Top 5 stories from Facilities Dive

A federal rule that took effect on January 1 puts a compliance burden on managers whose facilities use HVAC systems, freezers and other appliances with as little as 15 pounds of hydrofluorocarbons refrigerant charge.  

“This is definitely a new paradigm,” Steven Blumenfeld, vice president and general manager of Trakref, a cloud-based refrigerant management platform, said in an interview. There are “meaningful new responsibilities for facilities managers.”

The leak repair and management rule, which the U.S. Environmental Protection Agency finalized in 2024 and took effect at the beginning of 2026, lowers the threshold for appliances that must comply with greenhouse gas restrictions from 50 pounds of hydrofluorocarbons refrigerant charge to 15 pounds.  

The rule requires facilities managers with these smaller appliances to calculate the rate at which refrigerant is leaking every time they add to the appliances more HFC refrigerants or, if they use a substitute, those substitutes with a global warming potential, or GWP, greater than 53. 

“The low applicability threshold greatly expands the scope of the rule,” David Arthur Terry, an attorney with Hunton Andrews Kurth, says in a December blog post.  

If the leak rate is above a certain threshold, facilities managers must make a verifiable repair within 30 days and, if they can’t do that, either retrofit or replace the appliance within a year.

That requirement “provides very little time to repair a system before a system owner must begin to plan and implement the complete overhaul, retirement, and/or replacement of their system,” Terry says in the post. 

For facilities that already operate a refrigerant‑management system, the new regulatory landscape simply expands the scope — more equipment to track, more data to manage and more rigor required, Blumenfeld says. For those that don’t have a system in place, compliance will require a step-up in data collection and record keeping. That can be a challenge because the existing technologies that facilities managers rely on often operate in isolation to one another, with the HVAC system using one technology and freezers and other appliances using other technology — what Blumenfeld calls a “massively distributed problem.” 

“That [management system] gap now translates into meaningful new responsibilities for facility managers,” Blumenfeld said. At the core, managers will need to keep “auditable records” or “risk compliance exposure if logs are incomplete or improperly maintained,” he said.

A typical facility relies on a computerized maintenance management system or work‑order system for day‑to‑day operations, a separate environmental health, safety and compliance platform for regulatory documentation, and yet another asset‑inventory system for equipment tracking, Blumenfeld says. At the same time, service technicians typically use their own mobile tools or contractor‑specific platforms to log activities. “The result is a patchwork of disconnected systems,”  Blumenfeld said.

For facilities starting from scratch, step one is to tag all of the appliances that could fall under the compliance threshold, says Basant Singhatwadia, global director of customer success and strategy at Facilio, a multi-site facility management enterprise platform. 

“The challenge is that a lot of companies don’t have refrigeration assets tagged in their systems,” Singhatwadia said in an interview. “This is a daunting and potentially very expensive problem, because you basically need boots on the ground.”

Retail facilities could be especially hard hit to the extent they’re big users of refrigerated appliances, Singhatwadia said.

Blumenfeld recommends facilities managers prepare for compliance by detailing their inventory and then evaluating each appliance to determine its exposure under the new rule. Once that’s done, they can devise a system for monitoring leaks and then put in place an audit trail for filing with the EPA.   

Singhatwadia recommends facilities managers look for software that has compliance requirements built in and has a strong reporting engine. “It’s quite important because, what I've seen in the industry is that, once the year ends and the reporting period starts, people are scrambling for a month or two to generate their reports from an Excel spreadsheet,” he said. “Sophisticated refrigeration management software should be able to generate the required reports with a press of a click.”  

He said advanced refrigerant management systems are equipped with AI-driven telemetry and use sensor-based monitoring to identify slow leak detection and include automated repair workflows and compliance monitoring.

Three out of four companies have building management systems vulnerable to hacking or cyberattack, according to a new research paper by Claroty, a cyber-physical systems protection company. More than half of affected organizations had systems insecurely connected to the internet with known exploited vulnerabilities that were linked to ransomware, it said. 

The report studied over 467,000 building management systems across 500 organizations. Within those organizations, 2% of devices essential to business operations were operating at the highest level of risk exposure, according to the report. 

