The City of Jacksonville owns TIAA Bank Field. When the NFL Audit Committee’s compliance review program brought its Internal Audit function to assess the venue against the Department of Homeland Security’s Stadium Cybersecurity Best Practices Guidelines, the City had to be represented by someone who could speak for the estate. I worked the engagement alongside NFL Internal Audit, the Jacksonville Jaguars and the City’s Chief Security Officer — through walkthroughs, document production, validation of the observations, and the response the venue carried forward.
Whose building is it
An audit of a stadium is unusual in that the thing being assessed has three owners at once. The City owns the asset. The club operates the venue. The league sets the standard the review is written against. None of those parties can answer for the whole estate on their own, and the boundaries between them are exactly where an assessment finds things — the system everyone agrees matters and nobody clearly owns.
Getting the observations right therefore mattered more than getting them written. An observation validated in the room, with the three parties agreeing on what the system is and who runs it, becomes a response. One issued at the venue becomes a dispute about scope.
Control systems, not just servers
The scope reached stadium control systems as much as enterprise IT, which is the part that makes a venue review different from a corporate one. The systems that run a building holding tens of thousands of people are operational technology: access control and gates, life safety, power, HVAC, lighting, scoreboards and the networks under all of it. They were specified by different trades, procured on different cycles, and in many cases predate anyone’s expectation that they would be assessed as an attack surface.
That is where continuity and business impact analysis had to be done — not for a business process with a recovery time objective in a spreadsheet, but for systems whose failure mode is a crowd. And it is where the interesting boundary sits: between the venue’s operational technology and everything around it, which is the same it-OT convergence question found in a water plant or a substation, wearing a different building.
A stadium is a piece of critical infrastructure that happens to sell tickets.
Outcome
Observations validated jointly rather than issued at the venue, and a response the stadium carried forward.