Documentation

How we measure, model and assess buildings.

The Ownership Control Standard, our assessment and model, and the problems we find in buildings most often. Public, and free to use.

The Ownership Control Standard, our assessment and model, and the problems we find in buildings most often. Public, and free to use.

Request a briefing

GETTING STARTED

Shadow Guard documentation

The standard we measure properties against, how our assessment and model work, and what we find in buildings most often.

Written for owners, and for the IT, security and facilities teams who work with them. Everything here is public. You can use the Standard to check your own property without hiring us.

METHODS · VERSION 1.0 · OCTOBER 2026

Ownership Control Standard

Six conditions, one for each domain, that describe what it means for ownership to be in control of the technology in its building.

Every JANUS assessment measures a property against these conditions. Governance re-measures against them as people, contracts and systems change. Each condition is rated with one of three statuses:

● IN CONTROL

The condition is met, and ownership holds the evidence.

● PARTIAL

The condition is met in part, or is met but ownership cannot show it.

● NOT IN CONTROL

The condition is not met.

01 · INFRASTRUCTURE

Ownership holds administrative control of the network, and how it is built is documented.

What we check

  • Who holds administrator access to core switching, firewalls and wireless
  • Whether a current diagram matches what is installed
  • How building systems are segmented from tenant, guest and office networks

Evidence ownership should hold

  • Administrator account list for every network device
  • Current network diagram, held by ownership

02 · CYBERSECURITY

Ownership holds its own credentials and can revoke any vendor's remote access without asking.

What we check

  • Shared or default accounts on building and security systems
  • Every remote access path into the property, and who uses it
  • Whether ownership can disable a vendor's access on its own

Evidence ownership should hold

  • Credential register showing who holds what
  • Remote access register with an owner for each path

03 · PHYSICAL SECURITY

Ownership knows who administers cameras and door access, and can remove them.

What we check

  • Administrator accounts on access control and video systems
  • Where controllers and recorders sit on the network
  • How credentials are issued and removed when people leave

Evidence ownership should hold

  • List of administrators for access control and video
  • Written process for issuing and revoking credentials

04 · BUILDING SYSTEMS

Connected building systems are separated from each other and from the internet, and someone is responsible for patching them.

What we check

  • Which building automation, elevator, lighting and metering systems are networked
  • Whether any are reachable from guest, tenant or public networks
  • Firmware and software versions against what vendors support

Evidence ownership should hold

  • Inventory of connected building systems and their networks
  • Named owner for updates on each system

05 · VENDOR DEPENDENCIES

Each vendor's scope, accounts and documentation are on record, and nothing critical leaves with them.

What we check

  • What each vendor is responsible for, in writing
  • Which accounts, documents and configurations only the vendor holds
  • Handover terms if the contract ends

Evidence ownership should hold

  • Vendor register with scope, contacts and access
  • Copies of configurations and as-built documents held by ownership

06 · RESILIENCE

Backups and outage procedures have been tested, not just written down.

What we check

  • What is backed up, where, and how often
  • When a restore was last tested, and by whom
  • What happens to security and building systems when power or a circuit fails

Evidence ownership should hold

  • Record of the most recent restore test
  • Outage procedure for each critical system
Next: JANUS assessment

METHODS

JANUS assessment

Named for the Roman god who looks two ways at once. A JANUS assessment looks back at what is actually in the building, and forward at what ownership needs to control from here.

One property and a defined scope. Most of the work happens on site, with the people who run the building.

01

Scope

Agree on the property, systems, vendors and floors in scope, in writing.

→ Scope letter

02

Interview

Ownership, management and each key vendor: what they run, what they hold, what they would need to leave.

→ Interview notes

03

Verify

Walk the technology spaces and check what is there against drawings, contracts and what we were told.

→ Site observations

04

Measure

Measure each domain against the Ownership Control Standard and rank every finding by risk.

→ Risk register

05

Report

Walk ownership through the findings and agree the first 90 days.

→ Executive brief and 90-day plan

Included

  • Interviews with ownership, management and key vendors
  • Review of contracts, drawings and documentation
  • A walkthrough of the accessible technology spaces
  • A written report with risks ranked and a 90-day plan

Not included unless you ask

  • Penetration testing or exploiting vulnerabilities
  • Active network scanning or configuration changes
  • Electrical, alarm or low-voltage installation work
  • Legal certification that every risk has been found
See a sample report Next: ARGOS model

METHODS

ARGOS model

Named for the watchman of Greek myth with a hundred eyes. ARGOS is the model every property is built on in Command, so any issue can be traced from a single device up to the whole portfolio.

Every property is modeled on the same ten levels. That is what makes two buildings, or twenty, comparable. Examples below use the fictional Sample Tower.

LEVEL

EXAMPLE

WHAT COMMAND RECORDS

01

Portfolio

Every property one owner holds.

Three towers under one ownership group

Properties, owner, shared vendors

02

Property

One address under one ownership record.

Sample Tower, Miami

Address, ownership entity, management company

03

Building

Each structure on the property.

Tower A, parking podium

Floors, risers, technology rooms

04

Floor

Where equipment and people are.

Level 28

Spaces, closets, assets on the floor

05

Space

A room with a purpose.

IDF-28, security office

Assets, access, environmental conditions

06

Asset

A single device.

Door controller ACS-28-04

Make, model, firmware, network address, maintainer

07

System

The group an asset belongs to.

Access control

Vendor, administrators, head-end location

08

Dependency

What an asset needs to keep working.

