Industry Brief: Real Estate Cyber Risk Priorities

Why real estate is hard to rank

A property portfolio runs two technology estates. The first is conventional: email, finance, leasing, CRM, HR. The second is the building itself: heating and cooling controllers, lifts, lighting, metering, CCTV, parking, and the access control that decides who can enter.

NIST’s guide to operational technology security (SP 800-82 Rev. 3) lists building automation systems and physical access control systems among the operational technology it covers. These are programmable systems that monitor or control physical processes. When they fail, the result is felt as an operational event, not a data event.

CISA places real estate, which it describes as office and apartment buildings, condominiums and self-storage, in its Commercial Facilities Sector alongside entertainment and media and lodging. What the sector has in common is public access and mostly private ownership. Responsibility for any one building tends to be split, and the split is where gaps form.

PARTY	TYPICALLY HOLDS	WHERE THE GAP FORMS
Owner or landlord	The asset, the tenant contracts and the financial exposure	Often cannot see what the operator has connected to the building
Property manager	Daily operations, rent collection, tenant onboarding and vendor access	Can run several owners’ buildings from shared platforms and shared accounts
Integrator or facility vendor	The installed controllers and their maintenance, usually through remote access	Remote access can outlive the project, sometimes on shared credentials
Tenant	Its own IT inside the space, sometimes on infrastructure the landlord provides	Inherits the building’s network and access decisions without a say in them

That table describes a common pattern in multi-party property operations. It is not a finding about any one portfolio.

NIST CSF 2.0 added a Govern function for questions of exactly this kind: who decides, who is accountable, and how supply-chain risk fits into the overall risk strategy. In property settings the unanswered question is usually “who is accountable for this building system?” rather than “which tool should we buy?”

The priority order

The ranking weighs consequence first, then exposure, then how much of the control environment can realistically change within a planning cycle. It is a judgment, not a measurement. A portfolio with a large residential population or a data-heavy tenant base can reorder items three to five.

RANK	PRIORITY	WHY IT RANKS HERE	DECISION IT FORCES
1	Building and access systems	Consequences are physical and contractual: tenants locked out, climate or lift service lost	Tier buildings by consequence; set a remote-access and segmentation standard for each tier
2	Payment and transaction integrity	Fraud against rent, deposits, closings and vendor payments is routine, and recovery depends on speed	Decide who can change bank details and what verification is mandatory
3	Vendor and managed-service access	Vendors hold the keys to items one and two	Inventory remote-access paths; end shared credentials; set contract terms by tier
4	Tenant and customer data	Identity documents, financial references, access logs and occupancy patterns sit in one place	Decide what to collect, how long to keep it and who is accountable
5	Property platforms and tenant apps	Leasing portals, resident apps and smart-access platforms face the internet by design	Set procurement security requirements; review identity and API exposure

1. Building and access systems

Many older building-automation protocols were designed for isolated networks and carry no built-in authentication. Controllers are installed under maintenance contracts and stay in service far longer than office IT, so patching on a normal IT cycle is rarely realistic. Compensating controls matter more than patches: segmentation between building systems and corporate or tenant networks, a managed route for remote access with multi-factor authentication and session logging, and an inventory that says what is installed in which building.

NIST SP 800-82 Rev. 3 includes an operational technology overlay with baselines for low-, moderate- and high-impact systems. The useful idea for a portfolio is the tiering. A building that houses a data center, a hospital tenant or a trading floor does not need the same baseline as a self-storage site. Decide the tiers once, assign each building to one, and fund controls to match.

Hypothetical scenario. A building-automation vendor uses one remote-access credential across many client sites. An attacker takes it from an infected laptop and reaches the controllers at every site the vendor serves. The owners of those buildings learn about it late, because they never appeared in the vendor’s asset list and the vendor never appeared in theirs.

