical issue needs a physical response, or when a suspicious physical event requires IT to isolate a system.
Your First Line of Defense Is No Longer Just a Wall
A wall can delay entry, but it can't tell you whether a badge belongs to the person using it, whether a camera recording is trustworthy, or whether an access-control server has been tampered with. Modern facilities depend on connected cameras, badge systems, visitor platforms, elevators, HVAC controls, and other operational technology. Each system creates useful visibility, but each also creates another dependency that someone must secure and maintain.
The contractor scenario shows why the old division of responsibility fails. Facilities may own the doors and cameras, IT may manage the network, and Security may review alarms. If no one owns the relationship between those systems, an attacker can exploit the gap rather than defeat a well-configured product.
Practical rule: Treat every connected physical system as both a facility asset and a potential technology asset.
The response isn't to turn every facilities professional into a security engineer. It's to establish shared procedures. A contractor's badge should have an accountable sponsor, a defined access area, an expiration process, and a record that IT and Security can use during an investigation. A camera outage should trigger more than a maintenance ticket when that camera protects a server room, loading dock, or telecom closet.
Small operational lapses create larger exposure
The same principle applies to routine work. A janitorial vendor may need access to offices after hours. A mechanical contractor may need entry to a plant room. A fitness center may issue temporary credentials to instructors, student staff, or event workers. Those arrangements are normal, but they need consistent approval, monitoring, and removal.
The response plan should also account for physical evidence. Teams may need access logs, video, visitor records, alarm history, work orders, and network events at the same time. If records sit in separate systems with different retention rules, investigators lose time and may struggle to establish what happened.
A technical sweep can also be appropriate when a facility suspects unauthorized recording devices or unusual activity in sensitive rooms. For organizations assessing that risk, office bug sweep services can provide context on specialist physical counter-surveillance work without replacing normal access-control and network controls.
The central question is simple: who can enter, what can they reach, which system records it, and who responds when the event looks wrong? That question puts facility managers on the front line of digital defense, even when their job title sits outside IT.
Why Security Convergence Is Your New Reality
Security convergence means that previously separate security functions share information, policies, risk decisions, and response responsibilities. In 2021, CISA defined cybersecurity and physical security convergence as “formal collaboration between previously disjointed security functions,” and promoted a strategy in which a weakness in one layer can be mitigated by controls in the other (CISA's Convergence Action Guide).
A useful analogy is the modern smartphone. One device may replace a wallet, keys, tickets, identification, and communication tools. That convenience reduces the number of objects a person carries, but it also concentrates capability in one place. A compromised account can affect several parts of daily life at once.
Buildings have followed the same pattern. A credential may open a door, authorize a visitor, identify a user in a video system, and connect to a central access platform. A building automation network may control temperature, ventilation, lighting, and other equipment while using the organization's broader communications infrastructure. Integration makes operations easier, but it can also create single points of failure.
From separate teams to shared risk
The old model asks whether an issue belongs to the guard force, Facilities, Security, or IT. The converged model asks what could happen to people, operations, information, and business continuity if the issue remains unresolved.
That change affects everyday decisions:
- Access changes: Removing a user from an application isn't enough if a physical badge remains active.
- Vendor selection: A camera or visitor platform needs both physical-function and cybersecurity review.
- Maintenance: Firmware, passwords, remote access, and service accounts belong in the maintenance record.
- Incident response: A forced door, unusual badge use, and suspicious network activity may be one event.
- Continuity planning: A cyber outage can affect entry, elevators, HVAC, surveillance, or emergency communications.
Facilities leaders don't need to own every control. They do need a seat in decisions about systems that affect the building. IT can manage network architecture, identity, monitoring, and endpoint controls. Facilities can explain equipment dependencies, safe operating states, service access, and consequences of shutting down a system. Security can connect alarms, patrols, video, and investigations.
Efficiency isn't the same as resilience
A unified platform may simplify administration, but it doesn't automatically create a unified program. A shared dashboard won't resolve unclear ownership, weak vendor contracts, excessive privileges, or missing response drills. Teams need documented authority to act when a system is compromised, including who can disable a badge, isolate a device, preserve footage, or contact a service provider.
Facility leaders looking for practical guidance on avoiding digital problems turning into physical ones should start with those operating decisions, not with a technology shopping list. The strongest program connects people, procedures, systems, and physical consequences.
Where Digital and Physical Worlds Collide
Cross-domain failures usually begin with an ordinary facility component. The risk becomes serious when that component has network access, weak administration, poor monitoring, or a response process that stops at the department boundary.
HVAC and building controls
An HVAC controller may be physically located in a plant room, but its management interface can be reachable through a building network or vendor connection. If credentials, remote access, or segmentation are weak, an attacker may use the controls as an entry point into other systems.