The high exposure level of these devices provides malicious cyber actors with easily accessible entry points that “leave the door open to costly and potentially dangerous disruptions,” Claroty said Wednesday in a release. This combination of risk factors is concerning due to the widespread reliance on these systems to operate HVAC, lighting, energy, security and other systems in commercial real estate, retail, hospitality and data center facilities, the company said. 

Many building management systems are old and were not built with internet connectivity in mind. As a result, some may no longer be supported by their respective vendors, meaning vulnerabilities remain unpatched, Claroty says. 

While these systems were previously operated independently by facilities management staff, they are now more commonly connected and integrated using advanced building management and building automation systems, according to the report. But the benefits of connecting operational technologies and Internet-of-Things devices to the internet come with “very clear cybersecurity tradeoffs if not properly managed,” Claroty says. 

Third-party access provides another set of risks, with many vendors bringing in their own remote access technologies that may not be enterprise-grade or support security features like multifactor authentication, Claroty says. 

For facilities managers working to meet occupier demand for high-tech amenities, integrating vendor technologies can present trouble, according to Tom Karounos, global head of building technology at Tishman Speyer. 

“You start adding these things, you add complexity from other vendors coming in and plugging things into your network, [and] you always run the risk” of a cyber attack, Karounos said during a panel at the Realcomm IBcon conference earlier this month.

Making a plan to protect your business

Organizations undertaking digital upgrades have an opportunity when bringing BMS online to measure the business impact and safeguard the operational criticality of those devices, Claroty says. They can accomplish this by adopting a security framework that provides decision-makers and asset owners with a true assessment of security, as well as a remediation plan that can assist risk management teams and is understandable by executives, the company says. 

“With BMS controlling so much of modern-day CPS infrastructure, it’s critical to move from a reactive approach to a proactive strategy,” Claroty says. “Unless organizations use a comprehensive asset management solution to discover every device within a network, vulnerabilities and risks to critical assets can lurk unseen.”

The cyber-physical security firm advises a five-step action plan for this framework, including scoping, discovery, prioritization, validation and mobilization. By following these steps, operators can gain full visibility into assets and their exposure, assess the potential impact on business continuity and provide security and operations teams with information that can enable practical, non-disruptive risk reduction, per the report. 

Vetting vendors is especially important, according to Karounos, who says his company has a rigorous evaluation process.

“We do that on a yearly basis,” he said.“We take the vetting process very seriously, and we partner with our procurement team to keep us honest, so there’s no ambiguity there.” 

CEIA USA makes money when schools buy its metal detectors, but one of its employees would rather not see the market grow as fast as it has. 

"It's not right,” Tom McDermott, a company representative who advises schools on safety issues, said in an NPR episode last month. “We need to solve this problem. It's good for business, but we don't need to be selling to schools."

School officials are unlikely to stop buying anytime soon. Since the 1999 shooting at Columbine High School in Columbine, Colorado, when 13 students and a teacher were killed, there have been 400 school shootings, NPR reported based on a Washington Post analysis. The shootings have helped create a school security industry in the U.S. that market research firm Omdia says is $4 billion in size and growing. 

"Some people want to put their heads in the sand and pretend like it's not going to happen to them," Sarah McNeeley, a sales manager with SAM Medical, which sells trauma kits, said in the NPR episode. "Being prepared and having these devices in the schools is essential."

It’s not just schools driving security spending growth. The U.S. physical security market, of which commercial properties are a big component, is expected to grow to almost $57 billion in 2030, up from $38 billion in 2023, research shows.

Incidents like the shooting at 345 Park Ave. in July are likely behind some of that growth. With high-profile tenants like the NFL and private-equity firm Blackstone, the office building had a reputation for strong security like many other buildings in Manhattan. But the gunman was able to walk through its doors without incident despite openly carrying an AR-15. 

"It takes significant resources [to] prevent somebody from having free flow access through a facility," Matthew Dumpert, global leader of enterprise security risk management at financial and risk advisory firm Kroll, said in a Reuters report. 

Dumpert and executives at other firms told Reuters the number of calls they received from organizations seeking building security advice skyrocketed after the shooting. 

“Clients [called] with questions about how to protect themselves from similar attacks,” Dumpert said. 

As long as shootings remain elevated, facilities managers will be under a spotlight for the steps they take to secure their buildings. 

