French energy efficiency and flexibility framework
Decarbonization objectives 2030
Smart building cybersecurity
Energy flexibility services
Building Automation and Control Systems
GIMELEC set a national target: 100,000 buildings equipped with BACS Flex Ready® systems by 2030. Building Automation and Control Systems (BACS) are becoming central to energy performance in tertiary buildings — monitoring, controlling, and optimising consumption, and enabling interaction with energy flexibility services. But as buildings connect to the wider electrical system, they open new interfaces and new risk: a cybersecurity weakness here can hit operational continuity, energy performance, data protection, and trust between the many actors involved. To support deployment at scale across public and private tertiary buildings, GIMELEC published the BACS Flex Ready® cybersecurity reference — aligned with France’s energy efficiency, flexibility, and decarbonisation objectives.
GIMELEC needed a shared cybersecurity reference for the BACS Flex Ready® ecosystem — one usable by every actor across a smart building’s lifecycle, from owners and integrators to maintenance providers and flexibility service operators, not just cybersecurity specialists. The point wasn’t a theoretical framework. It was operational guidance that holds up in real building projects — through design, commissioning, operation, and maintenance — and stays simple enough to deploy at national scale without becoming a bottleneck.
The core challenge was defining a baseline that enabled energy flexibility without slowing deployment. Flexibility services require buildings to interact with the broader electrical system, and those interactions create new interfaces, responsibilities, and risks. Three realities made this hard. The ecosystem is fragmented — a single project spans owners, operators, integrators, suppliers, maintenance firms, and external flexibility providers, each with different responsibilities and different levels of cybersecurity maturity. Tertiary-building deployments are cost-sensitive and full of legacy equipment, so requirements had to stay realistic. And the flexibility interface itself — the API between operators and BACS systems — had to be secure, testable, and clearly specified. The reference had to be technically meaningful, operationally usable, and scalable enough to serve a 2030 national ambition all at once.
01
Defined a pragmatic cybersecurity reference built for the realities of tertiary buildings: operational constraints, many stakeholders, diverse deployments, and a need for guidance that non-specialists can actually apply.
02
Mapped cybersecurity responsibilities to each actor across the building lifecycle — design, integration, commissioning, operation, maintenance, and flexibility services — so each one’s obligations were understandable and actionable.
03
Contributed to the specification of the API that flexibility operators use to interface with BACS systems — the central mechanism of the model — clarifying how those exchanges should be structured and secured.
04
Defined a test certificate framework for that operator API, so implementations could be verified consistently against the expected behaviour and security requirements.
05
Produced a Protection / Evaluation Cybersecurity Specification (PECS) for flexibility operators, formalising the cybersecurity expectations for anyone interfacing with BACS systems and giving the ecosystem a structured basis for evaluation.
06
Delivered a downloadable reference file for owners, operators, and integrators, so the guidance could be used directly in real projects by operational teams, not only security experts.
Scaling energy flexibility in buildings only works if cybersecurity is practical, shared, and operational — a baseline abstract enough to be ignored, or complex enough to stall projects, fails either way. Smart-building security also has to reach well beyond the equipment: it lives in the interfaces, APIs, responsibilities, operating conditions, maintenance, and testing that tie the ecosystem together — and especially in the role of external flexibility operators. A common framework covering API specification, test certification, and operator obligations is what aligns owners, integrators, operators, and flexibility services around a single, deployable standard — which is exactly what a national target like 100,000 buildings by 2030 requires.
We’ll send you access by email.
