As cyber threats continue to evolve and escalate across all sectors, the commercial real estate industry finds itself increasingly vulnerable to attacks.  

The commercial real estate industry has become an attractive target for cybercriminals due to the high-value transactions and vast amounts of sensitive data that the industry handles. This ranges from financial information to personal data of tenants and buyers to proprietary building plans. IoT devices and smart buildings are adding to the problem, as they often lack strong security measures to block backdoor access to larger networks. 

A recent study from AON on top risks facing construction and real estate organizations ranks cyberattacks as a top three risk. Despite this critical concern, the study reveals that only 9 percent of construction and real estate industry respondents had quantified their cyber exposure. This stark reality underscores a significant gap in cybersecurity preparedness within the industry. 

The importance of cybersecurity governance for commercial real estate 

Establishing robust cybersecurity governance is no longer optional for the real estate industry — it’s imperative.  

With a comprehensive process in place, a real estate organization is better prepared to: 

• Protect sensitive client and property data 
• Safeguard financial transactions and prevent fraud 
• Maintain the integrity of smart building systems and IoT devices 
• Comply with data protection regulations 
• Preserve brand reputation and client trust  

The board and management should understand the cybersecurity program, be involved in decisions and actively participate in risk acceptance, mitigation or transfer. While a rigorous governance process helps organizations mitigate risks, address threats and meet regulatory compliance responsibilities, many boards lack sufficient cybersecurity training. Nearly 60% of respondents in a joint Corporate Governance Institute and Board Intelligence survey stated they haven’t received adequate cyber resilience training in the past year. 

The three pillars of cybersecurity governance for commercial real estate 

To establish effective cybersecurity governance, real estate organizations should focus on three fundamental questions: 

1. What are you doing?

   Real estate organizations should fully understand their current cybersecurity program and governance model. This involves:

• Understanding what client and property data is being collected and how (e.g., tenant information, property valuations and transaction details) 
• Ensuring you only store the minimum amount of data necessary for your operations  
• Understanding regulatory compliance obligations, especially across multiple states [e.g., General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), or sector-specific regulations] 

2. Is it enough?

   Your cybersecurity plan should involve a continuous process of risk evaluation specific to real estate operations. If you determine that your residual risk is too high, it may be time to make additional investments in security controls or transfer risk through cybersecurity insurance. Consider: 

• Do you understand the specific cyber risks unique to your real estate transactions and operations? 
• Are you meeting all relevant compliance requirements for handling sensitive property and financial data? 
• Do you have controls in place to ensure only authorized personnel can access sensitive property and client data?  
• Have you implemented robust security measures for your property management systems, smart building technologies and IoT devices? 
• Do you have comprehensive backup, recovery and business continuity plans in place for your critical property management systems? 

3. How do you know?

   Knowing you’re prepared involves having the right monitoring processes and understanding how you would detect and react to various cybersecurity events. Ask yourself: 

• Do you have appropriate monitoring systems to detect cyber breaches across your network, including remote properties and IoT devices? 
• Has a third-party validated that your cybersecurity controls function as intended to detect breaches? 
• If an attack succeeds, do you have incident response plans and recovery processes in place to minimize damage and restore your real estate operations quickly? 

BPM’s Cybersecurity Assessment Services 

As an organization operating in a highly targeted industry, you face not only monetary risk from a security breach itself but also the potential damage to your brand integrity. Cyber threats targeting the commercial real estate sector are growing in sophistication and frequency.  

By prioritizing cybersecurity governance and implementing robust security measures, real estate organizations can better protect their valuable data, maintain client trust and safeguard their operations in an increasingly interconnected world. 

Cybersecurity attacks aimed at real estate companies are predicted to continue to grow in 2024 and beyond. We can help. 

BPM offers Cybersecurity Assessment Services, including Penetration Testing and Incident Assessment Support. Our independent team evaluates your organization and works to identify your information security weaknesses to help you understand where cyber threat actors are most likely to strike. Then, we will help you build a methodology to manage cybersecurity risk. We’ll develop risk-prioritized recommendations and controls that help you respond to and monitor an attack should the worst occur. 

Don’t wait for a breach to happen — start building your cybersecurity governance plan today. Contact us today to get started.