Study guide
8.4 IoT, Cloud-Based BAS, Expert Systems, and Cyber-Security
AEE Certified Energy Manager CEM
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: Energy and Sustainability Policies, Codes, and Standards
1.1 Federal and State Energy Policies, Decarbonization Targets, and ESG Reporting 1.2 Building Energy Codes: ASHRAE Standard 90.1, IECC, and Compliance Paths 1.3 Energy Management Systems: ISO 50001, ENERGY STAR Benchmarking, and Portfolio Manager
2 Chapter 2: Energy Rates, Tariffs, and Supply Options
2.1 Utility Rate Structures: Volumetric vs. Demand Charges, Time-of-Use (TOU), and Real-Time Pricing 2.2 Demand Charges, Ratchets, Peak Shaving, and Power Factor Penalties 2.3 Energy Procurement, Deregulated Markets, Supply Contracts, and Green Tariffs 2.4 Demand-Side Management, Load Curtailment, and Transportation Energy Efficiency
3 Chapter 3: Energy Audits and Instrumentation
3.1 Energy Audit Methodologies: ASHRAE Level I, II, and III Audit Scopes 3.2 Audit Instrumentation, Data Loggers, Metering Accuracy, and Safety (PPE) 3.3 Baseline Energy Data, Utility Bill Disaggregation, and ECM Identification 3.4 Energy Modeling, Simulation, Digital Tools, and Performance Indicators
4 Chapter 4: Energy Accounting and Economics
4.1 Energy & Power Units (kWh, kW, Therms, MMBtu, Joules) and Conversion Calculations 4.2 Financial Metrics: Simple Payback Period, Return on Investment (ROI), and LCCA 4.3 Time Value of Money: Net Present Value (NPV), Internal Rate of Return (IRR), and Escalation 4.4 Advanced Financial Evaluation: Annual Worth, SIR, Depreciation, and Interest Formulas
5 Chapter 5: Electrical Power Systems and Motors
5.1 Electrical Fundamentals: Single/Three-Phase Power, Apparent/Real/Reactive Power, and Power Factor 5.2 Electric Motors: Efficiency Classes, Loading Calculations, NEMA Premium, and Losses 5.3 Variable Frequency Drives (VFDs), Affinity Laws, and Electrical Harmonics
6 Chapter 6: Lighting Systems
6.1 Lighting Fundamentals: Photometric Quantities (Lumens, Lux, Foot-Candles, CRI, CCT) and Efficacy 6.2 Lighting Technologies & Retrofits: LED Systems, Fluorescent/HID Replacement, and LPD 6.3 Lighting Controls: Occupancy/Vacancy Sensors, Daylight Harvesting, Dimming, and Task Tuning
7 Chapter 7: HVAC Systems and Building Envelope
7.1 HVAC Fundamentals & Psychrometrics: Dry-Bulb, Wet-Bulb, Dew Point, Relative Humidity, and Enthalpy 7.2 Cooling and Heating Equipment: Chillers (COP, kW/ton, EER, SEER), Heat Pumps, and Boilers 7.3 Air and Water Distribution: AHUs, VAV vs. CAV, Pumping Systems, Fans, and Economizers 7.4 Building Envelope: Heat Transfer (U-factor, R-value, SHGC), Infiltration, and Thermal Insulation 7.5 Building Envelope Calculations: Degree-Days, Solar Heat Gain, and Passive Design 7.6 Refrigerants, Cooling Towers, and Specialized HVAC Technologies (Absorption, VRF, Chilled Beams)
8 Chapter 8: Building Automation, Controls, and Artificial Intelligence Systems
8.1 Building Automation Systems (BAS) Architecture, BACnet, Modbus, and DDC Loops 8.2 Energy Control Strategies: Temperature/Pressure Resets, Night Setback, and Deadbands 8.3 Fault Detection & Diagnostics (FDD), Energy Analytics, and AI Optimization 8.4 IoT, Cloud-Based BAS, Expert Systems, and Cyber-Security
9 Chapter 9: Energy Storage Systems
9.1 Battery Energy Storage Systems (BESS): Technologies, Capacity, Efficiency, and Safety 9.2 Thermal Energy Storage (TES): Chilled Water, Ice Storage, and Phase Change Materials 9.3 Storage Dispatch Strategies, Tariff Integration, Peak Shaving, and Microgrid Integration
10 Chapter 10: Boiler and Steam Systems
