BMS / BAS Cybersecurity Specification – 33 requirements, acceptance checklist, bid grid

The cybersecurity clauses to insert into the technical specification of a building management system (BMS / BAS) work package, the acceptance checklist that shows they were delivered, and the grid to score the cybersecurity part of bids. Derived, recommendation by recommendation, from the guide published in April 2026 by ANSSI, the French national cybersecurity agency (ANSSI-PA-110, in French), which contains neither contract clauses nor a checklist. Written in English, with no reference to French procurement law: usable in a tender in any country, public or private.

What you get

• BMS-BAS-Cybersecurity-Specification.docx – an editable Word document, 15 pages, about 5,000 words, text to adapt in [square brackets]: 1. How to use this document: who it is for, why now, how to choose the level, what the document is not. 2. References: ANSSI-PA-110 v1.0 (official French title with an English translation), EU Energy Performance of Buildings Directive 2024/1275, Article 13 (building automation above 290 kW by 31 December 2024 and above 70 kW by 31 December 2029), NIS 2, IEC 62443, ISO 16484 (BACnet), ANSSI-PA-022. 3. Definitions: 10 terms (BMS / BAS, controller, supervisory system, engineering workstation, protocol gateway, administration network, remote access, Owner, Contractor, levels). 4. 33 requirements (E-01 to E-33) in 10 chapters and two levels, Essential (26) and Enhanced (7), each linked to its ANSSI recommendation (R1 to R26) or marked as a complementary practice, and each with the evidence expected at acceptance: segregation and flow filtering, administration network and protocols, remote access chain with bastion and on-demand activation, switch and gateway hardening, time synchronization (NTP, BACnet), controller integrity and services, USB ports and BIOS/UEFI, removable media, wireless and Wi-Fi, BACnet/SC, Modbus and BACnet filtering, Foreign Device, accounts and passwords, patching lead times, backups, vulnerability and incident notification, documentation and reversibility, cybersecurity acceptance. 5. Summary table of the 33 requirements (level, reference, evidence). 6. Cybersecurity acceptance certificate template. 7. Remote access log template.
• BMS-BAS-Acceptance-Checklist-and-Bid-Grid.xlsx – an Excel workbook, 4 sheets, native formulas, no macro:
  • Acceptance checklist: the 33 requirements, result drop-down (Compliant, Partial, Non-compliant, Not applicable); compliance rate, blocking non-compliances and outstanding items calculated automatically; Enhanced requirements greyed out when the Essential level is selected.
  • Bid evaluation grid: 7 weighted criteria out of 100 points, 0-to-5 scale, 3 bidders, weighted scores and totals calculated automatically.
  • Remote access log (30 lines) and equipment inventory (60 lines, equipment type drop-down). Blank templates: no sample data to delete.
• Updates for 12 months, sent by e-mail whenever the ANSSI guide or the referenced texts change.

For whom

Building owners and property managers, public bodies, engineering consultants and owner's representatives who write a BMS work package, facility managers, and BMS integrators who want to meet these requirements before they are imposed on them.

The link with ANSSI

ANSSI is the French national cybersecurity agency. Its guide is non-binding, in French, and published under the French open license (Licence Ouverte v2.0), which allows reuse with attribution. This product is an independent work: it is neither published nor endorsed by ANSSI. The recommendation numbers (R1 to R26) and the official titles are kept so that your reviewers can trace every clause back to its source.

Limits

Not a consulting service or an audit: the document does not replace your own risk analysis or the advice of your CISO. Adapt the evaluation grid and the acceptance rules to your procurement rules, and check the national transposition of EU texts in your country.

Quality

Word: opened and paginated in Microsoft Word (15 pages), table headers repeated across pages, requirement headings kept with their text, no French left apart from the official ANSSI titles and terms, quoted with their translation. Workbook: recalculated in Excel with 0 cells in error, and checked against an independent recalculation, carried out by the publisher, on fictitious test data that is not delivered (29 checks: compliance rate, blocking non-compliances, outstanding items, conditional formats, weighted scores and totals, drop-down lists). Written with the help of AI from the ANSSI guide, structured and reviewed by an information systems consultant.

Same files, three levels of rights, chosen at checkout. The Company or personal use level is open to everyone, businesses and consumers. The Team and Consultancy / White label levels are for businesses only: they cover several entities or deliverables handed to your clients.

• Company or personal use – $390 excluding taxes ($468 including 20% VAT for a consumer in France): one company or one public body, for its own contracts; resale and redistribution prohibited; 12 months of updates; also open to consumers, for personal use.
• Team – $790, businesses only: up to 5 entities of the same group, a public body with its affiliated bodies, or the same consortium, each with the Company rights; 45-minute onboarding video call; reply within 2 working days.
• Consultancy / White label – $1,490, businesses only: you adapt the specification, the acceptance checklist and the bid grid to produce deliverables for your own clients (unlimited) under your own brand and hand them the adapted files; reselling, redistributing or publishing the template itself is prohibited; 45-minute video call, reply within 2 working days.

Which one is for you? Company or personal use for the contracts of your own company or public body, including an integrator's own bids. Team for a group, a public body with its affiliated bodies, or a consortium (5 entities at most). Consultancy / White label if you are an engineering firm, an owner's representative or a consultant putting these requirements and the acceptance grid into your clients' tender documents, under your brand. Consumers: Company or personal use, for personal use; the other levels are not open to them.

More than five entities, firm networks, software or training use: message the MOE CAPITAL Digital LinkedIn page. Team or White label license: at checkout, enter the legal name and the registration or VAT number of the licensed entity (required for these levels; if it is missing, we ask for it by e-mail; optional for the Company or personal use level). Full license terms available before purchase at lesbonsmots.gumroad.com/license-terms; the PDF is attached to every purchase. Prices exclude taxes: Gumroad, the reseller, adds VAT or sales tax at checkout according to the buyer's country.

Consumers: 14-day right of withdrawal from purchase, even after download and whatever the level ordered, with a refund within 14 days : Withdraw from contract here; two-year statutory guarantee of conformity; consumer mediator: Société de la Médiation Professionnelle (SMP), Alteritae, 5 rue Salvaing, 12000 Rodez, France – www.mediateur-consommation-smp.fr. Terms of Service: lesbonsmots.gumroad.com/terms.

Publisher: SASU MOE CAPITAL (MOE CAPITAL Digital brand), which operates the "Les bons mots" shop: 95 impasse des Garennes, 81710 Saïx, France, Castres Trade and Companies Register 979 936 085, [email protected]. Gumroad, the reseller, takes the payment.

Company or personal use level details below.