Practical cybersecurity governance for IoT and blockchain in building services

To the Editor:

Patruni and Saraswathi ¹ presented a useful discussion of securing Internet of Things (IoT) devices through Ethereum blockchain and smart contracts. Their article is relevant to building services because building systems now depend on connected sensors, controllers, gateways and building-management platforms. These systems can improve comfort, energy use and maintenance, but they also increase the number of points where security can fail.

The article is valuable because it shows that blockchain can support trust and data integrity in connected systems. At the same time, the practical use of blockchain in buildings should not be seen only as a technical upgrade. In many facilities, the first need is still basic governance: knowing which devices are connected, who can access them, who is responsible for updates and what should happen when a fault or breach is suspected.

This is especially important in older buildings where new digital devices are added slowly over time. A building may have modern sensors beside older equipment that was not designed with cybersecurity in mind. If the asset list is incomplete, a blockchain-based solution may protect only part of the system. A simple baseline for IoT capability, such as the core cybersecurity approach described by Fagan et al., ² can help teams check whether basic protections are already in place.

Usability also deserves attention. A security tool that only a specialist can understand may not work well in a real facility. Maintenance teams, small contractors and building operators need plain instructions on what the system does, what alerts mean and when a problem must be escalated. Good cybersecurity should support the people who run buildings, not make their work harder.

A risk-based approach may also help. Not every device in a building needs the same level of protection. A sensor that only reports temperature may not need the same controls as a system connected to access control, ventilation, energy management or life-safety equipment. This is where building services professionals can add value, because they understand both the technical system and the everyday use of the building.

For building services practice, the next discussion should connect blockchain and IoT security with procurement, commissioning and maintenance. Contracts should clearly state security requirements, update responsibilities, data ownership and incident reporting arrangements. These details may appear small, but they are often what determine whether a digital system remains safe after installation.

In summary, Patruni and Saraswathi ¹ make an important contribution by showing how blockchain and smart contracts may strengthen IoT security. Future work can build on this by giving more attention to the human and organisational side of adoption. Secure digital buildings need good technology, but they also need clear rules, trained users and shared responsibility.