Why passing an audit is not proof that facilities management businesses can withstand a real incident
Cyber security has become one of the most audited and regulated areas of enterprise technology. However, simply passing an audit or achieving certification is not the same as proving that systems, people and processes can withstand a genuine outage or cyber incident. Here, Nathan Charles, head of customer experience at cyber resilience specialist OryxAlign, explains why organisations need to look beyond compliance to build genuine operational resilience.
Facilities management businesses invest significant time and resource into achieving certifications such as ISO 27001 and Cyber Essentials, while also manging increasingly connected building systems and services. These frameworks provide valuable structure and demonstrate a credible baseline of security maturity. However, compliance alone does not prove that the systems, people and suppliers responsible for keeping buildings operational can withstand a genuine disruption.
Compliance frameworks like these set a recognised baseline, create accountability and give boards and customers a way to benchmark security maturity. The risk lies in what happens post-certification.
For many organisations, passing an audit becomes the objective in itself, rather than a step towards genuine resilience. Certification and self-assessment exercises capture a snapshot of security controls at a single point in time, under conditions that are largely predictable. They rarely test what happens when those controls are placed under real pressure, such as a ransomware attack that spreads faster than the incident response plan anticipated, a misconfigured update that takes building management systems offline, or a supplier outage with knock-on effects nobody had mapped.
When the paperwork doesn’t match reality
The gap between documented compliance and operational reality is well evidenced. The UK Government’s Cyber Security Breaches Survey 2025/2026 found that 43 per cent of UK businesses reported experiencing a cyber security breach or attack in the past twelve months. This is despite most organisations already having basic technical measures, such as malware protection, firewalls and access controls, in place.
For facilities management businesses, the gap between documented compliance and operational reality can have consequences beyond IT. Building management systems (BMS), access control, CCTV, heating, ventilation and air conditioning (HVAC), lighting and other connected systems can all play a role in keeping buildings secure and operational. A business may therefore have the required controls and documentation in place, but still be unable to demonstrate that these systems and the teams responsible for them can continue to operate during a severe but plausible disruption.
Regulators are recognising the gap too
Encouragingly, this is not a case of compliance frameworks being wrong; it reflects how regulators and standard-setters are actively evolving what they expect organisations to demonstrate. The National Cyber Security Centre (NCSC) has developed its Principles Based Assurance approach specifically to move away from assessment against fixed, compliance-driven control sets, in favour of a risk-based approach.
This means looking beyond whether individual building systems and processes meet documented requirements, towards whether they can be relied upon when conditions are no longer predictable. This is particularly important where responsibility is shared between facilities teams, building owners, technology providers, contractors and other third parties. Across sectors and geographies, there is a consistent direction of travel where demonstrated resilience, not paperwork, is the real measure of readiness.
From checklist to stress test
For organisations that want to close this gap, the starting point is treating resilience as something that is tested and proven, not assumed because a framework has been satisfied. That means running scenario-based exercises that simulate severe but plausible disruption, such as a ransomware attach affecting building management systems, the loss of a critical facilities contractor or technology provider, a failure of access control or other connected building systems, or a major cloud outage, and observing how systems, teams and decision-making actually hold up under pressure.
Compliance frameworks and regulatory obligations remain an essential part of managing cyber risk, and organisations should not disregard them. But they represent a floor, not a ceiling. Genuine operational resilience is proven under pressure, not certified on paper. Organisations that build a culture of continuous testing, honest assumption-challenging and cross-functional ownership will be far better placed to keep critical services running when, not if, disruption occurs.
To learn how OryxAlign helps organisations map digital dependencies and strengthen operational resilience, visit www.oryxalign.com.