“We will not accept this as ‘business as usual,’” employees at the Centers for Disease Control in Atlanta said in August after their office was sprayed with more than 150 bullets by a gunman who reportedly was worried about vaccine safety. Speaking through their union, the employees said they wanted bullet-resistant glass installed in all of the buildings on the CDC campus, armed guards, weapons detection capabilities and an enhanced alert system. 

“Temporary fixes won’t cut it,” the employees’ union said. 

Schools with resources are increasing their use of security guards, adding bullet-resistant glass to their buildings and contracting to have drones operate on their campuses. A handful of Florida schools are participating in a pilot program in which they’re maintaining on-site drones that can be deployed if there’s an incident.

“In a school shooting, most of the death happens in the first 120 seconds, so [the drones are] about how quickly can you get there to engage the shooter,” Justin Marston, CEO and co-founder of drone company Campus Guardian Angels, said in a CBS News report. 

Florida has approved $557,000 in its 2025–2026 budget to fund the drone program in three school districts, the CBS report said. 

Security list

There are a handful of items facilities managers can put on their shopping list if they don’t want to take chances on security, Shaun Pace, president of San Antonio-based security company Pace Protection, said in an Inc. report. These include bullet-resistant glass, a second set of doors at entrances, gun detectors, a panic alarm system and heightened elevator security. 

Different grades of bullet-resistant glass are available but facilities managers can also coat building exterior windows with bullet-resistant film, which is cheaper and can buy occupants time to find cover before the bullets penetrate the glass, Pace said in the Inc. report. “Every second can save a life in these situations,” he said. 

A set of security doors directly behind the main entrances is a way to isolate the interior of a building from intruders after they’re inside. “Guests shouldn’t be able to just stride into an office building, especially places housing high-profile companies like the NFL and Blackstone,” Pace was paraphrased as saying.  

Weapons detectors installed directly behind the security doors can trigger an alert if someone’s carrying a gun or an explosive device. The technology is more advanced than a standard metal detector. It costs between $40,000 and $50,000 for each unit, Pace said.

In the 345 Park Ave. shooting, occupants were texting to warn others in the building of the intrusion, something they wouldn’t have to do if the building had a panic alarm system, Pace said. Ideally, the system would announce the threat over a voice intercom and trigger flashing lights on each floor. Relying on occupants to text one another, Pace said, is far from “standard practice.”

Enhanced elevator security can be a last line of defense by enabling any security officer or building management employee to shut the system down if an intruder is heading to another floor. In the case of 345 Park Ave., only the security guard who was slain in the incident could shut down the elevators, the Inc. report said, so the shooter was able to get to an upper floor, where he shot a Blackstone employee. 

Having only one person able to shut down the system is “absolutely not” a best practice, Pace said. 

The list of security upgrades might seem extreme but there have been 350 mass shootings in the U.S. since the start of this year, according to Gun Violence Archive. The two most common settings are workplaces and schools, where 28% and 22% of the shootings occur, respectively, according to a tracker maintained by the Rockefeller Institute of Government. 

Editor’s note: Omdia is owned by Informa, parent company of Informa TechTarget, of which Facilities Dive is a part. Facilities Dive makes editorial decisions independent of Informa. 

Prisons have fences around their perimeter to keep inmates from escaping but these structures have been unsuccessful at stopping outside collaborators from using drones to drop drugs, phones, tools and other contraband inside the fences for prisoners to use.

“We fight this battle every day,” Joel Anderson, director of the South Carolina Department of Corrections, told WIS News 10 in a Jan. 21 report. 

Over the last decade, contraband drops have become a problem for facilities, in the United States as well as Canada, the U.K., and other countries, reports show. 

A phone scam targeting healthcare workers in Iowa that netted $500,000 in illegal proceeds, for example, originated from a prison in Georgia by inmates who were running a call center using phones delivered to them through drone drops, ABC News reported.   

“A person inside of the Calhoun State Prison in Georgia … was running the show," Joseph Vogel, an Iowa private detective who investigated the calls, said in the report. 

Department of Justice and FBI officials in testimony last year said there were 479 drone incidents at federal prisons in 2024, up from 23 in 2018. 

