Licensing is not a cyber rule
Dubai Land Department and RERA, and the Abu Dhabi property rules, govern real-estate activity. The research found no verified universal cyber audit cycle in them.
Smart building and property cybersecurity in the UAE: In property, a breach can lock tenants out or divert a rent payment.
Attackers use ordinary routes: a phished login, a vendor account, a fake payment email. In a property business, those routes sit close to building systems, tenant data and the people who move money for deposits and rent.
The road to money
Where an ordinary intrusion goes in a property business
The first steps look like any other sector. The last three do not.
- A call or a click
A spoofed email from a broker, a landlord or a vendor, or a stolen password for a leasing platform.
- A trusted identity
Not only administrators. Leasing agents, finance staff who change bank details, and the integrators with remote access to the building.
- Money in motion
Rent, deposits, closings and vendor payments. Recovery of a wire depends on how fast the bank and law enforcement are told.
12,368real estate fraud complaints and about $275 million in reported losses in the FBI IC3 annual report (US figures) - The building itself
Heating and cooling, lifts, access control, CCTV and metering, often on old controllers with remote vendor access.
- Split responsibility
Owner, manager, integrator and tenant each hold part of the estate. The gap forms where nobody owns the building system.
What the regulator expects
Property has few cyber rules. The ones that exist reach you by status.
The research found no universal cyber audit cycle for developers, brokers or property managers. Licensing and building rules are not cyber mandates unless a clause says so. Duties come from data law, government ownership, designation and contracts.
Government status brings DESC
DESC ISR applies to Dubai Government Entities. DESC IoT and ICS standards apply to in-scope government and semi-government smart-building operators. A large or advanced building is not designated for that reason.
Contracts carry the rest
Building management and smart-city suppliers meet security, access and incident terms by contract. The PDPL covers the personal data of tenants and buyers where it applies.
Rules and frameworks behind this page
- NIST SP 800-82 Revision 3Guide to operational technology security. Lists building automation and physical access control among the systems it covers.
- DESC standards and policiesISR for Dubai Government Entities, and the IoT and ICS standards for in-scope government and semi-government operators.
- UAE Personal Data Protection Law, Federal Decree-Law 45 of 2021Asks for suitable security measures and testing of their effectiveness (Art. 20), and an impact assessment for high-risk processing (Art. 21).
- UAE Critical Information Infrastructure Protection PolicyUAE IA applies only to entities designated under this policy.
Source: DLD and RERA licensing rules; DESC ISR, IoT and ICS standards; UAE PDPL; CIIP policy. This is analysis, not legal advice.
UAE rules, by who you are
Which UAE rule reaches a developer, a property manager or a smart-building operator
Property licensing is not a cyber rule. Duties come from data law, government ownership, designation and contracts. A large or advanced building is not designated for that reason.
Developers, brokers and property managers
Abu DhabiBinding lawAbu Dhabi real-estate licensing and property rules, with the PDPL where it applies.
Protect tenant, customer and employee data, transaction systems, payment portals and document stores. The public sources reviewed set no universal yearly cyber audit for every developer or broker.
Dubai developers, brokers and property managers
DubaiRegulator ruleDubai Land Department and RERA, with the property licensing rules and the PDPL where it applies.
The regulator governs real-estate activity, not cyber. Protect transaction and tenant data and the systems that hold it. DESC covers government entities and designated services, not every property company.
Smart-building and facilities operators
Abu DhabiRegulator ruleBuilding, fire and safety rules, with UAE IA and CIIP if designated, and contract requirements.
For connected BMS, HVAC, lifts, access control, CCTV and IoT, separate building OT from corporate IT. Control vendor remote access. Keep secure configurations and recovery plans. Statutory duties depend on the building code and designation.
Dubai government and semi-government smart-building operators
DubaiStandard or policyDESC ISR, DESC IoT and ICS standards where systems and entity are in scope, and CII designation where it applies.
Apply ISR to Dubai Government Entities and the IoT and ICS standards by scope. Identify BMS and IoT assets, manage vendor access and keep evidence for the controls that apply.
Private building management and smart-city suppliers
DubaiContract termContract requirements, the PDPL where it applies, and designation-specific rules.
Confirm whether the service is part of identified CII or a government contract. Do not infer designation because a building is large or advanced.
Property technology and tenant-platform providers
FederalBinding lawPDPL where it applies, contracts, and DESC CSP only if you provide government-facing cloud services.
Protect personal data and API links. Identify controller and processor roles and cloud suppliers. No blanket yearly penetration test applies to all proptech firms.
Personal data in the property sector
FederalBinding lawFederal Decree-Law No. 45 of 2021 (PDPL), subject to exclusions.
