Walls, Cameras and Chillers: Putting the Estate Edge Inside the Trust Boundary

Most UK zero-trust programmes begin where the user works: laptops, identity providers, SaaS tenants and cloud workloads. The estate itself — the building management system, CCTV, door controllers, lifts, energy meters and environmental sensors — is frequently treated as a facilities matter rather than a security boundary. That separation is becoming harder to defend. In 2026, the estate edge is a network edge, and it deserves the same disciplined trust reasoning as any other part of the enterprise.

The estate is not outside the perimeter

A modern UK office, campus or retail estate is a mesh of operational technology and internet-connected devices. Building management systems regulate heating, ventilation and cooling. Access control systems decide who enters which space. CCTV captures personal data. Energy monitoring platforms report consumption to landlords, managing agents and sustainability teams. Each of these systems has users, administrators, suppliers and remote maintenance paths. Each is a trust relationship.

The difficulty is that many of these relationships were designed for convenience rather than verification. A contractor arrives on site, connects to a flat network, reaches the BMS and departs. A facilities manager uses a shared account because the proprietary application does not support federation. A CCTV vendor keeps a standing remote-access route because raising a ticket for every firmware check is impractical. None of this is unusual. It is also not a stable basis for resilience.

Begin with an estate identity map

The first step is not a product selection. It is an inventory that records what exists, who owns it, what it talks to and how it is reached. For each estate system, document the business owner, the technical custodian, the protocols in use, the data flows, the remote-access paths and the supplier dependencies. Include legacy systems that are out of support but still in service, and note where compensating controls are relied upon.

This map should classify systems by consequence, not merely by technical vulnerability score. A chiller controller that affects server-room cooling may matter more than a meeting-room display. A door controller serving a secure area may carry different risk from a car-park barrier. The point is to make explicit which estate functions are safety-related, which process personal data and which support regulated operations. That clarity shapes segmentation and assurance effort.

Segment with operations, not against them

Identity-aware segmentation is the core engineering move. The aim is not to isolate facilities teams from their own systems, but to replace broad network reachability with explicit, attributable access. Zones and conduits should follow operational function and consequence: BMS management, CCTV, access control, energy monitoring and corporate IT should not share a casual flat network. Where systems must communicate — for example, access control events feeding a security operations platform — allow-list those flows and broker them through a controlled point.

For legacy equipment, segmentation may need to be delivered through network-layer controls, virtual patching or passive monitoring rather than endpoint agents. That is acceptable if the compensating controls are documented and tested. What is not acceptable is a permanent exception that recreates the flat network under a new diagram.

Make vendor access a supervised workflow

Contractor access is where estate trust most often leaks. The practical answer is not to ban remote support, which can delay maintenance and create shadow routes, but to make it supervised, time-bound and evidenced. A supplier session should have a named sponsor inside the organisation, a justified purpose, multi-factor authentication, just-in-time credentials and session recording. Standing VPN accounts and shared local administrator passwords should be retired where possible.

The facilities team should be a visible part of this workflow, not bypassed by it. They know when a maintenance window is safe, which systems are fragile and which alarms must not be disturbed. Treat them as trust brokers for the estate, with a clear escalation path when a supplier needs urgent access outside normal hours. Procurement should also carry the requirement: contracts should specify access methods, logging expectations, patch responsibilities and notification duties.

Test resilience without breaking the building

Resilience testing at the estate edge requires restraint. Aggressive scanning or exploitation attempts against live building systems can disrupt heating, cooling, lifts or access control, and may breach safety and contractual obligations. Safer methods include tabletop exercises, control validation, passive traffic analysis and failover tests conducted during commissioning or planned maintenance windows. A useful drill is to simulate loss of remote supplier access and confirm that on-site staff can maintain safe operation through manual procedures.

Testing should produce evidence for assurance, not just reassurance. Record what was tested, what was deliberately excluded, who approved the window and what compensating controls were in place. That record matters to audit committees, insurers and regulators, and it gives facilities teams confidence that security is not asking them to take unbounded operational risk.

Report the estate as a trust boundary

Board reporting should treat the estate edge as part of the enterprise trust boundary. Useful measures include the proportion of estate systems with named owners, the number of standing vendor access routes, the percentage of remote sessions that are approved and recorded, segmentation coverage by consequence tier, time to revoke access and the results of resilience tests. These measures connect zero-trust strategy to the physical estate without reducing it to a compliance checklist.

The building is not merely a place where the network operates. In a UK enterprise, it is increasingly part of the network. Extending zero trust to the estate edge is therefore not an operational technology sideline. It is a question of whether the organisation can vouch for every identity, path and supplier relationship that touches the places where people work.