What is BACnet/SC, and is BACnet IP secure?

Updated 4 November 2026

What plain BACnet IP leaves open

BACnet IP is UDP on port 47808. A device answers any request that reaches it. There is no user, no password and no encryption, so the security is entirely in who can reach the network. An optional security layer was added to the standard years ago but was rarely implemented. That's why a phone plugged into the controls switch can scan and read a whole building, and why the same is true for anyone else who gets onto that network.

How BACnet/SC works

• TLS over WebSockets. Each device opens an encrypted connection, over TCP, to a hub. The hub passes messages between devices. A site can have a primary and a failover hub, and devices that support it can also connect to each other directly.
• Certificates. Every device has its own operational certificate, signed by a certificate authority set up for that site, and only accepts connections from devices with certificates from the same issuer. These are private site certificates, not the public ones a website uses, and they have expiry dates that have to be managed.
• No broadcasts. A Who-Is goes to the hub, which hands it to every connected node. Nothing depends on IP broadcasts, so SC crosses routers, VPNs and NAT without BBMDs.
• Same BACnet above. Objects, properties, priorities and services are unchanged. SC is a new data link, like BACnet IP or MS/TP, and BACnet routers join SC networks to IP and MS/TP ones.

What changes on site

• Firewalls get simpler. Nodes make outbound TCP connections to the hub's address and port (often 443, set by the site). No inbound UDP, no broadcast forwarding.
• Commissioning gets an extra job. Someone has to run the certificate authority, issue a certificate to every device, and renew them before they expire. Agree who owns that, IT or the controls contractor, before the job starts.
• Your tools need a certificate. A BACnet IP scanner can't see an SC network; a tool has to be given its own certificate to join. Mixed sites, with an SC backbone between supervisory controllers and BACnet IP or MS/TP underneath, are common, and the IP and MS/TP parts below the router stay as open as before.

Easy BACnet is BACnet IP only and doesn't connect to BACnet/SC networks.

Protecting BACnet IP today

• Keep controls on their own VLAN or network, not the office or guest network. See what is a subnet?
• Firewall between VLANs. Allow UDP 47808 only between the hosts that need it: head-end, supervisory controllers, BBMDs.
• Never put BACnet IP on the internet. Search engines that index exposed devices find thousands of BACnet controllers answering from public addresses. Remote access goes through a VPN you can turn off per user.
• Watch foreign-device registration. A BBMD that accepts foreign devices from anywhere lets a remote host join the network. Restrict it to known addresses where the BBMD allows it.
• Lock down the head-end and supervisory controllers. Their web and workstation logins are the real front door: change default passwords and keep them patched.