The physical consequence can include unsafe environmental conditions, disrupted operations, equipment stress, or a building shutdown while engineers restore trustworthy control. The cyber response can't focus only on malware. Facilities must identify safe manual modes, critical equipment dependencies, and the service provider authorized to recover the system.
A building automation system overview can help facility teams frame these controls as operational technology rather than ordinary office software.
Cameras and the evidence problem
Cameras support prevention, verification, investigations, and safety. They can also be disabled, misconfigured, disconnected, or manipulated if administrators don't protect the management platform and recording infrastructure.
The operational damage is larger than a blind spot. If an unauthorized person enters a sensitive area while footage is unavailable, investigators may need to combine badge events, visitor records, patrol notes, door alarms, and network logs. In a 2026 industry survey, nearly half of security teams reported taking more than 30 minutes to find the right video footage after an incident, highlighting a response gap between physical systems and cyber investigations (State of Physical Security survey).
That delay can affect containment and confidence. Teams should know which camera covers each critical area, how footage is searched, who can export it, how exports are protected, and what happens when the recording server is part of the suspected incident.
Visitor management and restricted areas
A visitor platform can improve reception workflows, but it becomes a serious control when it issues credentials or determines where a visitor may go. A compromised account, inaccurate host record, or poorly configured permission can allow access beyond the intended appointment.
The attack path may begin with social engineering, stolen credentials, or an unreviewed integration with access control. The physical outcome could be entry to a server room, records area, control room, or loading zone. The audit question is not whether the visitor was registered. It is whether the system enforced the approved destination and whether a person verified the visitor at the point of access.
Maintenance access and connected equipment
Maintenance teams often have legitimate reasons to connect laptops, removable media, diagnostic tools, or vendor equipment. That work should be controlled without making safe maintenance impossible.
Use approved devices, named accounts, time-limited access, documented work orders, and an escort process for sensitive areas. If a technician reports a system anomaly, Facilities and IT should preserve relevant logs before making changes that might erase evidence.
Mapping Your Key Controls and Technologies
A facility audit should start with a map, not a product catalog. List each system, its physical location, its owner, its network relationship, its vendor access path, and the operational result of failure. OT environments supporting building controls should use a definitive record based on asset inventories, passive monitoring, and point-in-time active scanning, then validate that record for completeness, accuracy, and consistency (joint cybersecurity guidance summarized by Skadden).
Physical access control systems
PACS includes badge readers, controllers, door hardware, credential databases, alarms, and management consoles. Begin with the doors that protect critical systems, not just the main entrance. Identify who approves access, who creates credentials, who reviews exceptions, and who removes access when employment or a contract ends.
Check controller cabinets, telecom closets, and panels for unauthorized physical access. Confirm that service accounts are documented, vendor connections are approved, and event logs reach a location that investigators can review. A badge reader isn't secure merely because it opens the correct door. It must also be protected as a networked device.
Facility managers comparing business security systems in Indiana should apply the same questions to any market. Ask how the system handles identity, permissions, updates, outages, audit records, and recovery.
Video surveillance
CCTV has two jobs, prevention and evidence. Protect cameras from tampering, protect recording servers from unauthorized access, and verify that time settings are consistent enough to compare video with badge and alarm events.
Don't rely on a wall of live feeds as proof of coverage. Test searches by location, time, person, and event. Confirm that authorized staff can export footage without allowing broad administrative access. Decide in advance how the team preserves original files and documents any conversion or transfer.
Building automation and OT
OT includes equipment that senses or changes the physical environment. HVAC, lighting, elevators, pumps, generators, and access systems may have different safety and availability requirements from ordinary IT assets.
Create an inventory that identifies criticality, exposure, availability needs, and safe failure states. Replace default credentials, restrict remote access, separate vendor accounts, and require a work order for changes. Passive monitoring can reveal unexpected communication without disrupting sensitive equipment, while carefully controlled active scanning can support validation.
Network segmentation
Segmentation limits how far an attacker can move after reaching one device. It doesn't replace strong authentication, patching, monitoring, or physical protection, but it makes a single compromise less likely to become a building-wide event.
NIST and CISA guidance recommends layered protection, treating a physical compromise of a badge reader, telecom closet, or control room as a potential cyber entry point that requires physical access restrictions and network segmentation (Operational Technology activities and outcomes). Facilities should ask IT to explain, in operational language, which systems can communicate, which cannot, and what remains available if the corporate network is isolated. Guidance on physical access control can support that conversation, especially when teams need to connect door hardware decisions with broader risk controls.
A Practical Framework for IT and Facilities Collaboration
Technology programs fail when ownership stops at the procurement stage. A camera vendor may install equipment, IT may provide connectivity, Facilities may manage the room, and Security may watch the alerts. Unless the organization assigns responsibilities for configuration, patching, access reviews, outages, evidence, and vendor escalation, the system has several participants but no accountable owner.
