Cybersecurity Guidance for Data Center Power and Cooling Infrastructure Systems

Overview

The paper starts from the fact that power and cooling equipment is no longer isolated machinery: UPS, switchgear, cooling, environmental monitoring and physical-security systems connect to BMS/DCIM, the corporate IT network and cloud services. That connectivity brings monitoring and remote management, but it also turns the facility's operational technology (OT) layer into an attack surface. The paper places the problem in the network architecture formed by these devices rather than in any single unit, and assigns separate duties to the vendor and to the site owner.

On the vendor side, expectations are tied to named standards. The development process should be certified to ISA/IEC 62443-4-1 or be consistent with ISO 27034. At product level, IEC 62443-4-2 is the certificate to look for in components and IEC 62443-3-3 in systems, with vulnerability handling per ISO/IEC 30111. This yields a concrete certificate list that can be written straight into a procurement specification. The checklist itself is split across design, installation and operation.

For network design the core principle is to separate power and cooling OT networks from corporate IT using the zones-and-conduits approach of IEC 62443-3-2. All communication protocols in use should be inventoried and unused services disabled. The paper also stresses that security must be sustained through operations rather than set up at design and left alone, so patching, access and monitoring need an owner after commissioning. The record gives checklist principles only; it does not provide a threat model or a quantified risk score.

Key points

1. Vendor development process should be certified to ISA/IEC 62443-4-1 or consistent with ISO 27034.
2. Look for IEC 62443-4-2 certification on components and IEC 62443-3-3 on systems.
3. Vulnerability handling should follow ISO/IEC 30111.
4. Segment OT (power/cooling) networks from corporate IT with zones and conduits per IEC 62443-3-2.
5. Identify every communication protocol in use and disable unused services.
6. Security has to be sustained through operations, not only at design.
7. Scope covers UPS, switchgear, cooling, environmental and physical-security systems.

Using it in design

• Add an OT-network section to the design: each monitored device class carries a protocol list and an IEC 62443 certification flag.
• Define a rule check that facility OT networks are segmented from IT, backed by a zone and conduit diagram.
• Require that remote access passes through a managed gateway.
• Write 62443-4-1, 4-2, 3-3 and ISO/IEC 30111 into the vendor specification as certificate check items.

Who should read it

Design engineers, operations and cyber-security teams connecting power and cooling controls to BMS/DCIM.

Related standards

• ISA/IEC 62443
• ISO/IEC 27001
• NIST CSF
• EN 50600-2-5

Publication details

Authors

Patrick Donovan; Katie Hargraves; Maria A. Torres Arango

Publisher

Schneider Electric

Year

2026

Document number

WP 216

Document language

English

Source type

Manufacturer

Access

Free to read

Licence

Copyright retained; citation only — the publisher’s terms apply to the original document

Citation