Switch SW-28-01, UPS-28

Upstream device, port, power, circuit

09

Event

Anything that changes.

Controller degraded at 04:12

Time, source, related events

10

Decision

What ownership did about it, and who.

Shared login retired

Owner, action, date, evidence

See a record in Command Next: Common findings

FIELD GUIDE

Common findings

The problems we expect to find in most buildings. None of them needs new equipment to fix.

Each one maps to a condition in the Ownership Control Standard. Figures are cited in our research.

01 · CYBERSECURITY

Vendors share one administrator login

What it looks like

Two or more vendors, or a vendor and building staff, use the same administrator account on a building or security system.

Why it happens

It was set up that way at installation and nobody owned the account afterwards.

What it risks

Nobody can say who made a change, and ownership cannot remove one vendor without locking out the other. Third parties were involved in 48% of breaches in Verizon's 2026 report.

How to fix it

Named accounts for every person and vendor, held and issued by ownership.

Related reading

02 · BUILDING SYSTEMS

Building automation reachable from guest or tenant Wi-Fi

What it looks like

Controllers or the building management workstation can be reached from a network that guests, residents or tenants use.

Why it happens

Networks were added over years by different vendors, and separation was never tested from both sides.

What it risks

Anyone on the shared network can reach systems that control heating, cooling, elevators or lighting.

How to fix it

Separate the networks and confirm the separation from each side.

Related reading

03 · PHYSICAL SECURITY

Only the vendor can administer door access

What it looks like

Ownership and management can issue cards, but only the integrator can add or remove administrators.

Why it happens

Administrator rights stayed with the installer after commissioning.

What it risks

Ownership depends on one vendor to control who can change who opens which door.

How to fix it

Add an ownership administrator and keep a list of everyone with administrator rights.

Related reading

04 · INFRASTRUCTURE

No current network diagram

What it looks like

The most recent diagram predates the last renovation, or exists only in a vendor's files.

Why it happens

Changes were made by several parties and nobody was responsible for the record.

What it risks

Outages take longer to trace, and nobody can show which systems share a path.

How to fix it

A baseline diagram, held by ownership and updated when anything changes.

Related reading

05 · VENDOR DEPENDENCIES

Remote access with no end date

What it looks like

A vendor VPN or remote tool is always on, with no expiry, no log review and no named owner.

Why it happens

Remote access was granted for support and never reviewed.

What it risks

A vendor's compromised credentials become a path into the building. The 2013 Target breach began with credentials stolen from an HVAC contractor.

How to fix it

A remote access register, an owner for each path, and access that expires.

Related reading

06 · INFRASTRUCTURE

One circuit carries building systems and security

What it looks like

A single carrier circuit or core switch serves building automation, cameras and access control.

Why it happens

It was the cheapest design at the time, and nothing has failed yet.

What it risks

One failure takes several systems down at once, including the ones that keep people safe.

How to fix it

Map the dependency, price a second path, and write down what happens when it fails.

Related reading

07 · BUILDING SYSTEMS

Controllers running outdated firmware

What it looks like

Controllers are one or more major releases behind, with no plan to update them.

Why it happens

Nobody is named as responsible for updates, and vendors only act when asked.

What it risks

Known vulnerabilities stay open. Claroty's 2025 study found 75% of organizations had building management devices with known exploited vulnerabilities.

How to fix it

Name an owner for updates on each system and schedule them with the vendor.

Related reading

08 · RESILIENCE

Backups that have never been restored

What it looks like

Backups run, but nobody can say when a restore was last tested.

Why it happens

Backups are set up at installation; testing is nobody's job.

What it risks

Recovery time is unknown until the day it matters.

How to fix it

Test a restore, record it, and repeat on a schedule ownership can see.

Related reading
Next: Glossary

FIELD GUIDE

Glossary

The terms we use, in plain language.

Access control
The system of controllers, readers and software that decides who can open which door, and when.
ARGOS
Shadow Guard's ten-level model of a property, from portfolio down to a single decision.
BACnet
The most common communication protocol for building automation. Secure communication (BACnet/SC) was added to the standard in 2019.
Building automation system (BAS)
The controllers and software that run heating, cooling, ventilation, lighting and related equipment. Also called a building management system (BMS).
Command
Shadow Guard's software. It keeps one current record of every system, dependency and vendor in a property.
Dependency
Something an asset needs to keep working: a switch port, a power supply, a circuit, a vendor.
IDF / MDF
Intermediate and main distribution frames: the closets where network equipment for a floor, or for the building, is installed.
JANUS
Shadow Guard's assessment method. It looks back at what is in the building and forward at what ownership needs to control.
OT
Operational technology: systems that control physical equipment, as opposed to office IT.
Ownership Control Standard
The six conditions every property is measured against, one per domain.
PoE
Power over Ethernet: devices such as cameras and door controllers powered through their network cable, so a switch failure also cuts their power.
Remote access
Any way a vendor or employee can reach a building system from outside the property.
Risk register
The list of findings from an assessment, each ranked by risk with an action and an owner.
Segmentation
Separating networks so that systems on one cannot reach systems on another.
VMS
Video management system: the software that records and displays cameras.

COMPANY

Updates

What we have published, and when.

OCTOBER 2026

Documentation published

The Ownership Control Standard (v1.0), the JANUS and ARGOS references, common findings and a glossary.

OCTOBER 2026

Sample report

An illustrative JANUS report on a fictional property.

OCTOBER 2026

Research

Why building technology is hard to run, with every figure cited to its source.

Measure your building against the Standard.

Start with one property. We'll come back with a scope and a date.