A 2019 ASIS Foundation study found that only 24% of respondents had already converged physical and cybersecurity functions, indicating that governance and organizational design remain major obstacles (Genetec's physical security report). The solution is a recurring operating rhythm, supported by a written division of duties.
Use one shared checklist
| Action Area | Key Questions to Address | Responsibility |
|---|---|---|
| Shared system ownership | Who manages the camera network, access platform, visitor system, and building controls? Who approves changes and handles outages? | Joint |
| Asset inventory | Which devices exist, where are they located, what do they connect to, and how critical are they to operations? | Joint |
| Identity and credentials | Who issues, reviews, suspends, and removes badges, administrator accounts, vendor accounts, and service credentials? | Joint |
| Network protection | Which systems are segmented? Which connections are necessary? Who monitors unusual traffic or unauthorized configuration changes? | IT Lead |
| Physical protection | Who controls access to controller panels, telecom closets, control rooms, server areas, and recording equipment? | Facilities Lead |
| Vendor security review | Does the supplier document remote access, updates, logging, support accounts, incident notification, and recovery responsibilities? | Joint |
| Change management | What work order, approval, testing, and rollback process applies before a system or device changes? | Joint |
| Incident response | Who can disable a badge, isolate a device, preserve footage, contact a vendor, and authorize a safe operational state? | Joint |
| Evidence handling | Where are logs and video stored? Who can export them? How does the team preserve integrity and document access? | Joint |
| Exercises and review | When will teams rehearse a cross-domain incident and update risks, contacts, procedures, and dependencies? | Joint |
Make the meeting operational
The first joint meeting shouldn't begin with a debate about platforms. Walk the building together. Visit the main entrance, security desk, telecom spaces, control rooms, camera recording location, loading dock, and any area where vendors connect equipment. Ask each team member what happens when power, network access, badge service, or camera recording fails.
Then select one realistic exercise. For example, a contractor badge opens a restricted door, the associated camera stops recording, and the connected device generates an unusual network alert. The exercise should test notification, authority, isolation, physical verification, evidence preservation, occupant safety, and vendor escalation.
The best incident plan is the one that tells people what they can do before they need permission from three departments.
Facilities should bring operational constraints to the table. Shutting down a controller may create safety or comfort problems. IT should explain containment options and dependencies without assuming that every device can be treated like a standard workstation. Security should define how guards, dispatchers, and investigators record and escalate what they see.
Review the checklist after exercises, vendor changes, renovations, staffing changes, and major work orders. A document that no one updates becomes another disconnected system.
Building a Resilient Security Posture for 2026 and Beyond
A resilient security program shows its value during an ordinary disruption. A badge reader fails, a camera loses connectivity, or a vendor arrives with equipment that no one expected. IT, Facilities, and Security should know who verifies the condition, who can isolate the affected control, and how operations continue safely.
The strongest facilities programs turn that expectation into repeatable habits:
- They inventory dependencies: Teams document which doors, cameras, controllers, networks, work orders, and vendors support each critical operation.
- They assign ownership: Each shared system has named people responsible for approval, maintenance, monitoring, escalation, and response.
- They practice failure: IT, Facilities, and Security rehearse incidents that cross physical and digital boundaries.
- They preserve evidence: Logs, footage, visitor records, and work orders remain searchable, access-controlled, and protected from routine deletion.
- They improve continuously: Incidents, exercises, audits, and maintenance work produce specific updates to procedures and handoffs.
CISA's convergence guidance provides a foundation for treating cybersecurity and physical security as one coordinated risk-management discipline (CISA's action guide). Facility leaders can apply that principle through a facility risk assessment, starting with the rooms, systems, and dependencies whose failure would disrupt safety or operations. The assessment should also identify where IT and Facilities use different names, records, approval paths, or response assumptions.
Routine controls protect people while the digital program matures. Train janitorial and maintenance staff to report propped doors, unfamiliar devices, damaged readers, and unusual behavior. Keep emergency procedures current, and prevent slips and trips through housekeeping, prompt spill response, adequate lighting, signage, and work-order follow-through. Workplace safety resources report that slips, trips, and falls cause nearly 700 workplace fatalities each year (slip and trip prevention guidance).
Janitorial training should reinforce the same discipline: follow documented procedures, report damaged security equipment, and preserve access-control conditions while cleaning or servicing shared areas. CDC guidance also requires disinfectant surfaces to remain wet for the full contact time stated on the product directions or Safety Data Sheet (CDC facility cleaning guidance).
Operational takeaway: Secure the building you have, document how it works, and make IT and Facilities jointly accountable when one control fails.
Start this week with a joint walkthrough of entrances, telecom closets, control rooms, camera infrastructure, and vendor access points. Record each system owner, identify one unresolved handoff between IT and Facilities, and schedule a short cross-domain incident exercise before buying another tool.
Leave a Reply