The Defense Health Agency (DHA) strategic goals are to support the Military Department’s Surgeon General (SG), enhance the DHA role as a Combat Support Agency, and optimize DHA internal business processes. The DHA provides Enterprise Support Activities (ESA) to meet these strategic goals. The DHA Facilities Division is one such ESA tasked with delivering medical facilities worldwide. As the Department of Defense implements the Risk Management Framework, and the increased dependency on the cyberspace domain in both combat and defense, it is critical that DHA’s Facilities Division develop and implement standards that reinforce security of building controls systems and networked equipment. Doing so will improve standardization/reduce variation project‐by‐project, improve the cybersecurity for new facility construction, optimize investments in cybersecurity to balance security with lifecycle costs, and create flexibility for future modernization.