How to sequence network hardening in a multi-building energy retrofit roadmap

For a multi-building energy retrofit, bring the electrical engineer, controls integrator, IT team, and building operator to a dependency review. Use the questions below to agree the sequence for this site and record who may approve each transition.

Contents

Key takeaways

How to review dependencies between network hardening and electrical upgrades

Identify which network and electrical tasks depend on each other before approving parallel work. The Federal Energy Management Program warns that connecting energy management information systems to building automation and utility controls involves physical assets that could harm a building or its occupants if a malicious act or human error were introduced. Have the engineer document the operating state if electrical work finishes before the planned network controls, including who would authorise the transition.

The Federal Energy Management Program cites NIST's definition of operational technology as programmable systems or devices that interact with the physical environment, including building management systems. It also notes that availability is critical in the cyber-physical world for OT systems, while confidentiality and integrity may be prioritised differently than in IT. Ask the operator which services must remain available, what outage is proposed, and who approves the return to service.

During the review, record each proposed connection on one line: the building it serves, the control system at each end, the planned electrical change, the person responsible for the connection, and the operating state while work is incomplete. If one team assumes a connection will be ready before another team plans to test it, mark that as an unresolved dependency. Agree whether the schedule can proceed with that question open or whether a named reviewer must close it first.

How to sequence network hardening in a multi-building energy retrofit roadmap

How to sequence network hardening in a multi-building energy retrofit roadmap.

How to agree a sequence for physical security, IT networks, and power distribution

Use this worksheet to agree a sequence for the site. It is not a prescribed order from ISA or the Federal Energy Management Program:

For each decision, name a reviewer, supporting record, and unresolved question. Revisit the register when equipment or interfaces change.

This worksheet is not a universal installation rule. A project may have different teams, access arrangements, and operating constraints in each building. Ask the site team to set the actual order and explain what evidence allows a stage to begin. If physical access and network-interface reviews disagree about a handoff, put both decisions in front of the person responsible for approving that handoff. Record the resolution.

What is the correct sequence for physical security, IT networks, and power distribution

What is the correct sequence for physical security, IT networks, and power distribution.

What should you ask about IEC 62443 and zone boundaries during a phased retrofit

ISA states that the ISA/IEC 62443 series of standards defines requirements and processes for implementing and maintaining electronically secure industrial automation and control systems. It sets cybersecurity benchmarks in industry sectors including building automation and electric power generation and distribution. The overview does not specify a zone layout or an energisation gate for this campus.

Ask the controls integrator which parts of the full standard they propose to use, how they would document boundaries for each phase, and who will review a temporary connection between IT and OT. Obtain the relevant standard text for the design review rather than treating this summary as a design specification.

Request a diagram for the existing arrangement and a separate diagram for the proposed interim arrangement. Have the integrator point to each interface that changes during the phase and explain who can approve it. If the drawing uses a term such as “zone,” ask the team to define it for this project and identify the document that governs the boundary. Do not infer from the overview page that one particular zone layout has been approved.

How to schedule building phases across a multi-building campus without cascading delays

Review the proposed schedule building by building. For each handoff, ask what must be completed elsewhere and what the team would do if that prerequisite were delayed:

For example, if Building B is scheduled to use a shared connection while Building A is under construction, ask the operator whether that connection actually serves both buildings. Then ask the controls team what temporary arrangement is proposed, who reviews it, and how the schedule records a delay in A. Use this example only if such a shared connection exists at your site. Use the answer to revise the phase plan before approving the next handoff.

What checklist validates network readiness before energizing new power distribution equipment

Use the following questions to validate readiness. Record the person answering each question, the supporting project document, and any decision still outstanding.

Attach the answer to each question to a drawing, test record, or signed decision. The word “reviewed” alone does not tell the operator what changed. Where the answer remains unknown, identify who will investigate it and when the decision must be made. Ask the electrical engineer and operator to state separately what they need before energisation; the cybersecurity review should inform their decision without pretending that the cited overview alone authorises the electrical work.

Which sequencing assumptions should the project team challenge

Challenge a uniform replacement schedule. The Federal Energy Management Program notes that due to the complexity and cost of acquiring new equipment, OT is frequently not replaced at the same rate as consumer or informational technologies, creating challenges in protecting legacy systems from cybersecurity threats. Ask each building team which controls they can replace and which need a separate review.

Ask how the design addresses the physical consequences of each EMIS connection, and how the operator weighed availability alongside confidentiality and integrity for the affected OT. The Federal Energy Management Program identifies both issues; the correct decision for this site needs its own documented assessment and accountable reviewers.

Compare the phase plan with the register before sign-off. Can every scheduled handoff point to a current drawing and an owner? Are temporary arrangements recorded separately from the intended final state? Can a reviewer tell which services the operator expects to remain available? If an answer differs between buildings, keep the difference visible instead of copying a single assumption across the campus. These checks help the team make an explicit local decision; they do not substitute for the project's engineering or security approvals.

Frequently asked questions

Does ISA/IEC 62443 prescribe the order of this retrofit? ISA states the series defines requirements and processes for securing industrial automation and control systems; it does not provide a building-by-building construction schedule. Ask the responsible team which parts of the full standard apply to this design.

Why review existing building controls separately? The Federal Energy Management Program says OT is frequently not replaced at the same rate as consumer or informational technologies due to the complexity and cost of acquiring new equipment. Identify which controls will remain before making a schedule assumption.

What should the sequencing review produce? Keep a dated dependency list, named reviewers, agreed transition conditions, and unresolved decisions with the commissioning documents. Update the list when the design changes.

For more on this topic, see other guides on this site.