Security
6 min read
In this article
Make the day easier.
Find ways to cut waste, handle complaints and keep repairs moving across your sites.
Facilities wants to get the stores connected. IT needs to know what connects, who can access it and what users can change. A common deployment plan keeps those questions from turning into separate, repeated conversations.
The short answer
Review cloud HVAC security around the actual deployment: equipment connections, data handling, user access, allowed control changes and interruption procedures. Monaire’s dedicated cellular gateway avoids store-network onboarding, while its security records support the vendor review.
What matters most
Document whether HVAC devices need access to the store or corporate network.
Decide who can change setpoints, approve overrides and view site data.
Confirm what remains local and who responds when cloud connectivity is interrupted.
Start with a connection diagram both teams can use
Cloud HVAC security review gets difficult when facilities and IT are discussing different versions of the system. Facilities may picture wireless sensors, while IT is trying to determine whether devices will join the corporate network or connect to existing controllers.
Start with the actual equipment-to-cloud path. Identify the sensors, thermostats, gateway, local controls and any integrations. Show what information leaves the site and which remote actions the system supports.
Monaire’s dedicated cellular gateway can connect the deployment without using store Wi-Fi or the corporate LAN. That simplifies the network conversation and avoids the store Wi-Fi dependencies discussed in AI HVAC vs. smart thermostats.
Document the proposed installation rather than assuming every site is identical. If an existing BMS integration adds a connection, include it explicitly. A useful diagram lets IT review the real connection and lets facilities understand who supports each part.
Decide who can view information and change settings
A regional facilities manager, store manager, contractor and IT administrator do not necessarily need the same access. List the tasks each role needs to perform and the sites it needs to see.
Separate viewing data from making a control change. Then identify who can edit schedules, adjust permitted setpoints, manage users or support an investigation. Confirm those permissions in the proposed configuration instead of assuming a role name explains everything.
Role question | Operating reason |
|---|---|
Who can change schedules? | An incorrect schedule can affect many stores |
Who can make a local override? | Stores need a defined response to an operating exception |
What can a contractor access? | Service access should match the assigned work |
Who removes old accounts? | Departing staff should not retain access |
Your team should also know how access is granted and removed. Use Monaire’s Security page and the review discussion to confirm the available authentication and permission controls for your deployment.
How it works
One deployment plan for Facilities and IT
Document the connection, authority and evidence before rollout.
1
Connection
Show the dedicated cellular path and any proposed integrations.
2
Access
Define who can view sites and change settings.
3
Operation
Confirm approved limits, overrides and interruption handling.
4
Evidence
Request the SOC 2 report and ISO certificate through the Trust Center.
Make customer control of HVAC operation explicit
Facilities owns the building’s operating requirements. Define occupied hours, comfort bands, setpoint limits, equipment restrictions and the changes that require human approval.
Monaire’s automation operates within customer-defined limits. Those limits make the security review relevant to daily work: reviewers can see what the system is allowed to do and how a user can intervene when a site has an exception.
Ask how changes and overrides are recorded and reviewed. A store that opens late or hosts a special event should have a defined process, rather than relying on someone to remember a temporary setting afterward.
Keep control permissions separate from spending approval. An automated work order does not authorize an unrestricted repair expense. The HVAC automation guide explains how alerts, approved actions and assigned work can fit together without blurring those responsibilities.
Confirm what happens when a connection is interrupted
A dedicated cellular gateway avoids store Wi-Fi dependency, but coverage, power and communications still need to be addressed. Know who receives a lost-connection notice and who is responsible for restoring service.
Ask what continues at the equipment, which remote functions become unavailable and what happens when connectivity returns. Local HVAC control and cloud-based visibility are separate questions. Confirm their behavior for the installed equipment and controller setup.
Missing readings should appear as missing readings, not as an indication that equipment is operating normally. The team also needs a way to follow required site checks when remote information is unavailable.
Include communications recovery in commissioning. Facilities should know how to recognize an interruption, what the store needs to do and how to confirm that remote data and controls have resumed. That turns an abstract outage discussion into an operating procedure people can use.
How Monaire sees it
Facilities and IT can move faster when the review describes the same equipment, connection and control authority. Monaire helps make that deployment clear and provides the security evidence for the vendor review.
Give IT the assurance records and deployment details together
Monaire has a SOC 2 Type II report covering its Building Intelligence and Automation Platform and the Security category. Its information security management system is certified to ISO/IEC 27001:2022 within the stated certificate scope.
The Monaire Trust Center is the public starting point for requesting the restricted report and certificate. The Monaire security credentials article explains why those records help facilities move the review forward.
IT should assess the complete records and raise questions about findings, scope and customer responsibilities as needed. Pair those records with the proposed connection diagram, access model and relevant data-handling answers.
This makes a claim about building management software security easier to assess. The review is about both the vendor’s practices and the system your sites would actually use. A SOC 2 report supports that decision; it is not a substitute for understanding the deployment.
Finish with a shared rollout plan and clear owners
Turn the review into a short list of decisions: the connection to be used, approved user roles, operating limits, interruption handling and the people responsible for support.
For a multi-site rollout, document the common setup and the site exceptions. A location with an existing controls integration or difficult cellular coverage may need additional work. Identify that before repeating the installation plan elsewhere.
The building management system guide helps define which local functions must remain in place. The Monaire technology overview can support the equipment and connection discussion.
Cloud HVAC security becomes easier to manage when Facilities and IT work from the same operating plan. Schedule a Monaire demo to walk through the cellular deployment, control authority and available evidence together. That keeps the review connected to the goal: improving HVAC operations across your sites with clear responsibility for how the system works.
Why should facilities be involved in a security review?
The placeholder answer.
What should we ask about remote control?
The placeholder answer.
Does a cloud outage mean the HVAC stops working?
The placeholder answer.
Is a SOC 2 report enough to approve the software?
The placeholder answer.
Still have questions?
Can’t find what you are looking for? Reach out to our team
Keep reading
AI HVAC
7 min read
What Is HVAC AI, and How Can It Help Your Facilities Team?
HVAC AI helps your facilities team catch problems and reduce energy waste without checking every unit at every location.
AI HVAC
7 min read
AI HVAC vs. Smart Thermostats: What Does Your Team Need?
For multi-site HVAC, reliable connectivity comes first. Monaire’s dedicated cellular gateway avoids the store Wi-Fi dependency of Wi-Fi thermostats.
AI HVAC
7 min read
HVAC Automation Software: Fewer Alerts, Faster Action
HVAC automation is valuable when it gets a problem resolved, not when it sends another alert.