2. Payment and transaction integrity

The FBI’s Internet Crime Complaint Center recorded 12,368 real estate fraud complaints and about $275 million in reported losses in its latest annual report. The category covers fraud involving real estate investment, rental or timeshare property. Payment diversion inside a transaction can also be reported as business email compromise, which totaled about $3.05 billion across 24,768 complaints, all sectors combined. These figures count what victims reported. They do not measure how often the fraud occurs.

One case in the previous year’s report (FBI Denver, March 2024) shows the pattern. Victims received a spoofed email from people they believed were their agents and were asked to wire $956,342. The FBI’s Recovery Asset Team stopped the transfer of $955,060, and the money was returned. Recovery of this kind generally depends on how quickly the bank and law enforcement are told.

The decisions here are procedural and sit with finance and operations as much as with security. No change to bank details on the strength of an email alone. A callback to a number held independently on file. Two approvers above a set value. And a named person, with an out-of-hours bank contact route, for the moment someone realizes a wire was wrong.

3. Vendor and managed-service access

A portfolio buys from many small vendors: facility management, guarding, lift maintenance, building-automation integrators, parking operators, tenant-app providers, leasing and brokerage platforms. Each holds some mix of physical access, network access, tenant data and payment authority. Treating them as one category produces a questionnaire process that is thorough on paper and blind to the access paths that matter.

Tier vendors by what they can touch, not by what they cost. Then check the paths directly: which remote-access routes exist, whose credentials they use, and which still work for vendors whose contracts have ended. A completed questionnaire records what a vendor says. An access inventory records what it can do.

Contract terms should follow the tiers: multi-factor authentication for remote access, incident notification within a defined window, and the right to retrieve or delete tenant data on exit.

4. Tenant and customer data

Real estate operators hold an unusual combination: identity documents and financial references collected at leasing, signed lease terms, payment details, visitor and access logs, and camera footage. Access logs and occupancy patterns also show when premises are empty, which gives them value beyond what the data appears to say.

The decisions concern volume and accountability. Decide what leasing and onboarding really need to collect and how long to keep it. Decide which party is accountable for each data set when the owner, the manager and a platform vendor all touch it. Privacy obligations differ by jurisdiction, so confirm with counsel which law applies at each location instead of assuming one standard across the portfolio.

5. Property platforms and tenant apps

Leasing portals, resident apps, smart-lock systems and visitor-management platforms are internet-facing by design, and most are bought, not built. Four questions cover much of the exposure. Does the platform support single sign-on and multi-factor authentication for staff? Does it separate one tenant’s or building’s data from another’s? What can its API expose to a logged-in user? What happens to the data and the integrations if the vendor is breached or sold? Put these questions into procurement, so they are answered before contracts are signed.

What to rank lower

Scanning and patching every building controller before an inventory exists. You cannot prioritize what you cannot list.
Tenant awareness campaigns ahead of payment verification rules. Training does not replace a callback rule.
A single “smart building” security product bought to cover everything above. Segmentation, access routes and accountability are management decisions that no product settles.

Resilience decisions to make before an incident

Which buildings must keep operating with building systems in manual mode, and who can authorize it?
Who can take building systems offline, and how are tenants told?
What service levels do leases promise, and which outages would breach them?
How long can rent collection and tenant onboarding be down before cash flow or occupancy is affected?
Which vendors must reach systems during recovery, and how is that access verified?

Questions for the next leadership review

Do we have a list of buildings by consequence tier, with one named owner for each building’s operational technology?
Which vendors have remote access to building systems today, and which of those contracts have ended?
Who can change bank details, and what verification applies?
Which tenant data do we hold that we no longer need?
If building systems at our highest-tier site were unavailable for a week, what would we do on the first day?

Sources

NIST. Guide to Operational Technology (OT) Security, SP 800-82 Rev. 3.
NIST. Cybersecurity Framework (CSF) 2.0.
CISA. Commercial Facilities Sector.
FBI Internet Crime Complaint Center (IC3). Internet Crime Report (annual). Complaint counts and reported losses; real estate fraud and business email compromise categories.