The modern commercial building is no longer just brick and mortar. Increasingly, building systems can connect HVAC, lighting, access controls, elevators, energy management, and other functions through digital building technologies.
Those systems can improve efficiency, monitoring, and building operations. They can also introduce cybersecurity considerations that extend beyond a company's traditional IT environment.
For business leaders evaluating commercial real estate, the question is no longer only how a building operates. It's also how connected building systems could affect the people and operations occupying it.
Cybersecurity in smart buildings focuses on protecting both physical infrastructure and sensitive data. Common risk areas include:
Building Automation and Control Systems: Building automation systems may control or monitor HVAC, lighting, fire systems, energy management, and other building operations. Because these systems interact with the physical environment, a cybersecurity event can potentially create operational consequences rather than remaining solely an information-security issue.
Physical Access and Security Systems: Digital access controls, badge readers, surveillance systems, and other connected security technologies can introduce additional systems and data that need to be appropriately secured.
Connections to Other Networks: The degree of connectivity between building systems, external services, cloud platforms, and other networks can affect the building's cybersecurity risk profile. Understanding those connections can be an important part of evaluating a digitally connected property.
Operational Continuity: Because building systems may control functions such as HVAC, lighting, access, and security, disruption to those systems can potentially affect normal building operations.
For a company occupying a smart building, cybersecurity can intersect with issues that extend beyond the building owner's technology infrastructure.
Depending on the property and the systems involved, business leaders may want to understand how connected building technologies could affect:
The relevance will vary by property. A highly connected headquarters, manufacturing facility, healthcare environment, or other technology-dependent operation may present different considerations than a less digitally integrated space.
Business leaders don't need to become cybersecurity specialists to ask better commercial real estate questions.
When evaluating a technology-enabled building, questions may include:
The answers may warrant further review by the company's IT, cybersecurity, legal, risk, or insurance professionals depending on the property and the organization's requirements.
Smart-building cybersecurity can involve multiple stakeholders, including building owners, property managers, technology vendors, service providers, and occupants.
Their responsibilities will not necessarily be the same. A tenant may control its corporate network and internal technology while relying on other parties to operate building automation, access, or other property-level systems.
Understanding where those responsibilities intersect can be as important as understanding the technology itself.
Cybersecurity does not replace traditional commercial real estate due diligence. It adds another consideration when the property itself relies on connected technology.
Location, economics, building condition, access, infrastructure, and lease terms still matter. But as building operations become more digitally connected, companies may also need to understand whether those systems align with their operational, technology, and risk requirements.
The more dependent a business is on the building's technology, the more important it becomes to understand that technology before committing to the space.
Cybersecurity & Infrastructure Security Agency (CISA) – Smart Building Security Guidance
Arizona Department of Real Estate – Market Resources
This content was prepared by the Keyser editorial team. It is provided for educational purposes only and should not be construed as legal or financial advice.
A smart building uses connected digital technologies to monitor, manage, or automate building functions such as HVAC, lighting, access control, energy management, security, and other systems.
Cybersecurity risks can involve building automation systems, access controls, connected devices, network connections, cloud services, and other technologies supporting building operations. The specific risks depend on the systems used and how they are configured and connected.
Potentially. Because connected building systems may control physical functions such as HVAC, lighting, access, and security, a cybersecurity incident affecting those systems could also affect building operations.
Business leaders may want to understand which building systems are connected, who manages them, whether they interact with tenant-controlled systems, how responsibilities are divided, and what operational dependencies those technologies create.
Cybersecurity may be a relevant due diligence consideration when a property relies on connected systems that could affect the company's operations, access, security, or technology environment. The appropriate level of review depends on the property and the organization's requirements.