INDUSTRY FACT FILE · REAL ESTATE, CONSTRUCTION & FACILITIES

Cybersecurity FAQs for Real Estate, Construction and Facilities

Forty frequently asked questions and answers in five categories, written for Boards, CISOs, project and site heads, property and facility managers, security heads, sales and finance teams.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: Regulation, standards and occupier requirements 3.  Category 3: Buildings, cameras, doors and vendors 4.  Category 4: SOC, incidents and ransomware resilience 5.  Category 5: Payments, portals, data and privacy

Audience: Boards, MDs, CFOs and CISOs

Q1. Why are property and construction companies cyber targets?

Because they move large payments to many counterparties, hold buyers' KYC and bank details, run buildings on exposed control systems and cannot pause launches, billing or tenant services—attracting ransomware groups, fraudsters and opportunists alike.

Q2. Which incidents should the Board know about?

The 2021 Verkada breach reached about 150,000 camera feeds; Target's 2013 breach began with an HVAC contractor; Bouygues Construction and ISS World shut down IT after 2020 ransomware and malware attacks; Ansal Housing disclosed repeated ransomware attacks in 2021; and the FBI reported US$2.77 billion in BEC losses in 2024.

Q3. What are the biggest risks for an Indian property company?

Ransomware hitting ERP and CRM at launch, payment diversion on contractor bills, building systems and cameras reachable from outside, theft of buyer and tenant data under DPDP, and slow detection that misses CERT-In's six-hour window.

Q4. Is this an IT problem or a building problem?

Both. Buildings run on IP networks maintained by vendors, and the business runs on ERP, CRM and portals. Security must be owned jointly by IT, projects, property management and security, with the Board accountable.

Q5. What should the Board review each quarter?

Building system and vendor access risks, payment fraud controls and simulation results, backup test results, buyer and tenant data exposure, incidents and near misses, audit findings, SOC coverage and exercise outcomes.

Q6. Who should own building system security?

The CISO or CIO jointly with property and facility management and the security head, with a single inventory of building, security and tenant-facing systems per asset.

Q7. How should we prioritise investment?

Verify payments and credentials, separate building systems from IT and tenants, control vendor access, make ERP and CRM recoverable, protect buyer and tenant data and build monitoring that covers buildings—in that order.

Q8. How can Codec Networks help?

Codec Networks provides building system and IoT assessments, CCTV and access control testing, segmentation and vendor access design, ERP, portal and app testing, payment fraud defence, DPDP programmes, a 24x7 building SOC and crisis exercises.

Audience: Compliance, company secretarial, leasing and CISO offices

Q9. Do CERT-In Directions apply to property companies?

Yes. They apply to bodies corporate generally. Cyber incidents must be reported within six hours of noticing them and ICT logs retained for 180 days in India.

Q10. What do CERT-In's 2025 audit guidelines expect?

Risk-based, independent cyber audits covering IT, OT, cloud and applications, with closure of findings—so building management and security systems belong in the audit scope.

Q11. Does RERA create cybersecurity obligations?

Not directly, but RERA's registration, escrow, disclosure and timeline duties depend on accurate project, collection and buyer records—so the integrity and availability of ERP and CRM is a regulatory matter for promoters.

Q12. What must listed companies and REITs disclose?

Under SEBI's LODR Regulations, listed entities disclose cyber security incidents, breaches and loss of data in the quarterly corporate governance report; REITs follow SEBI's REIT Regulations for governance and unit-holder reporting.

Q13. Does DPDP apply to CCTV footage and visitor logs?

Yes. Footage and visitor records that identify individuals are personal data; notices, retention limits, access controls and breach intimation apply, with most obligations under the DPDP Rules from May 2027.

Q14. What are MeitY's CCTV essential requirements?

Security requirements for CCTV cameras under the Compulsory Registration Order, tested by STQC, in effect from 9 April 2025. Developers, FM companies and integrators specifying cameras should confirm compliance of what they buy and install.

Q15. Which standards should we align to?

ISO/IEC 27001 for the management system and IEC 62443 for building automation and security systems; together they answer most occupier, lender and insurer questionnaires.

Q16. Can Codec Networks audit us?

Yes. Codec Networks is CERT-In empanelled and performs IT and building OT audits, ISO 27001 and IEC 62443 gap assessments and occupier questionnaire support.

Audience: Property managers, facility managers, security heads and engineering teams

Q17. How should building systems be separated from IT and tenants?

Use a zone-and-conduit model: building, security, corporate and tenant networks on separate VLANs or switches, controlled flows through a firewall, no dual-homed workstations and no building controllers on tenant Wi-Fi.

