BAS-406 Reading Guide
How to use this reading guide
This is the concept-review layer for a 100% online course. Read each module before its lesson, complete the retrieval prompts without looking, then use the linked authoritative sources to verify project-specific editions, requirements, and manufacturer procedures.
Online evidence is not OJL: browser simulations, document cases, and isolated remote equipment build reasoning and documentation skill; supervised field performance is recorded separately.
Station role, architecture, scope, inventory, and requirements
Why it matters: A station is part of an OT system, not an isolated software file; recovery depends on hardware, OS/platform, network, identity, licenses, certificates, databases, controllers, and external services.
Vocabulary and working scope
Supervisor; station/server; controller; client; database; driver; field bus; IP network; cloud/service; interface; dependency; availability; scope; inventory; OPR; project standard.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
The owner requests a replacement supervisor but provides only a station backup and an old IP list.
Calculation: Reconcile required, discovered, documented, backed-up, restorable, and unknown assets/dependencies.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
Platform, OS, time, DNS, certificates, and licensing
Why it matters: A station can start and still be unrecoverable or insecure when time, certificates, DNS, licensing, compatibility, or entitlement is undocumented.
Vocabulary and working scope
Hardware; virtual machine; OS; platform version; firmware; patch; compatibility; time source; time zone; DNS; hostname; certificate; trust store; expiration; license; entitlement; activation; dependency.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
A restored station has a different hostname, expired certificate, five-minute clock offset, and a license bound to old hardware.
Calculation: Calculate clock offset, certificate/license time remaining, resource compatibility, and required maintenance window.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
Identity, RBAC, accounts, and secure remote access
Why it matters: Technical connectivity is not authorization; remote access must be deliberate, attributable, limited, monitored, and closed.
Vocabulary and working scope
Unique identity; role; least privilege; MFA where supported; service account; shared account; credential vault; session; Neeve; jump host; approved target; time bound; log; revocation; break glass.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
A vendor asks for permanent administrator access through a shared VPN account to troubleshoot one controller.
Calculation: Count users/roles/privileges, stale or shared accounts, session duration, approved targets, and closure evidence.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
Networks, drivers, device discovery, and segmentation
Why it matters: Discovery and broad firewall access can affect production; use approved boundaries, explicit targets, least functionality, and monitored tests.
Vocabulary and working scope
Interface; NIC; VLAN; subnet; route; firewall; port; protocol; driver; device; discovery; broadcast; BACnet/IP; BBMD; MS/TP; polling; timeout; segmentation; allowlist.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
A new supervisor sees duplicate BACnet devices across routed networks and floods a slow field bus with polling.
Calculation: Calculate address/subnet membership, poll load, timeout/retry impact, duplicate instances, and permitted flow matrix coverage.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
Station databases and core services
Why it matters: A station archive that omits external databases, certificates, licenses, drivers, or secrets is not a complete recovery capability.
Vocabulary and working scope
Point database; hierarchy; history; alarm; schedule; user; graphic; program; driver; log; audit; file store; export; retention; dependency; migration; integrity.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
Trends restore but alarm recipients, certificates, and custom driver modules do not.
Calculation: Inventory service records, retention/storage, dependency coverage, and restore pass/fail by function.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
Resources, capacity, performance, health, and monitoring
Why it matters: A larger resource allocation does not correct unbounded history, alarm floods, driver retries, database corruption, or bad program design.
Vocabulary and working scope
CPU; memory; heap; storage; database growth; network load; device count; point count; history rate; alarm rate; queue; latency; watchdog; service health; threshold; baseline.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
Station memory rises daily while a driver reconnects and an alarm storm expands the database.
Calculation: Calculate utilization, growth rate, time-to-capacity, event/record rate, latency percentile, and before/after baseline difference.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
Backup scope, frequency, protection, retention, and 3-2-1 strategy
Why it matters: A backup is a claim until its contents, integrity, ownership, protection, retention, and recovery use are tested.
Vocabulary and working scope
Configuration item; full/incremental; export; archive; database dump; external dependency; secret; encryption; checksum; offline copy; immutable copy; retention; RPO; 3-2-1; change trigger; owner.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
The only archive is stored on the running supervisor and is overwritten after each change.
Calculation: Calculate RPO coverage, copy/media/location counts, retention generations, storage requirement, checksum match, and dependency coverage.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
Restore testing, dependencies, secrets, licenses, and functional proof
Why it matters: Restore success means the approved recovery acceptance tests pass; a file that imports without error is insufficient.
Vocabulary and working scope
Clean target; restore order; prerequisite; hostname/IP; certificate; secret; license; driver; database; controller trust; time; smoke test; functional test; RTO; evidence; isolated network.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
A station opens after restore but cannot authenticate controllers, route alarms, or decrypt saved credentials.
Calculation: Measure RTO, compare to objective, reconcile restored functions/dependencies, and verify checksums and data recency.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
Patching, upgrades, compatibility, migration, and rollback
Why it matters: A current version is not automatically safer when unsupported dependencies, untested migration, or no recoverable rollback create greater operational risk.
Vocabulary and working scope
Supported version; release note; vulnerability; dependency matrix; firmware; module; database schema; certificate; license; staging; regression; maintenance window; rollback trigger; snapshot; downgrade limitation.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
A security patch requires a platform upgrade that changes database schema and drops support for a legacy driver.
Calculation: Reconcile dependency compatibility, test coverage, downtime estimate, migration duration, resource margin, and rollback feasibility.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
Disaster-recovery exercise, documentation, turnover, and as-left defense
Why it matters: A recovery plan improves through exercised evidence; untested steps, unavailable people, hidden credentials, and undocumented dependencies are findings, not assumptions.
Vocabulary and working scope
Scenario; incident role; communication; runbook; RPO; RTO; restore target; fallback operation; acceptance; issue; corrective action; training; owner; review cadence; as-built; recovery package.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
The primary supervisor fails during occupied hours and the designated backup operator cannot locate the current recovery package.
Calculation: Measure detection, decision, restore, and validation times; reconcile objectives, results, gaps, owners, and retest dates.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
Required and deeper reading
- ASHRAE Guideline 13-2024
Modern BAS specification, architecture, I/O, communication, configuration, testing, documentation, cybersecurity, and legacy-system context. - NIST SP 800-82 Rev. 3
Current OT security guidance for BAS access, segmentation, remote work, monitoring, and recovery boundaries. - NIST SP 1339 OT Backup Quick Start Guide
Current OT backup, restore testing, recovery exercise, and change-management guidance. - Honeywell Engineering Manual of Automatic Control for Commercial Buildings, 1997
Foundational control-loop, DDC, controller-programming, application, and BMS architecture source; legacy examples require current project and standards verification. - ASHRAE standards titles, purposes, and scopes
Official edition and scope route for Guideline 36-2024, Standard 135-2024, and related standards; adopted project edition controls.