Cybersecurity Risk in Building Automation Systems on Saudi Arabian Giga Construction Projects: A Risk Governance Framework

Abstract

Saudi Arabia’s Vision 2030 giga-projects are connecting building automation systems (BAS) to corporate networks, cloud platforms, and remote vendor access at a rate that has outpaced the cybersecurity governance traditionally applied to operational technology. BAS field protocols such as BACnet, Modbus, and KNX were designed primarily for interoperability rather than operation in adversarial network environments, and legacy deployments often provide limited native authentication and encryption. This paper develops the Building Automation Cybersecurity Risk Framework (BACRF), a six-layer governance model that classifies BAS-specific threats, assigns responsibility across the fragmented delivery chain of owner, project management consultant, contractor, mechanical-electrical-plumbing (MEP) subcontractor, and vendor, and prioritizes mitigation measures through a Cyber-Risk Index (CRI). The framework was built from a structured literature review of 25 sources, screened from an initial pool of database records to a final set spanning industrial control system, cyber-physical systems, and construction cybersecurity literature, together with an illustrative scenario informed by the authors’ professional experience. Applying the CRI to a representative giga-project scenario, with explicitly reported likelihood, consequence, and weighting inputs, identifies network segmentation failure as having the highest priority among unauthorised remote access and supply-chain exposure as the leading risk. The framework provides giga-project owners and delivery teams a reproducible basis suitable for contractual implementation for prioritising BAS cybersecurity investment, although the scoring weights remain illustrative pending calibration against documented incident data.