10.1 Boiler Fundamentals & Efficiency: Combustion Efficiency, Excess Air, and Stack Losses 10.2 Steam Distribution & Traps: Steam Trap Types, Failure Modes, Testing, and Insulation 10.3 Condensate Recovery, Boiler Blowdown Control, and Waste Heat Recovery
11 Chapter 11: Distributed Generation and Renewable Energy Systems
11.1 Solar Photovoltaic (PV) and Wind Energy Systems: Design, Inverters, and Capacity Factor 11.2 Combined Heat and Power (CHP) / Cogeneration: Thermal Efficiency and System Sizing 11.3 Grid Interconnection, Net Metering, Islanding, and Microgrid Resilience 11.4 Biomass, Geothermal, Hydropower, Solar Thermal, and Waste-to-Energy Systems
12 Chapter 12: Industrial Systems
12.1 Compressed Air Systems: Efficiency, Pressure Drop, Leak Management, and Receiver Storage 12.2 Industrial Process Heating, Cooling Towers, and Industrial Refrigeration 12.3 Production-Normalized Energy Metrics, Pumping System Optimization, and Process Integration
13 Chapter 13: Operations, Maintenance, and Commissioning
13.1 Preventive, Predictive, and Reliability-Centered Maintenance Strategies 13.2 Building Commissioning: Existing Building Commissioning (EBCx) & Retro-Commissioning (RCx) 13.3 Savings Persistence, Continuous Commissioning, Sensor Calibration, and Alarms 13.4 Quantifying O&M Losses: Compressed Air Leaks, Steam Traps, Boiler Scale, and Group Relamping 13.5 CMMS, Water Treatment, and Human Behavior in Energy Management
14 Chapter 14: Energy Savings Performance Contracting and Measurement & Verification
14.1 Energy Savings Performance Contracting (ESPC), ESCO Roles, and Financing Models 14.2 Measurement and Verification (M&V): IPMVP Options A, B, C, and D 14.3 Baselines, Weather Normalization, Non-Routine Adjustments, and M&V Reporting
8.4 IoT, Cloud-Based BAS, Expert Systems, and Cyber-Security
Key Takeaways Explain This Topic AI
The Internet of Things (IoT) brings cheap, networked sensors and edge devices to buildings, enabling granular submetering, occupancy sensing, and equipment monitoring that older hard-wired BAS could not afford.
Cloud- and web-based BAS platforms give a CEM remote, multi-site access through browsers and mobile apps, centralizing analytics and dashboards but shifting data custody to the vendor.
Expert systems are rule-based AI that encode human diagnostic knowledge into if-then fault rulesets, complementing the machine-learning FDD of Section 8.3 with transparent, auditable logic.
BAS cyber-security risk grows as OT (operational technology) converges with IT; defenses include network segmentation, hardened protocols, default-password elimination, encryption, access control, and patching.
Because building controls increasingly touch safety and life-safety systems, a compromised BAS can disable ventilation, lock out chillers, or trigger alarms—cyber-security is an operational-continuity issue, not just a data issue.
Last updated: July 2026
IoT, Cloud-Based BAS, Expert Systems, and Cyber-Security
The Building Automation Systems of Section 8.1 ran on dedicated controllers and proprietary networks. The CEM Body of Knowledge now adds a connected layer: the Internet of Things (IoT) , Web/Cloud-Based Systems , Expert Systems , and Cyber-Security . These four topics reshape how a CEM collects data, runs analytics, and protects the buildings they manage.
The Internet of Things in Buildings
IoT refers to networks of inexpensive, internet-protocol-addressable sensors and edge devices. In a building, IoT delivers capabilities the legacy BAS could not:
Granular submetering at the panel or equipment level without running new control wiring.
Wireless occupancy and CO₂ sensors that feed demand-controlled ventilation and lighting.
