Predictive maintenance depends on trusted data moving from field sensors through gateways, BMS/EPMS platforms, historians, analytics, DCIM and CMMS. Every connection that makes earlier maintenance possible also creates a path that must be identified, controlled and recoverable.
The objective is not to turn maintenance engineers into cybersecurity analysts. It is to make sure a maintenance decision is based on authentic evidence, that remote access is governed, that updates do not create operational risk, and that the facility can continue operating safely when a connected component is unavailable or suspected to be compromised.
A maintenance sensor is part of the OT environment
NIST SP 800-82 Rev. 3 defines operational technology broadly enough to include building automation, physical-environment monitoring and measurement systems. It also emphasizes that security controls must respect OT performance, reliability and safety requirements.
That matters in a data center. A vibration node, wireless temperature sensor, power-quality meter or fluid-quality probe may appear less critical than a PLC or BMS controller, but its data can influence maintenance priority, redundancy decisions and work on live infrastructure.
The first control is therefore classification. For each connected maintenance component, record:
- Physical asset and exact measurement point
- Device, gateway, firmware and software versions
- Network address, protocol and communication path
- Data destination and downstream consumers
- Local or cloud dependency
- Supplier and support arrangement
- Authentication and remote-access method
- Update and recovery method
- Effect of loss, manipulation or delay
- Accountable operational and cybersecurity owners
An inventory that lists only the sensor model is incomplete. The maintained object is the entire data path that turns a physical condition into an operational decision.
Map the data flow before selecting controls
For every sensor class, draw the authorized flow from the field device to the final system of record. Include gateways, brokers, APIs, vendor platforms, time sources and administrative paths.
This supports three questions:
- Where can a value be altered, delayed or replayed?
- Which connection crosses an organizational or security boundary?
- What happens to maintenance operations when a component is unavailable?
NIST CSF 2.0 treats hardware, software, services, systems, data flows and supplier services as managed assets. ISA/IEC 62443 adds the useful concepts of zones and conduits: group assets with common security needs, then explicitly control the communications between them.
For predictive maintenance, a practical design might separate:
- Field sensors and acquisition devices
- BMS/EPMS or OT supervisory systems
- An integration or data-broker zone
- Analytics and historian services
- DCIM and CMMS applications
- Vendor-support access
- Corporate reporting systems
The exact architecture is site-specific. The control principle is consistent: only required communications should be permitted, and each boundary should have an owner and a documented purpose.
Protect integrity, not only confidentiality
Maintenance data is often treated as operationally useful but not sensitive. That view misses the main risk. A false normal condition can hide degradation, while a false severe condition can trigger unnecessary intervention on protected equipment.
Controls should therefore address:
- Device and service identity
- Authentication and least-privilege authorization
- Encryption where supported and operationally appropriate
- Integrity checking for files, messages and configurations
- Protection of credentials and certificates
- Approved configuration baselines
- Time synchronization and clock-offset monitoring
- Detection of missing, stale, frozen or implausible values
- Audit logs for administrative and rule changes
- Independent corroboration for high-consequence decisions
A single remotely supplied sensor value should not automatically authorize intrusive work. High-consequence actions should require operational context and corroborating evidence, such as load, redundancy, a second measurement method or a physical inspection.
Govern vendor remote access as a maintenance activity
Connected condition-monitoring platforms commonly depend on vendors for commissioning, diagnostics, firmware support and analytics. Remote access should be time-bound and tied to an approved purpose.
At minimum, the process should define:
- Named rather than shared accounts
- Multi-factor authentication where supported
- Approval for each session or approved support window
- A controlled access path rather than direct internet exposure
- Least-privilege access to the required assets
- Session logging and review
- Automatic expiry or disablement after the work
- Supplier escalation and incident contacts
- Rules for file transfer, tools and removable media
- Evidence attached to the change or work record
Supplier access is not solely an IT matter. Operations must understand the plant condition, maintenance must understand the work, and cybersecurity must control the access path.
Patch with operational discipline
The statement “keep everything patched” is incomplete for OT. Updates may require validation, a maintenance window, rollback planning and OEM confirmation. Conversely, “we cannot patch OT” is not an acceptable permanent position.