Use suitable technical and organisational safeguards and test them. Assess processing, access, backups and breach handling. Visitor logs and camera footage count as personal data.
Designated critical property or urban services
FederalRegulator ruleCIIP Policy and UAE Information Assurance standard, where designated.
UAE IA applies only to designated entities. Confirm your formal designation and service scope.
This is analysis, not legal advice. A sector’s presence on a critical-infrastructure list does not make every company in it critical. We state a test or audit frequency only where the binding rule, licence, designation or contract does. Confirm your licence, any designation and the current version of each rule with your counsel.
Beyond the UAE
If you also operate in the US, the UK, India or Australia
UAE rules come first for a UAE business. These are the main rules elsewhere that can reach you through customers, data or offices abroad. Check scope with your own counsel.
India
- CERT-In Directions under section 70B(6), 28 April 2022Service providers, intermediaries, data centers, body corporates and government bodies must report listed cyber incidents within 6 hours and keep ICT logs for a rolling 180 days within India.
- Digital Personal Data Protection Rules, 2025Notified in November 2025; most duties start 18 months later. Breach notice goes to the Board, with a detailed report within 72 hours. Relevant to tenant and buyer records held in India.
Australia
- Cyber Security (Security Standards for Smart Devices) Rules 2025In force 4 March 2026. Makers and suppliers of most smart devices for personal, domestic or household use must meet baseline security standards. Check resident-facing devices you supply or install.
- Privacy Act 1988: Notifiable Data Breaches schemeCovers organisations and agencies under the Privacy Act. Assess a suspected breach within 30 days. If it is likely to cause serious harm, tell the OAIC and the people affected.
What changes
What changes for a property owner or operator
The same security decision gets a different answer once a building, a tenant and a payment are in the picture.
Who to protect first
Domain and cloud administrators.
Finance staff who change bank details, leasing agents, and the integrators with remote access to building controllers.
What to patch first
Everything critical, on a monthly cycle.
Internet-facing platforms first. Old controllers stay in service for years, so segmentation and tight remote access protect them.
How to rank suppliers
By spend, or by the data they hold.
By what each vendor can touch: doors, lifts, climate, tenant data or payment authority. Tier by access, not by cost.
Who owns the risk
One accountable owner for each system.
Owner, manager, integrator and tenant share the estate. Name one accountable party per building system.
Verifying a payment
Check the invoice.
Call back on a number held on file before any change of bank details. Require two approvers above a set value.
First asks
What we are asked first
Find what the building connects to
Inventory controllers, access control, cameras and metering, and who can reach each one remotely.
Set the payment rule
Decide who may change bank details, which callback is required and who approves above a set value.
End shared credentials
List vendor accounts that are shared or still active after a contract ended, and close them.
Confirm your status
Check whether any of your operations are government-owned, in DESC scope or designated as critical.
First moves
Where we would start with a property owner or operator
Manage Cyber Risk & Exposure
Tier buildings by consequence and list every vendor with remote access to building systems.
- Cyber Risk Assessments
- Crown Jewel Identification
- Third-Party & Supply-Chain Risk
Protect What Matters
Separate building systems from corporate and tenant networks, and put remote access behind one controlled route.
- OT/ICS & IoT Security
- Security Architecture
- Identity & Access Security
Secure & Comply
Map which data law covers tenant and buyer data at each location, and turn it into owners and retention rules.
- Privacy & Data Protection Compliance
- Regulatory Compliance
Read next
What to read before you talk to us
Industry Brief Industry Brief: Real Estate Cyber Risk Priorities Five priorities for property, from building and access systems to tenant data. Cybrilliant Risk Management SME Article Third-Party Risk Beyond the Questionnaire Why a vendor questionnaire does not show what a supplier can reach. Cybrilliant Supply Chain Risk SME Article UAE Cybersecurity Regulatory Landscape: A Practical Executive View What applies in the UAE alongside the property rules. Cybrilliant GRC SME Article Identity-Aware Network Segmentation How to segment access so one compromise stays small. Cybrilliant Security Architecture SME
Sources and method. This page is analysis, not legal advice.
- NIST SP 800-82 Rev. 3, Guide to Operational Technology Security
- FBI Internet Crime Complaint Center, Internet Crime Report
- UAE Legislation portal
- Federal Decree-Law No. 45 of 2021 on Personal Data Protection
- UAE Critical Information Infrastructure Protection Policy
- UAE Information Assurance standard
- DESC Information Security Regulation and Standards
- DESC Critical Information Infrastructure identification
- DESC Cloud Service Provider / Data Centre / SOC security standards