How Facilities Managers can become a critical line of defence in cybersecurity

Chief Technology Officer James Dunnett explores how the connected workplace means that facilities management has a critical role to play in cybersecurity

In a world where every building system, from lighting to lifts, is connected, cybersecurity is no longer just an IT concern. Facilities are now part of the digital ecosystem, and that makes them part of the threat landscape too. During Cybersecurity Month, it’s a good moment to reflect on how FM can help protect the connected workplaces we all rely on.

When buildings become part of the network

The digital transformation of facilities has delivered huge benefits, including data-driven energy management, predictive maintenance, and smarter workplace experiences. But it’s also expanded the potential attack surface. Every IoT sensor, smart meter or automated control panel represents a potential access point to a network.

Cybersecurity in this context is about more than firewalls and encryption. It’s about managing the interaction between people, technology, and the built environment. That’s where FM can make a real difference.

5 ways Facilities Managers can play a leading role

1. Managing the risk at source
   Facilities managers are responsible for procuring and maintaining a growing range of connected systems, from BMS to access controls and energy monitoring tools. Each device that connects to a network must meet the same security standards as corporate IT assets. Working with accredited suppliers and ensuring equipment firmware and software are regularly updated is a simple but powerful step in closing the door to potential cyber threats.
2. Supporting human resilience
   Most breaches still occur through human error, such as an unlocked cabinet, shared login or untrained contractor. FM teams can help reduce this risk by embedding cybersecurity awareness into daily operations. Just as health and safety are everyone’s responsibility on site, digital safety should be too. From visitor management processes to contractor onboarding, small behavioural changes can have a large cumulative effect.
3. Controlling data access and integrity
   As facilities data becomes more valuable, it must be managed with the same rigour as any other business data. That means clear governance over who can access information, how it’s shared, and how it’s stored. EMCOR UK’s own systems are certified to ISO 27001 (information security) and Cyber Essentials Plus, ensuring customer data is handled safely and in full compliance with UK standards.
4. Vetting the extended supply chain
   Cybersecurity doesn’t end at the perimeter of the building or organisation. Service providers, subcontractors and technology partners can introduce risk if standards are inconsistent. FM teams can lead by example, requiring suppliers to meet recognised certifications and to demonstrate how they manage their own systems securely. This collaborative approach builds trust and strengthens resilience across the supply chain.
5. Planning for the unexpected
   Cyber incidents can have physical consequences. A locked-out BMS or a compromised access control server can disrupt operations as surely as a power failure. Including cyber risks in business continuity and recovery planning ensures that the physical environment remains safe and operable even in a digital crisis.

The power of FM–IT collaboration

In many organisations, facilities and IT still operate in parallel. Yet the most resilient ones are those where the two work together. At EMCOR UK, this collaboration is built into the way services are delivered. Our Insight Intelligence platform provides a secure, single source of truth for estate and asset data, accredited to bank-grade security standards. It allows IT and FM teams to view, analyse and act on information in one place, strengthening both operational performance and data protection.

In customer environments, this means cybersecurity becomes a shared responsibility. IT manages the digital perimeter; FM safeguards the operational technology that keeps buildings running. Together, they create a joined-up approach that protects systems, people and processes.

Building cyber resilience from the ground up

As the line between physical and digital infrastructure continues to blur, the role of FM in cybersecurity will only grow. Facilities leaders have the advantage of proximity – they understand the assets, the people, and the operational rhythms of a building. When combined with IT’s technical expertise, that knowledge becomes a powerful defence.

Cybersecurity Month is a reminder that resilience isn’t just built into networks, it’s built into behaviours, processes, and partnerships. And in that sense, FM is already at the front line.

Support with your cybersecurity

Smart businesses are taking a proactive approach by protecting their operations from risk today while building the connected, secure workplaces of tomorrow.

If you’d like to discuss how EMCOR UK can support you to create resilient Facilities, get in touch with our team.