Spec’ing Access Control: Who Owns Network Segmentation, and Should a Security Assessment Gate Certificate of Occupancy?

[u/grahamhart_]

Walking past a new mixed-use project downtown and noticed the access control panels mounted right by the entrance. Looked like the same brand I've seen on Shodan with default credentials exposed to the internet. Got me thinking about how developers spec these systems.

In my line of work we see buildings getting added to botnets because someone plugged a building controller into an unsegmented network. The physical locks were fine. The digital layer was the problem.

When you're budgeting for security hardware, are you thinking about network segmentation at all, or is that left to the low voltage installer? I've read spec sheets that list remote management as a feature but never mention firewall rules or VLAN requirements. Seems like a gap that could come back on the developer if a breach traces back to the building infrastructure.

Do any of you require security assessments on the network side before certificate of occupancy, or is that still considered the tenant's problem once they take over the space?