The modern commercial building is no longer just brick and mortar. Increasingly, building systems can connect HVAC, lighting, access controls, elevators, energy management, and other functions through digital building technologies.
Those systems can improve efficiency, monitoring, and building operations. They can also introduce cybersecurity considerations that extend beyond a company's traditional IT environment.
For business leaders evaluating commercial real estate, the question is no longer only how a building operates. It's also how connected building systems could affect the people and operations occupying it.
What Cybersecurity Risks Can Exist in a Smart Building?
Cybersecurity in smart buildings focuses on protecting both physical infrastructure and sensitive data. Common risk areas include:
-
Building Automation and Control Systems: Building automation systems may control or monitor HVAC, lighting, fire systems, energy management, and other building operations. Because these systems interact with the physical environment, a cybersecurity event can potentially create operational consequences rather than remaining solely an information-security issue.
-
Physical Access and Security Systems: Digital access controls, badge readers, surveillance systems, and other connected security technologies can introduce additional systems and data that need to be appropriately secured.
-
Connections to Other Networks: The degree of connectivity between building systems, external services, cloud platforms, and other networks can affect the building's cybersecurity risk profile. Understanding those connections can be an important part of evaluating a digitally connected property.
-
Operational Continuity: Because building systems may control functions such as HVAC, lighting, access, and security, disruption to those systems can potentially affect normal building operations.
Why Should Commercial Real Estate Cybersecurity Matter to Occupiers?
For a company occupying a smart building, cybersecurity can intersect with issues that extend beyond the building owner's technology infrastructure.
Depending on the property and the systems involved, business leaders may want to understand how connected building technologies could affect:
- Physical access to the workplace
- Continuity of HVAC, lighting, elevators, and other building services
- Security and monitoring systems
- Connections between building technology and company-controlled systems
- Responsibility for responding to incidents affecting building operations
The relevance will vary by property. A highly connected headquarters, manufacturing facility, healthcare environment, or other technology-dependent operation may present different considerations than a less digitally integrated space.
What Should Business Leaders Ask When Evaluating a Smart Building?
Business leaders don't need to become cybersecurity specialists to ask better commercial real estate questions.
When evaluating a technology-enabled building, questions may include:
- Which building systems are digitally connected?
- Which systems control critical functions such as HVAC, access, elevators, or security?
- Are building systems connected to external networks or cloud services?
- Will any building technology connect with the tenant's own systems?
- Who manages and maintains the building's connected systems?
- How are cybersecurity responsibilities divided among the owner, property manager, vendors, and occupants?
- What happens operationally if a critical building system becomes unavailable?
The answers may warrant further review by the company's IT, cybersecurity, legal, risk, or insurance professionals depending on the property and the organization's requirements.
Is Smart-Building Cybersecurity a Shared Responsibility?
Smart-building cybersecurity can involve multiple stakeholders, including building owners, property managers, technology vendors, service providers, and occupants.
Their responsibilities will not necessarily be the same. A tenant may control its corporate network and internal technology while relying on other parties to operate building automation, access, or other property-level systems.
Understanding where those responsibilities intersect can be as important as understanding the technology itself.
Should Cybersecurity Be Part of Commercial Real Estate Due Diligence?
Cybersecurity does not replace traditional commercial real estate due diligence. It adds another consideration when the property itself relies on connected technology.
Location, economics, building condition, access, infrastructure, and lease terms still matter. But as building operations become more digitally connected, companies may also need to understand whether those systems align with their operational, technology, and risk requirements.
The more dependent a business is on the building's technology, the more important it becomes to understand that technology before committing to the space.
Citations
-
Cybersecurity & Infrastructure Security Agency (CISA) – Smart Building Security Guidance
-
Arizona Department of Real Estate – Market Resources
Disclaimer
This content was prepared by the Keyser editorial team. It is provided for educational purposes only and should not be construed as legal or financial advice.
Frequently Asked Questions About Smart-Building Cybersecurity
What Is a Smart Building in Commercial Real Estate?
A smart building uses connected digital technologies to monitor, manage, or automate building functions such as HVAC, lighting, access control, energy management, security, and other systems.
What Cybersecurity Risks Can Smart Buildings Create?
Cybersecurity risks can involve building automation systems, access controls, connected devices, network connections, cloud services, and other technologies supporting building operations. The specific risks depend on the systems used and how they are configured and connected.
Can a Cyberattack Affect Building Operations?
Potentially. Because connected building systems may control physical functions such as HVAC, lighting, access, and security, a cybersecurity incident affecting those systems could also affect building operations.
What Should a Company Ask Before Leasing Space in a Smart Building?
Business leaders may want to understand which building systems are connected, who manages them, whether they interact with tenant-controlled systems, how responsibilities are divided, and what operational dependencies those technologies create.
Should Cybersecurity Be Part of Commercial Real Estate Due Diligence?
Cybersecurity may be a relevant due diligence consideration when a property relies on connected systems that could affect the company's operations, access, security, or technology environment. The appropriate level of review depends on the property and the organization's requirements.
