Cybersecurity / Operational technology
Securing AI Access to Data Center Control Systems
The key security decision is not whether an AI model is accurate. It is whether the model—or its supplier—can reach systems that operate cooling, power or physical infrastructure.
Sections in this article
Separate observation from action. Let AI read only the telemetry required for its purpose; grant any write capability through independently governed, narrowly scoped control interfaces with explicit operational approval.
An optimization vendor may ask to connect its service to the building management system (BMS). That request sounds like a software integration, but it can cross the boundary between information technology (IT) and operational technology (OT). At the far end of that boundary are controllers attached to fans, pumps, chillers and other physical assets.
An electrical power monitoring system (EPMS) may primarily provide measurements. Some facilities also have separate supervisory or control functions associated with electrical plant. Do not assume that all EPMS products can issue breaker commands—or that an analytics tool needs any such authority. Start with the real topology, not a generic diagram.
Map where information stops and control begins
Build a data-flow inventory with five elements: telemetry origin, aggregation point, model environment, proposed output, and any component able to act on that output. Include vendor support connections and administration paths. This exposes accidental backchannels that would not appear on a simple AI architecture slide.
01 Identify all read paths → 02 confirm network boundaries → 03 enumerate write-capable interfaces → 04 match each permission to an approved operating purpose → 05 test revocation.
NIST SP 800-82 describes segmentation and isolation for OT networks. The relevant design may use gateways, firewalls or unidirectional mechanisms depending on required communication, safety constraints and existing plant architecture. A hardware data diode can support one-way telemetry, but it is neither necessary for every use case nor compatible with every two-way control requirement.
A practical permissions matrix
| Function | Preferred scope | Approval question |
|---|---|---|
| Forecasting dashboard | Read-only, selected telemetry streams. | Can it operate without direct access to controller subnets? |
| Maintenance recommendation | Read telemetry; write only to approved ticketing workflow. | Does a ticket trigger any automatic plant action? |
| Cooling optimization | Specific permitted setpoints through an approved command gateway. | Are independent engineering limits and interlocks enforced? |
| Vendor support | Temporary, attributable, monitored access via controlled support route. | Who authorizes, records and revokes the session? |
| Emergency procedure | Authorized local control independent of AI availability. | Can operators restore control if the AI path fails? |
Use distinct service identities for data ingestion, reporting and any commands. Remove shared administrator accounts and standing vendor access where possible. Apply multi-factor authentication to supported access paths, log privileged activity and test that permissions expire as intended.
Design a command path that can reject requests
For an AI system that is only advisory, no OT write path may be needed. For genuinely approved closed-loop automation, a separate engineering-controlled layer should decide whether a proposed command is permissible. That layer may enforce allowed equipment, operating mode, rate-of-change limits and interlocks.
BMS/EPMS sources and approved export gateway.
Model inference and recommendations, isolated from broad OT administration.
Authorized control interface, independent checks and operational logging.
Segmentation should reflect actual systems, not arbitrary one-size-fits-all subnets. Industrial protocol security also depends on installed versions and supported extensions. Some deployments support secure transport or protocol-specific protections; do not state that every BACnet or Modbus implementation is equally exposed.
Restrict command types and destinations at the appropriate gateway. A cloud service should not gain a general route to core OT controllers merely because it needs temperature data. Where a vendor requires remote access, review updates, credential storage, certificate handling, incident notification and recovery dependencies.
Capture enough evidence to investigate an incident
Useful logs answer who or what initiated an action, when it happened, which asset was targeted, whether it was permitted, and what result the controller reported. Include model or software version where available, but never assume retaining every inference vector is necessary or practical.
- Record authentication and administrative changes on the vendor-facing interface.
- Log permitted and rejected write requests with reliable timestamps.
- Correlate critical changes with the BMS event history and change-management records.
- Protect log integrity and restrict deletion permissions; select retention based on risk and applicable rules.
- Review unexpected access, new destinations and unusual command frequency.
Immutability, WORM storage and high-frequency logging may be warranted in some facilities, but these are design choices rather than universal statutory mandates for all AI systems. Likewise, obligations under the EU AI Act depend on the actual system, role and applicable provisions.
Plan recovery around the physical system
Disabling the AI application is not necessarily the same as restoring safe plant operation. Define which controls stay local, how write permissions are disabled, who verifies the handover and what happens if a network gateway becomes unavailable. The facility's authorized engineers must validate the full transition sequence against commissioning documents and equipment requirements.
An optimization gateway begins requesting setpoint changes outside its approved operating profile. The command interface rejects the requests and alerts the operations team. The team suspends the gateway's write permissions, confirms stable operation under the approved local control sequence and reviews the logs before reconnecting the service.
The correct fallback depends on the site's design; forcing equipment to “factory defaults” or operating undocumented bypass switches may introduce additional risk.
Good OT security makes AI a bounded participant in operations, not an administrator of the facility. The most useful question to ask at every integration review is: What is the least authority this system needs to do its job?
Sources and further reading
Primary frameworks and reference materials. Engineering decisions require site-specific validation; legal classifications require assessment of the actual use case.
- Guide to Operational Technology Security, SP 800-82 Rev. 3NIST
- ICS recommended practicesCISA
- AI RMF Core: third-party governanceNIST AI Resource Center