Consolidated data on state prison incursions isn’t available, but in South Carolina, there were 254 reported drone drops last year, say prison officials in the state. They think that number could be higher. 

“It could be well over 300, 350,” Anderson said in a Corrections 1 report. “We don’t see [those flights] in the middle of the night that never make it in.” 

In Georgia, officials reported more than 70 incidents in November, the highest one-month tally they’ve seen, the ABC News report said. 

"We're under attack every single day when it comes to combating this issue," said Tyrone Oliver, commissioner for the Georgia Department of Corrections. 

From a legal standpoint, prison facilities are limited in what they can do, in part because of Federal Aviation Administration rules prohibiting drones from being shot down because of their classification as registered aircraft.

Even if prisons could shoot them down, a Rand study says, officials would be inviting legal liability because of the danger a disabled drone would pose to surrounding areas. “Legal limitations notwithstanding, there are significant questions about the practicality, safety, and effectiveness of [shooting down drones],” it said. 

The FAA cites safety issues as one of the reasons it hasn’t carved out a shoot-down exception for drones. “An unmanned aircraft hit by gunfire could crash, causing damage to persons or property on the ground, or it could collide with other objects in the air,” the agency says.  

The drugs that these drones typically carry could also be a problem. Prison officials in South Carolina said they apprehended a drone that contained enough fentanyl to kill everyone in the prison. “Four hundred and sixty-four grams of fentanyl in one bag with one drone," Anderson told Fox News. "We would hate to disable a drone, and it flies off into a subdivision somewhere, and then we don't know where it is." 

The FAA is aware of the risk of drones over prisons and released an update when the problem was emerging, about eight years ago, to restrict flights over some of the federal government’s prisons, but it has yet to add prisons as a class to its list of facilities over which it prohibits the flying of drones. 

States are filling the regulatory breach within the authority they have, but because they must work within FAA restrictions, the laws tend to focus on stepped-up penalties, not on how drones can be apprehended. Maryland, for example, enacted a 2024 law imposing a $1,000 fine and a 3-year sentence on anyone caught flying a drone over a prison, while a 2019 Delaware law makes it a felony to fly a drone over a prison. 

Tracking and apprehension

The best practice for prison facilities dealing with drones is to deploy technology to track them and when one lands within the premises, to apprehend it. 

South Carolina officials are doing that using a detection system for its medium and maximum security prisons. The system sends an alert so the prison can activate a pre-selected team of facility staff to go to the area to recover the drop — and sometimes the drone. 

"We've had drones caught in our nets,” Anderson said in the Fox News report. “We've had drones caught in our fences. We've had drones crash on the yard. We've had drones where the battery ran out."

The FAA permits drone tracking in part to regulate their use over restricted areas, like airports, but a 2020 advisory prepared by the FAA and other federal agencies says only federal authorities can jam or otherwise interfere with drone operations. That means prison officials are generally limited to dealing with the drop, not the drone itself, unless one crashes or is otherwise recoverable.

“Correctional institutions must assume a detect-and-respond posture,” the Rand report says.

It’s valuable for prison officials to track the drone even if they can’t apprehend it because they can obtain the identity of the owner, manufacturer, model and other data that can be useful for spotting patterns and handed over to law enforcement, says a white paper prepared by Dedrone, a security technology company. 

“Security personnel can use flight data to determine if a single drone has visited the area multiple times or if there are multiple, individual intruders, and record if there are certain days or times where there are an increase in incidents,” the paper says. “This data is invaluable when looking to identify and prosecute pilots who violate laws.”

Tracking technology that homes in on the radio signals that all drones release is widely available and is indispensable for prison facilities trying to combat the problem, the Rand paper says. 

“Most institutions rely on human observation for detection, but this is problematic,” the paper says. “Many agencies are experiencing significant staff shortages and perimeter patrols and tower posts might not operate at full capacity, particularly during overnight hours, when most drone activity is likely to occur Furthermore, at a distance, drones can be virtually invisible to the naked eye or mistaken for a bird or another object and the sound of a drone can be easily misinterpreted.”

“Recorded cases of drones being used for contraband have been exponentially increasing,” says a post by Airsight, a drone detection company. The company touted its technology as the kind of thing prison facilities can put in place to give themselves some defense against incursions even if they can’t stop the drops. “Early Detection … provides immediate alerts when unauthorized drones breach the perimeter, allowing prison staff to take swift action,” it says. 

