Why Cyber Risk Now Belongs on the CRE Due Diligence Checklist
We both know how a CRE transaction comes together. Phase I environmental. Title and survey. Lease audits. Rent roll verification. Tenant credit review. Thirty to sixty days of coordinated diligence before anyone signs anything that can’t be unsigned.
There’s a workstream quietly joining that list, and many CFOs on the buy side and sell side haven’t built it into their process yet: cybersecurity due diligence on the property’s digital and building systems.
This isn’t a hypothetical add-on. It’s showing up as a named line item in some CRE diligence frameworks alongside financial, legal, and ESG review, and some buyers, lenders, and their counsel are starting to ask about it whether or not a seller is prepared to answer.
So you want to be prepared for it.
What Is a Cyber Encumbrance in Commercial Real Estate?
ProtectMyIT coined the term Cyber Encumbrance for a weakness in a building’s digital or building systems that could affect a deal: an unpatched server, an orphaned vendor credential, an unsecured building system. The word is borrowed from real estate as a commercial comparison only. It is not a legal encumbrance, and nothing is recorded against the title. The parallel is practical: before closing, a buyer wants to know what comes with the building, and these weaknesses come with it, whether or not anyone has looked for them yet.
What Buyers Are Actually Inheriting
When you acquire a property – or a portfolio – you’re not just acquiring the building and the leases. You’re acquiring everything connected to it: the property management platform, the access control and badge systems, the building management system running HVAC and elevators, the leasing portal tenants log into, and whatever vendor remote-access credentials came with the last owner’s IT setup – all representing a category of inherited risk that many diligence checklists weren’t designed to surface.
Two well-known deals show how a cyber issue can surface around an acquisition. Both are corporate transactions, not real estate ones, so they don’t tell us what to expect for a building. They do show that these issues can affect a deal.
When Yahoo disclosed prior breaches while being acquired by Verizon, the purchase price was renegotiated down by roughly 7%.
Marriott’s case was different. It acquired Starwood in 2016 and found out in 2018 that Starwood’s reservation system had been compromised since 2014. The UK’s data protection regulator later fined Marriott about $24 million, citing inadequate monitoring and encryption of the systems it took on. That was a penalty, not a price adjustment, but it shows what can follow when a system comes with a deal and nobody has looked at it closely.
Where This Stands Today
Let me be straight with you: we’d call this need emerging, not established. Some lenders are putting more weight on cybersecurity in loan origination and refinancing, and cyber insurers are underwriting more selectively, looking for evidence that owners and managers keep core controls over their systems and anything connected to them. We haven’t yet seen wide adoption of any standard for acquisitions.
For a buyer, that cuts both ways. Nobody is likely to hand you a checklist, so the questions are yours to ask. It also means a few well-placed questions can tell you a lot about what you’re taking on.
What “Inheriting the System” Actually Looks Like
It’s easy to nod along at “you’re acquiring digital risk” in the abstract and still not feel it. So here’s what a cyber encumbrance actually looks like in specifics – the kind of thing a diligence review is designed to catch before you own it instead of after:
Unpatched Badge and Access Control Systems
Access control panels are often installed once, connected to the network, and then left alone for the life of the building – because they work, and “if it ain’t broke” is the default posture for building infrastructure. That also means the server running it may be sitting on an operating system that stopped receiving security patches years ago, reachable from the same network as everything else in the building. An attacker doesn’t need to be sophisticated to find an unpatched, internet-facing system; automated scanning tools do that work for them.
HVAC and Building Automation Systems With Weak Access Controls
Building management systems are frequently installed by a mechanical contractor, not an IT team, and secured accordingly – sometimes with a default password never changed, sometimes reachable from the open internet because a vendor wanted remote access for maintenance.
When that system isn’t segmented from anything else, “who can adjust the thermostat” and “who can access tenant financial data” can end up being the same answer. That unsegmented exposure is oneof the quieter building management system boundary risks a buyer can inherit.
Vendor Remote Access: The Open Door Attackers Use
This isn’t hypothetical industry lore – it’s precedent. The Target breach, one of the most-cited retail cyber incidents on record, originated through credentials stolen from an HVAC vendor with remote access into Target’s network. A CRE property with elevator, HVAC, and security vendors all holding standing remote-access credentials has the same structural exposure: the attacker doesn’t need to breach the building owner directly if a vendor with a weaker security posture already has a key.
Operational Disruption: When Building Systems Become a Liability
A data breach is the exposure everyone thinks of first. A building-systems compromise is a different kind of problem: locked or malfunctioning access-controlled doors, elevators taken offline, or HVAC forced outside safe operating ranges – a habitability and life-safety issue, not just an IT ticket.
That’s tenant relations, potential liability, and in extreme cases a building temporarily unusable, all from a system many owners have never asked anyone to test.
