On August 19, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory about active cyberattacks targeting programmable logic controller (PLCs) in critical U.S. sectors, including. energy, water, chemical, and food & agriculture. The attackers didn’t rely on a flaw unique to one product. They searched for controllers that were exposed to the internet, running outdated firmware, or missing basic access protections. A successful attack can disrupt critical processes, damage equipment, compromise sensitive data, and spread too other connected systems.
The takeaway for contractors and facility teams is simple: any controller that isn’t kept up to date and properly secured is a potential target, whether it sits in an industrial process or a building management system (BMS). The good news is that the most effective defenses are routine maintenance practices.
Here are steps you can take to keep the controllers you install, manage, or sell are secure now and in the future.
1. Inventory Your Control Systems
Start with a complete list of all the controllers in your systems. For each one, record the manufacturer, model, application, current firmware version, and any system it connects to directly or indirectly. Prioritize anything that is internet-facing or hasn’tbeen updated recently.
2. Apply Security Patches
Update controllers to the latest manufacturer-recommended firmware, starting with any demilitarized zone (DMZ) devices. Then update the programming and configuration software used to manage them. Check each manufacturer’s security advisories regularly. Most publish known vulnerabilities along with recommended fixes and hardening guidance. Test firmware and software updates in a development environment before deploying them to your live systems.
3. Verify Your Controllers Are Not Internet-Accessible
Start by auditing any firewall rules for exposed controller communication services. Block industrial and building automation protocol ports at the network perimeter unless there is a specific, secured need for them; your manufacturer’s documentation will list the ports their devices use. Limit access to critical systems by sending data one way to storage servers and keeping IT and OT networks separate.
4. Add Layers of Protection
Enable password protection, restrict controller access to specific authorized workstations, configuring access levels, such as read-only, and require multi-factor authentication for any remote access to your OT network.
5. Create Standards for Regular Monitoring and Logging
While you probably already monitor your systems and log issues, you can strengthen controller security further:
- Deploy intrusion detection software
- Monitor all communication traffic for unauthorized connections
- Create an alert system for unauthorized operations
- Log all protocol connections to controllers, including timestamps and source IP addresses. Pay particular attention to connections from programming and configuration software, since these tools can modify controller logic.
6. Schedule Regular Security Checks
The most important element of system security is a regular audit schedule. Without one, critical updates get missed, and the risk of cyberattacks, data leaks, and outages grows.
For example, say you’re a contractor who installed controllers in a building system. When the project wraps up, you move on to the next job. But did you tell your client that the system needs regular monitoring and updates? If not, it could be left running years-old firmware.
If you’re a facility manager, do you have a schedule for firmware and system updates? How often does it run? Delayed upgrades and skipped checks leave gaps that attackers target. To protect your systems over their lifespan, set a consistent schedule for auditing equipment and a plan for deploying upgrades. Staying ahead of updates reduces risk and helps prevent critical outages.
Get Secure Building Systems Controls at BCS
Building Controls & Solutions offers access to millions of products and parts, in stock and available for shipping or local pickup. Browse our catalog of controllers, software, and field devices to find the right solution for your facility.
Need help selecting products, supporting an installation, or planning a regular maintenance schedule? Contact our team of Technical Support experts.