Equipment-mounted vibration, current, and temperature sensors for condition-based maintenance.
Edge computing that pre-processes data locally to cut bandwidth and latency.
IoT's value is resolution at low cost : a CEM can suddenly see loads and conditions that were invisible when every sensor needed a home-run cable. The trade-off is data volume, wireless reliability, and a much larger attack surface.
Web- and Cloud-Based Systems
Cloud- and web-based BAS platforms move storage and analytics off the facility's on-prem server and into a hosted environment. A CEM accesses them through a browser or mobile app. Benefits:
Remote, multi-site access from a single dashboard—a CEM managing a portfolio sees every building in one pane.
Centralized analytics (the cloud is where the ML of Section 8.3 usually runs).
Easier updates and scalability —no on-site server to maintain.
Energy Information Systems (EIS) that aggregate meter data, weather, and occupancy into benchmarking and anomaly alerts.
Risks include data custody (the vendor holds the data), internet dependency (a WAN outage blinds the operator), and subscription cost over the asset's life. The CEM weighs these against the operational savings—typically cloud wins for multi-site portfolios, on-prem for a single critical facility.
Expert Systems
An expert system is a branch of AI that encodes a human expert's knowledge as a rule base —a set of transparent if-then rules applied by an inference engine . In buildings, expert systems typically drive rule-based fault detection and diagnostics (FDD) :
IF supply-air temperature > setpoint + 3°F AND chilled-water valve > 80% open AND outside-air temperature < 70°F THEN likely chiller capacity loss—investigate.
Expert systems contrast with the machine-learning FDD of Section 8.3, which learns patterns from data rather than from written rules. Each has strengths:
Approach Strength Weakness
Expert (rule-based) Transparent, auditable, encodes known physics Only finds faults someone thought to write a rule for
Machine-learning Finds novel/complex patterns Opaque "black box," needs training data, harder to audit
Mature FDD platforms blend both: rules catch the known faults fast and explainably; ML catches the subtle, novel ones. The CEM should know which engine is firing a given alert before acting on it.
Cyber-Security for Building Automation
As OT (operational technology—the BAS) converges with IT, building controls inherit IT's attack surface. A compromised BAS is not merely a data breach: it can disable ventilation, lock out chillers, shut down lighting, or trigger life-safety alarms . Cyber-security is therefore an operational-continuity concern, not just an IT concern.
Attack Surfaces
Exposed protocols: BACnet and Modbus were designed for reliability, not security. BACnet default port 47808 and unauthenticated Modbus can be scanned from the internet if the network is exposed.
Default and shared passwords on controllers and gateways.
Unpatched firmware with known vulnerabilities.
The IT/OT boundary: an attacker who breaches the corporate IT network may pivot into the BAS if the two are not segmented.
Hardening Measures
A CEM or their controls partner should enforce:
Network segmentation between IT, guest, and OT/BAS networks; place the BAS behind a dedicated VLAN and firewall.
Protocol hardening —BACnet/SC (Secure Connect) for encryption and authentication, or secure Modbus gateways; never expose a BAS port directly to the internet.
Credential hygiene —eliminate default passwords, enforce unique per-device credentials, use role-based access.
Encryption of data in transit (TLS) and at rest.
Patching and lifecycle management —track firmware versions and apply vendor patches; plan for controllers that can no longer be patched.
Monitoring and logging —audit who changed setpoints and when.
A response plan that includes the operational consequences of a control-system compromise.
Frameworks such as the NIST Cybersecurity Framework (Identify-Protect-Detect-Respond-Recover) and ISA/IEC 62443 for industrial automation adapt cleanly to building OT. The CEM's role is not to run the firewall, but to ensure cyber-security is specified in BAS procurements, verified in commissioning, and maintained over the asset's life.
The Connected Layer in Context
IoT feeds the data, the cloud aggregates and analyzes it, expert systems and ML turn it into actions, and cyber-security keeps the whole stack trustworthy. Together with the BAS architecture (8.1), control strategies (8.2), and FDD/AI analytics (8.3), this completes the Building Automation and AI domain the CEM must master.