• Founded January 2021 — 3 people to 26 in just over 5 years, focused on doing federal controls work right
• Headquartered in Pensacola, FL — serving federal and commercial customers across Florida, Alabama, and Mississippi
• Delivered work at 7 military installations: Eglin AFB, Tyndall AFB, Keesler AFB, NAS Pensacola, NAS Whiting Field, Hurlburt Field, NSA Panama City
• $3M aggregate bonding capacity — FL-licensed low voltage contractor, fully bonded and insured for prime and sub
• Ownership-level involvement on every project — single point of contact from bid through closeout
• No failed performance bonds, no abandoned contracts — a verifiable delivery record across all contract types

The real power isn't any single system — it's when they talk to each other.

FDD analyzes equipment trends and flags problems early — but identifying a fault is only half the battle. The real value is helping you decide what to do about it.

• The entry point: A phishing email sent to the Mechanical Contractor — Target's HVAC contractor — not to Target directly
• The path: The Mechanical Contractor had remote access to Target's vendor portal for billing. Their credentials were stolen.
• The pivot: Attackers moved laterally from the vendor portal to the POS network — a flat network allowed this
• The haul: POS malware harvested payment card data from registers across 1,800+ stores — 40M cards stolen, 70M guest records exposed
• The lesson: The BAS wasn't directly the breach vehicle — but the HVAC contractor's vendor access was the open door

HVAC Contractor Vendor Portal Flat Network

• What happened: Two separate facilities were left on factory default PIN settings, so the same code worked in both places
• The exposure: A person at the condo property could also access the federal credit-union site because the credentials matched
• How it was found: A later controls technician discovered the duplicated settings during routine service work
• Impact: No known intrusions were reported, but the access path existed until the settings were corrected
• Lesson: Access control defaults are never "temporary" once a building goes live

• The threat is state-level: State-sponsored groups operating out of Eastern Europe, the Middle East, and East Asia have all been attributed to active OT and building system targeting campaigns
• AI is accelerating the attack: These groups are using AI to write better phishing, search faster, and automate recon — what took days now takes minutes
• That means more volume: Faster recon and more convincing lures increase the odds that a building system gets targeted
• The software is only part of the story: Most failures still start with defaults, weak handoffs, and poor commissioning discipline
• The weak link: The people installing and handing off the system are often the difference between secure and exposed
• What that means: Verify every password, every remote path, and every network connection before turnover

Tridium Niagara has been dramatically improved since the 2013 incidents. Niagara 4.x is a fundamentally different security posture, and CMMC readiness is becoming a growing expectation across federal work.

Niagara 4.x Changes

• Forced password change on first login — no more defaults
• HTTPS / TLS required for all web connections
• Role-based access control with full audit trail
• Certificate-based station authentication

Industry Best Practices

• OT/IT network segmentation (BAS on isolated VLAN)
• VPN-only remote access with MFA
• Regular firmware and software patching schedules
• Document all remote access paths and credentials handed to the owner

CMMC

• Increasingly part of federal contract conversations and compliance planning
• Pushes stronger documentation, access control, and evidence of secure process
• Requires disciplined handling of credentials, networks, and maintenance workflows
• Expect it to influence how BAS work is scoped and handed off on federal jobs

• Replaced 7 legacy Niagara AX v3.8 JACEs with Niagara N4 v4.13 — restored connectivity lost due to aged equipment
• 332 LON field devices replaced with BACnet/IP over CAT 6 — 20 AHUs · 189 VAVs (HW reheat) · 3 chillers · 3 cooling towers · 2 boilers · 3 ERVs · 3 OAUs · 12 pumps
• All programming and graphics updated on building-level JACE and ENS at Building 696; full P2P trending

• 100% U.S. citizen workforce · I-9 verification for every technician · 10-business-day base access lead time
• No Bluetooth, Wi-Fi, or camera-capable devices on site — laptops required 96 CEG IT security scan before use; volt meters and flukes needed PSO approval
• Egress maintained at all times — active JSF training ongoing during construction; phasing plan required

• Independent PVT (Performance Verification Test) — hydronic and air-side · government-witnessed · 20% VAV spot check with ±10% failure tolerance

On a typical federal construction project, controls pricing passes through multiple layers of markup before it reaches the owner — and few people know how large the stack actually is.