Given the safety issues of interfering with drones, the FAA is unlikely to allow facilities to take more action, so detection appears to be prisons’ go-to defense for now. 

CHICAGO — In the basement of the Aon Center here, Brendan Talty moves through a corridor lined with brightly colored tape that shows where to walk, and where not to, under large, brightly colored pipes. Talty, chief engineer of the Aon Center for JLL’s property management business, runs a 21-person engineering team overseeing the city’s fourth-tallest skyscraper. 

Completed in 1973 as the Standard Oil Building, or “Big Stan,” the Aon Center has 83 floors and is the 13th-tallest building in the U.S., at 1,136 feet. After cracks were found in the exterior, the building was reclad in 1992 and more recently was upgraded with a redesigned lobby, modernized elevators and improvements to the doors connecting the building to Millennium Park.

The building is home to more than 8,000 employees of Fortune 500 companies that include Kraft Heinz, Microsoft, HCSC, KPMG, Aon and JLL — which calls the skyscraper home. In addition to the four and a half floors of headquarter space it occupies, the firm oversees the building’s mechanical and other systems and provides property management services to the building’s tenants. 

The mechanical parts of the building’s operations often begin and end with Talty, whose team of engineers is in charge of keeping the building’s systems operating safely and efficiently. That means monitoring and maintaining one Cleaver Brooks boiler (max steam capacity 32,000 lbs. per hour), two large Unilux boilers with Weishaupt burners (max steam capacity of 25,000 lbs. per hour each), chilled water from a district cooling system operated by CenTrio Energy, and the HVAC controls and equipment that run through the building. 

On top of their maintenance and compliance work, the engineers try to find ways to improve the energy efficiency of the building’s systems to reduce costs and emissions, according to Talty. His team recently decommissioned a Cleaver Brooks boiler that wasn’t needed and conducted a steam study to see if they could replace more of the building’s energy with electrification. 

One change they’re looking at is installing a combined heat and power unit where the decommissioned boiler used to be as a way to generate electricity using steam that’s already being produced. 

The change is expected to create a power unit that’s 70% to 90% efficient versus the 45% to 50% efficient they would get with separate systems, Talty said. Utility bills would be lower, too, with the on-site electricity generation. The combined unit would also reduce emissions compared to grid electricity and reduce the building’s dependence on grid power, improving resiliency. 

To improve efficiency further, the team is updating the building energy management system, first by replacing obsolete controllers, which will enable them to implement conservation measures, Talty said. Two other phases will follow.   

Meeting sky high expectations

In its role of property manager, JLL faces the same trends impacting the broader commercial real estate market, including the need to align buildings to what today’s workforce wants: attractive, flexible and functional space, high-tech amenities and healthy indoor air quality.     

Tenants want buildings that are sustainable and energy efficient, so staying on top of building system improvements and maintaining open lines of communication with occupiers is crucial, said Jenny Hosmon, senior vice president and Aon Center operations manager at JLL. 

Hosmon is in charge of leasing space, communicating with tenants and ensuring they’re safe and satisfied. 

One of the assets for keeping tenants satisfied is the Cloud Level, a conference center, fitness facility and lounge on the building’s 70th floor, making it the highest amenity space in Chicago. Opened in 2019, the space provides panoramic views of the city and gives employees and tenants a place to host meetings, meet up or decompress. 

The space is managed by JLL’s experience management team in partnership with Infuse Hospitality, a foodservice management company. Together, they keep the lounge stocked and manage events. Another partner, Lulafit, manages the fitness center, which employees can access for an annual fee. The experience management team also handles concierge services, tenant engagement and event planning, working in tandem with Hosmon’s team. 

For management issues involving its own headquarters operations, many requests go to Adrienne O’Brien, workplace manager of JLL’s Midwest region, and Patricia Byrne, workplace coordinator for JLL work dynamics. 

“I love that I get to … fix the lighting system, install sensors” as well as oversee the property management side, said O’Brien.

Providing an experience at JLL HQ

For employees and tenants, the building experience often comes down to the quality of the food and beverages and how well the space works for collaboration, breaks and other workplace needs, Byrne and O’Brien said. 