Q18. How do we assess a building without disrupting tenants?

Passive asset discovery, configuration and architecture reviews, and any active testing planned outside peak occupancy with FM and vendor teams—never unplanned scanning of lift or fire controllers.

Q19. How should vendor remote access work?

Through a brokered gateway with MFA, named accounts, approval per session, time limits and recording—never standing VPNs or TeamViewer with shared passwords.

Q20. What should we check at handover of a new building?

That default credentials are changed, remote access is documented and brokered, networks are segmented, firmware is current, cameras meet MeitY requirements and system documentation and backups exist.

Q21. How do we secure cloud CCTV and access platforms?

Named accounts with MFA and rotation, least privilege per site, audit logging, API key control, retention aligned to DPDP, vendor security assessment and regular penetration testing.

Q22. What about controllers that cannot be patched?

Segment them, restrict access, remove internet paths, monitor traffic and plan upgrades with the OEM; compensating controls are expected where patching is impossible.

Q23. How should co-working networks be designed?

Isolate each member or company, use network access control, keep access control and printers off member networks, protect the operator's own systems and monitor for scanning and malware.

Q24. How do IoT sensors and smart meters change risk?

They add internet-facing gateways; assess devices before go-live, isolate them in their own zone, change default credentials, manage firmware and monitor continuously.

Audience: SOC, IT infrastructure, incident response and property teams

Q25. Do property companies need a building SOC?

Yes, if buildings and platforms matter to revenue and tenant safety. Monitoring IT alone misses building systems, vendor sessions and security platforms.

Q26. What should the SOC monitor in a building?

Building and security network traffic, BMS and access control configuration changes, vendor remote sessions, VMS and cloud platform logins, IoT gateways and the IT systems the building depends on.

Q27. Why map the building's dependencies on IT?

To know which services—doors, lifts, parking, visitor check-in, helpdesk—stop when identity, network or cloud services fail, and to design workarounds before an incident.

Q28. What should an incident playbook include?

Tenant safety and manual operation of doors and lifts, containment, decisions on isolating vendors, CERT-In reporting within six hours, occupier and insurer notification, SEBI disclosure if listed, and communication.

Q29. How should backups be designed?

Immutable or offline backups of ERP, CRM, document systems, BMS and access control configurations and VMS settings, with regular restore tests and documented restart sequences.

Q30. Should we run exercises?

Yes—annual tabletop exercises with leadership, FM and security teams using ransomware-at-launch, building-outage and payment-fraud scenarios, plus technical restore drills.

Q31. How quickly can a developer recover from ransomware?

With segmented networks, tested backups and manual booking and billing playbooks, days; without them, weeks—as public cases show.

Q32. When should forensics be engaged?

As soon as compromise or fraud is suspected, to preserve evidence, establish root cause and support reporting, insurance claims and police complaints.

Audience: Finance, sales, IT, legal and privacy teams

Q33. How do we stop payment diversion fraud?

Verify every bank-detail change by call-back to a known number, require dual approval, monitor vendor master-data changes, enforce MFA on email and train finance and site teams with BEC simulations.

Q34. How should ERP and CRM be secured?

Harden configuration and roles, enforce MFA, control master-data and receipt changes, segment from building networks, back up immutably and monitor for anomalies.

Q35. How do we secure booking portals and tenant apps?

Test web, mobile and APIs before launch and after major changes, protect payment integrations, enforce strong authentication, limit data exposure and build security into the development lifecycle.

Q36. How do we protect buyer data shared with brokers?

Share the minimum needed, through controlled channels, under contract terms covering security and deletion, with monitoring of exports and periodic partner reviews.

Q37. How does DPDP affect a developer or landlord?

You hold personal data of buyers, tenants, residents, visitors and employees; DPDP requires notices, safeguards, retention limits and breach intimation—build the programme before May 2027.

Q38. How long should CCTV footage be kept?

Only as long as a documented purpose requires, with notices at entrances, restricted access, logging of exports and retention aligned to your DPDP programme and any regulatory or contractual requirement.

Q39. Our GCC tenant sent a security questionnaire—what now?

Treat it as an audit: map questions to ISO 27001 and IEC 62443 controls, close gaps in building and FM systems and build an evidence pack you can reuse for every occupier.

Q40. How can we start with Codec Networks?

Begin with a scoping call on your projects, buildings, platforms and vendors; Codec Networks will propose a building-aware assessment and assurance plan.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal or regulatory advice. Confirm obligations against the official instruments and your occupier and lender contracts.