Metasys Advisory: BAS Controller RFQ Records for Facility Automation

CISA published an Industrial Control Systems advisory for Johnson Controls Metasys. For facility maintenance and sourcing teams, the practical takeaway is broader than one BAS platform: building automation controllers, supervisory servers, gateways, I/O modules, power supplies and communication devices need clear records before a spare-part RFQ is sent.

This article uses CISA's Metasys advisory as public OT security context. It does not claim that any Johnson Controls, Metasys, BAS controller, supervisory server, gateway, I/O module, power supply, communication module or spare part is available, original, authorized, newly patched or covered by a fixed warranty. Those details must be confirmed for each exact inquiry.

What CISA published

CISA's Johnson Controls Metasys advisory was published under its Industrial Control Systems advisory program. It provides public security context for a building automation platform used in facility control environments.

CISA also maintains an ICS advisories index where teams can review recent OT advisories. These pages are useful references, but they do not identify the exact installed controller, version, cabinet position or replacement requirement at a specific site.

Why BAS controller RFQs need more than a platform name

Facility automation systems often include controllers, expansion I/O, supervisory software, network engines, gateways, sensors, power supplies and Ethernet devices. A maintenance ticket may describe an air-handling unit, chiller plant, building network or operator workstation, while the RFQ may actually be for one small controller or module.

If an inquiry only says “Metasys controller” or “BAS gateway,” the reviewer has too little evidence. The RFQ should separate the exact installed item from the building-system function. That makes it clear whether the request is for identical replacement, compatible spare review, documentation confirmation or maintenance stock planning.

Records to capture before requesting BAS parts

A useful BAS spare-parts inquiry should preserve both hardware evidence and facility context.

1. Complete manufacturer, model, order code, revision and serial details from the installed item.
2. Firmware, software, project or supervisory system version if visible in maintenance records.
3. Photos of the front label, side label, terminal area, ports and installed panel position.
4. System role: field controller, supervisory controller, I/O module, gateway, network engine, power supply or communication device.
5. Facility context, such as AHU, chiller plant, boiler room, energy meter, access-controlled cabinet or BMS network segment.
6. Network or protocol context, including Ethernet, BACnet, Modbus, serial, fieldbus or documented site standard.
7. Quantity, condition preference, destination country and required timing.

Advisory context is not interchangeability proof

A public advisory can identify what needs review, but it does not prove that another controller or gateway is a drop-in replacement. Firmware, project files, protocol support, I/O count, terminal layout, power input, licensing, supervisory compatibility and site commissioning rules can all matter.

If a site wants an alternative, the RFQ should list the installed original and proposed item separately. Mark what is known, what is unknown and what requires engineering approval. That avoids turning a sourcing request into an unsupported compatibility claim.

How NANKMOS should handle facility automation inquiries

NANKMOS should treat BAS advisory context as a prompt to ask for better asset evidence. The response should remain tied to exact part numbers, photos, version records, panel location, condition preference and destination.

Readers can search controller and automation product records, review industry application resources, read product-system guidance, or send a BAS controller RFQ. Availability, documentation, compatibility and delivery should be confirmed against the exact item.

Final takeaway

Building automation systems are operational control systems. RFQs for BAS controllers and gateways should be as specific as RFQs for PLC, DCS or industrial networking parts.

A strong inquiry includes the exact model, revision, firmware or software version, label photos, panel location, system role, protocol context, quantity, condition preference and destination. That gives maintenance and sourcing teams a clearer basis for review.