A report by ezCater based on a survey of 1,000 U.S. workers supports the idea that employees and tenants want informal, social spaces, including outdoor areas, breakrooms and eating areas. 

Workers are happiest when the building space leans into both technology and in-person ways to connect, the ezCater report says. “If those in-person gatherings involve food, even better,” the report says. 

One way JLL tries to meet those worker preferences is with commercial grade dishwashers on all of its floors. The appliances heat to 280 degrees Fahrenheit, making them sanitary for food service purposes. That’s enabled the firm to remove paper and plastic products from its food and beverage areas, O’Brien said. 

“There’s significant cost savings, plus it helps with our sustainability goals at JLL and really brings a sense of home to the office, O’Brien said. “When you walk in and you're handed a cup of coffee or a glass [rather than a paper cup that gets thrown away], it really makes for this incredible building experience and builds that sense of belonging.” 

A day porter is on-site during the week to load and unload the dishwasher with cups and other service items. When a machine needs to have work done, employees file a ticket that is accessed and managed on JLL’s Corrigo platform, replacing a previous email system, Byrne said. 

“Everything funnels through Corrigo,” she said. “We see invoices that come in and then you have your open work orders. It’s used in many ways.” As the point person for the service requests, Byrne will decide whether to pass the ticket along to a vendor or to another JLL department. 

Moving forward, that process is expected to become more efficient with the help of AI through JLL Serve, the firm’s AI-powered facilities management application that integrates data from assets to provide a centralized view of operational performance, maintenance and compliance requirements. 

“JLL Serve is the next step in the Corrigo process that we’re about to implement,” O’Brien said. “That will connect the vendor to the work order and then turn around and bill out. “It’ll just really be that glue that connects all those dots together.” 

JLL is also implementing a QR code system to provide repair, maintenance and preventative maintenance services, or RMPM. With that system, operators can scan a code during regular maintenance checks, whether conducted daily, monthly or quarterly, and get information that can help inform next steps.  

“The nice thing about this is that it gives you that history to go back and really look at things,” said O’Brien. “We recently used Corrigo to go look up an issue that we were having with one of our coffee machines. It was constantly breaking. We looked back and it was like seven or eight tickets, so we reached out to the vendor and said ‘Time to replace the machine.’ That’s a perfect example of the system working for us to make a more efficient process.” 

The broader trend of companies requiring employees return to the office is being driven in part by both employers and employees wanting more collaboration and both seeing the office as a hub for teamwork and communication, according to JLL’s 2025 Global Occupancy Planning Benchmark Report. 

One way JLL works toward this goal is through Resource Scheduler, a company tool that employees can use to look at rooms and reserve them, with pictures and information on seating, audio-visual support or whether there’s window access. JLL’s workplace management team also uses Space, the company’s platform for managing seat assignments, reserving desks and making other space management decisions. 

“Every month we get a badge study based on attendance in the office based on WiFi and badge swipes,” O’Brien said. “They compile that data and we can look at each one of those zones and areas to make sure that the number of seats assigned to that particular unit are appropriate for their attendance in the office and then base their seating on that.” 

Delivering on both hard and soft services

Running the Aon Center, like many buildings, comes down to ensuring building systems are functioning properly and making tenants happy, according to Michael Thompson, workplace management lead of the Americas at JLL. 

“If you’ve got great hard building services, that Brendan [Talty] is running, but you don’t have great hospitality, the person’s experience is not going to be great,” said Thompson. “Likewise, you can have great hospitality and everything, but if the building isn’t cool, people don’t feel safe and the elevators aren’t working, you aren’t going to have a good experience.” 

With employers and tenants looking for office space that meets all of their needs — sustainable and efficient energy use, healthy indoor air quality, good mix of flexible, collaborative and other types of space, with amenities and technology — occupancy planning becomes crucial to attracting and retaining workers, Thompson said. 

“Having this kind of understanding of what your occupancy patterns are really drives everything, from an energy perspective in heating and cooling the buildings to what we need to do from a hospitality perspective,” he said.

“Every day is a puzzle,” O’Brien said. “That puzzle is challenging, and you really have to think about how all the pieces are going to fit together to make an amazing experience or product.”