For most of BACnet's life, the security conversation was short, because there wasn't one. BACnet/IP sends unencrypted UDP broadcasts across whatever network it's given. That was acceptable when building systems lived on isolated wiring nobody else touched. It is not acceptable to an IT department in 2026.
BACnet Secure Connect — BACnet/SC — is the standard's answer. If you work on building networks, you will be asked about it, and increasingly you'll be asked to justify a design in terms IT recognises: TLS, certificates, segmentation, audit logging.
What actually changes for you in the field
No more broadcasts, no more BBMDs
This is the biggest practical shift. BACnet/IP discovery depends on broadcasts, and broadcasts don't cross routers — which is the entire reason BBMDs and Foreign Device Registration exist. BACnet/SC replaces that model with direct connections through a hub, so the whole class of BBMD misconfiguration problems simply goes away.
A hub replaces the broadcast domain
Devices connect to a hub rather than shouting on a segment. That hub becomes a real piece of infrastructure you have to plan for — where it lives, how it's sized, and what happens when it's unavailable. Most implementations support a failover hub for exactly that reason.
Certificates become your problem
Every device needs a certificate. Certificates expire. Somebody has to issue them, install them, track expiry dates and renew them before they lapse. If you have worked through an OPC UA certificate trust failure, this will feel familiar — and if you haven't, it is worth understanding that model before you deploy.
Traffic is encrypted, which cuts both ways
Good: it satisfies IT, and it means a compromised workstation can't trivially read or spoof building traffic. Less good: you cannot simply put Wireshark on the segment and read BACnet in plain text any more. Your troubleshooting workflow changes.
What it doesn't change
Worth being clear about, because there is some marketing enthusiasm around this topic.
- It doesn't change the object model. Analog inputs, priority arrays, present value, COV subscriptions — all identical. Everything you know about BACnet objects still applies.
- It doesn't secure MS/TP. Your RS-485 trunks are unchanged. BACnet/SC operates at the IP layer.
- It doesn't retrofit itself. Existing devices need firmware that supports it, or a router that bridges between SC and legacy BACnet.
- It doesn't remove the need for segmentation. Encryption protects traffic in transit. It does not mean building controllers belong on the same network as the accounting department.
The questions IT will ask, and what they mean
| What IT asks | What they're actually asking | Reasonable answer |
|---|---|---|
| “Is it encrypted?” | Can traffic be read or modified on the wire? | With BACnet/SC, yes — TLS. With BACnet/IP, no. |
| “How are devices authenticated?” | Can anything just join the network and start writing? | Certificate-based under SC. Under BACnet/IP, effectively not at all. |
| “What's your segmentation plan?” | Can a compromised office PC reach a controller? | A separate OT network or VLAN, with policy at the boundary. |
| “Who manages the certificates?” | Is this going to become our problem in three years? | A real question — decide it before deployment, not after. |
| “What ports do you need open?” | Give me a firewall rule I can justify. | Far simpler under SC than the UDP broadcast model. |
A realistic view for retrofit work
Where it does come up on existing sites, it is usually at the supervisory layer first: the connection between a supervisor and the wider network, rather than every field controller.
What to do about it now
- Find out whether the platforms you work on support it, and at what firmware level.
- Understand the certificate lifecycle before you have a site depending on it. Expiry is the failure mode that catches people.
- Be able to explain the segmentation argument without relying on the protocol to make it for you.
- Don't oversell it. BACnet/SC solves transport security. It does not solve a flat network, shared credentials, or an unsupported controller running firmware from 2009.
The underlying shift is that building networks are now part of the IT conversation whether we like it or not. The technicians who can hold that conversation credibly — in IT's vocabulary, without overclaiming — are the ones who get to influence how these systems get designed.
Go deeper
This is the same method, applied to protocols
Drives, sensors and sequences are all instances of one bigger problem: working out which layer is actually broken when the front end and reality disagree. That's what the book is about — BACnet, Modbus, LonWorks, OPC UA, gateways, and the diagnostic method that works across all of them.
Get BAS Communication — A Field ReferenceFound a wrong number or a broken link? Tell me and I’ll fix it.