Each vulnerability decision should document:
- Affected product, version and installed population
- Exposure and reachable paths
- Evidence of exploitation or vendor severity
- Safety, reliability and service consequences
- Patch availability and compatibility
- Required testing and outage
- Temporary compensating controls
- Owner, deadline and accepted residual risk
- Rollback and recovery plan
If an update cannot be applied promptly, compensate through measures such as access restriction, segmentation, service disablement, enhanced monitoring or reduced exposure. The decision should be reviewed when threat information, redundancy or operational conditions change.
Monitor cybersecurity conditions that matter to maintenance
Security monitoring should be designed around meaningful OT events, not a flood of generic logs. Useful cases include:
- New or unapproved device discovered
- Firmware or configuration changed
- Repeated authentication failure
- Remote session outside an approved window
- Unexpected external communication
- Loss of time synchronization
- Sudden change in reporting rate or data pattern
- Disabled audit logging
- Unavailable gateway or broker
- Certificate or credential nearing expiry
- Data mismatch between source and downstream system
These events should be correlated with approved maintenance and commissioning work. A planned sensor replacement should not become a security incident, but the approved work record must make that distinction visible.
Separate cyber incident response from maintenance validation
When data integrity is in doubt, the first maintenance response is not necessarily to repair the physical asset. The team should establish whether the underlying condition is real.
A practical sequence is:
- Preserve evidence and record the affected systems.
- Determine whether the data path, device or account may be compromised.
- Apply approved containment without creating a greater operational hazard.
- Validate the physical asset through an independent method.
- Shift to manual inspection or an alternate source where required.
- Restore from an approved configuration or replace the affected component.
- Confirm data integrity from source to CMMS/DCIM.
- Review affected maintenance decisions made during the uncertainty window.
Cybersecurity recovery is incomplete if the application is available but the maintenance baseline, timestamps or decision history can no longer be trusted.
Design for safe degradation
Predictive maintenance should improve resilience rather than make the facility dependent on one analytics platform. For each connection, define:
- Maximum tolerable data outage
- Last-known-good behavior
- Local buffering and reconciliation
- Manual inspection fallback
- Alternate evidence source
- Recovery priority
- Configuration backup and restore test
- Criteria for returning automated routing to service
Loss of predictive visibility should normally increase monitoring or trigger a controlled fallback; it should not silently produce a healthy status.
Measure control effectiveness
Useful program measures include:
- Percentage of connected maintenance assets inventoried
- Percentage of authorized flows documented
- Unsupported or end-of-life device count
- Vendor accounts without a current owner or expiry
- Critical vulnerabilities past approved treatment date
- Percentage of configuration backups successfully restored in tests
- Time to detect unauthorized change
- Time to revoke vendor access
- Data-integrity incidents affecting maintenance decisions
- Percentage of incidents with independent physical validation
- Recovery exercises completed on schedule
The objective is controlled risk, not a perfect score. Exceptions should be visible, owned and time-bound.
Put this into practice
Use the companion workbook to inventory devices and data flows, map zones and conduits, govern access, track vulnerabilities and patches, record monitoring use cases, manage incidents and recovery tests, and report control coverage to operations and management.
Download the Connected Maintenance Sensor Cybersecurity Control Register
A biblical perspective on vigilance
“But we prayed to our God and posted a guard day and night to meet this threat.”
— Nehemiah 4:9 (NIV)
Responsible vigilance combines faith with practical safeguards. The builders did not abandon the work, nor did they ignore the threat. In the same way, connected maintenance technology should not be rejected because it introduces risk. It should be protected through clear ownership, watchfulness and disciplined controls so that useful innovation can serve the facility without weakening its resilience.
The operating standard
A connected predictive-maintenance system is ready for operational use when the organization can identify every material component and data flow, control access and change, detect loss of trust, validate the physical condition independently and recover without losing the evidence needed for safe decisions.
Cybersecurity is not an extra layer placed after installation. It is part of the maintenance control loop.
Data Center Health 