BOMA New York: Data integrity and cybersecurity in CRE - by Sharon Hart

In commercial real estate, data is the foundation upon which our industry operates. From measurement standards that ensure accurate calculations to operational data that drives building performance, from tenant information that enables exceptional service delivery to benchmarking data that informs strategic decision-making, the integrity and security of our data infrastructure has never been more critical. 

However, data integrity extends beyond standardized measurements. It encompasses the accuracy and reliability of all information flowing through our buildings and operations. As our properties become increasingly connected through smart building technologies, maintaining data integrity becomes both more essential and more challenging. All the technology in smart buildings creates new vulnerabilities, making cybersecurity an important business priority for commercial real estate firms. 

Cybersecurity threats facing our industry are substantial and evolving rapidly. According to the FBI’s 2023 Internet Crime Complaint Center (IC3) report, business email compromises accounted for almost $3 billion in losses across all industry sectors. Within real estate, nexus losses reached $446.1 million in 2022 – seven times higher than all ransomware losses across all industries in 2023. These attacks typically involve threat actors intercepting communications and inserting fraudulent payment instructions, routing transactions to accounts they control. Given the high-value financial transactions common in commercial real estate, our industry remains a prime target. 

The risks extend well beyond financial fraud. The intricate network of players in the commercial real estate ecosystem, including contractors, subcontractors, service providers, and others, creates vulnerability to cybercrime. Commercial properties store vast amounts of sensitive information: tenant financial data, lease agreements, personal information, and proprietary business intelligence. A single data breach can result in stolen intellectual property, ransom demands, regulatory penalties, and lasting reputational damage that undermines tenants’ trust and competitive positioning. 

Smart building systems introduce additional complexity. An ever-expanding number of devices now support real estate operations, creating challenges in securing systems and understanding what data is being sent. From HVAC controls to access systems to energy management platforms, each connected device represents a potential entry point for cyber threats if not properly secured. 

Protecting our industry requires a comprehensive, proactive approach. Organizations should maintain complete asset inventories of all building systems and connected devices, implement multi-factor authentication and encryption for sensitive data, establish incident response plans, and conduct regular security audits. Employee training is crucial to help staff identify phishing attempts and social engineering tactics. Additionally, organizations must carefully vet third-party vendors and service providers who have access to building systems or tenant data, ensuring their cybersecurity practices meet industry standards. 

BOMA New York is committed to providing our members with the resources and knowledge needed to address these challenges. Through educational programming, best practice sharing, and industry collaboration, we can strengthen our collective defense against cyber threats while maintaining the data integrity that enables our industry to function effectively. By prioritizing both standardized data provision and robust cybersecurity practices, we protect not just individual properties but the broader business community that depends on the reliability and security of New York’s commercial real estate infrastructure. 

The stakes are clear: in an industry built on trust, data integrity and cybersecurity are not optional – they are foundational to our continued success. 

Sharon Hart, RPA, CPM, LEED AP, is chair of BOMA New York.