This is precisely the territory ProtectMyIT’s BMS Boundary Assessment is built to find and fix – not just at the moment of a transaction, but as an ongoing practice for buildings you already hold. If any of the above is unfamiliar, that’s worth knowing on its own, independent of whether you’re transacting this year.
None of this requires an exotic attacker. It requires an old server nobody inventoried, a vendor credential nobody revoked, or a default password nobody changed. None of it shows up on a rent roll, and some buyers’ diligence teams are starting to ask about it anyway.
The Financing Side Has the Same Exposure, on a Different Clock
It isn’t only acquisitions.
Refinancing and disposition carry the same dynamic on a compressed timeline. A lender doing diligence before a loan closes, or a buyer’s counsel reviewing a disposition package, may ask about data handling, system access controls, and incident history alongside the DSCR and occupancy numbers that usually drive the conversation.
It’s easier to hand over a clean, documented answer than to scramble for one after the question is asked.
How Buyers Use a Cyber Encumbrance Assessment Before Closing
Buyers who handle this well don’t wait to find out what they’ve inherited. They ask for a review of the property’s digital and building systems during diligence, or commission one themselves, the same way they’d order their own Phase I environmental report rather than rely on the seller’s. A Cyber Encumbrance Assessment is that review.
The Cyber Encumbrance Report that comes out of it gives a clear accounting of what’s connected to the property digitally. It sits in the closing binder next to the title report and the environmental survey, instead of surfacing as a surprise after closing.
That means, before the deal clock runs out:
- Knowing what’s actually connected to the property’s network – building systems, vendor access points, leasing and property management platforms – and who can reach them
- Asking the seller for
- documented evidence of basic controls
- (access management, monitoring, incident history)
- Understanding what the review is likely to surface, so it can be fixed or priced in before it becomes a renegotiation
None of this requires a permanent security retainer.
The Failure That Takes the Insurance Payout With It
Here’s the part that turns a bad incident into a catastrophic one: the same unpatched badge server or unsecured HVAC system that makes an attack possible can also be the exact thing an owner attested was under control on their cyber insurance application.
Underwriting has been moving from taking that attestation at face value to expecting dated, verifiable evidence behind it – tested backups, enforced controls, documented patching. When a claim reveals the gap between what was attested and what was actually in place, insurers aren’t just entitled to deny the specific claim; they can rescind the policy altogether.
Compliance Creep: When Attested Controls Go Silently Stale
This is the exact gap ProtectMyIT coined a term for: Compliance Creep – a control that was accurate when the policy was written, quietly stale by the time it’s actually tested against reality. Nobody decides to let it happen. It just accumulates, one unreviewed control at a time, until the gap between what was attested and what’s true is real.
That means the realistic worst case isn’t “the building had an incident.” It’s “the building had an incident, the incident happened precisely because a control was weaker than represented, and the policy that was supposed to absorb the loss doesn’t pay – leaving the full cost of remediation, tenant disruption, and liability sitting on the owner’s balance sheet with no backstop.” (If you want to see what navigating that scenario involves, here’s what cyber insurance support looks like post-incident.)
The building damage and the insurance protection fail for the same reason, at the same time. That’s exactly the kind of cyber encumbrance a transaction readiness review exists to find – before a buyer, a lender, or an insurer finds it for you.
—
Everything above is written from the buyer’s chair – what you inherit, what it costs you, why it’s worth knowing before you sign. If you’re the one selling instead, the same underlying risk creates a very different kind of leverage problem: see it from the seller’s side →
If you have a disposition, acquisition, or refinance on the calendar in the next 12 months, the right time to find out what your digital due diligence would say is before someone else asks the question.
Frequently Asked Questions
What is a Cyber Encumbrance in commercial real estate?
ProtectMyIT coined the term Cyber Encumbrance for a weakness in a building's digital or building systems that could affect a deal: an unpatched server, an orphaned vendor credential, an unsecured building system. The parallel is practical: before closing, a buyer wants to know what comes with the building, and these weaknesses come with it, whether or not anyone has looked for them yet.
What digital systems and risks does a buyer actually inherit when acquiring a commercial property?
When you acquire a property – or a portfolio – you're not just acquiring the building and the leases. You're acquiring everything connected to it: the property management platform, the access control and badge systems, the building management system running HVAC and elevators, the leasing portal tenants log into, and whatever vendor remote-access credentials came with the last owner's IT setup – all representing a category of inherited risk that many diligence checklists weren't designed to surface.
Can a cybersecurity gap void a commercial property owner's cyber insurance coverage after an incident?
When a claim reveals the gap between what was attested and what was actually in place, insurers aren't just entitled to deny the specific claim; they can rescind the policy altogether. That means the realistic worst case isn't 'the building had an incident.' It's 'the building had an incident, the incident happened precisely because a control was weaker than represented, and the policy that was supposed to absorb the loss doesn't pay – leaving the full cost of remediation, tenant disruption, and liability sitting on the owner's balance sheet with no backstop.'
