CRE
A SOC 2 compliance checklist for commercial real estate should cover 5 areas: scope, security controls, evidence, vendor oversight, and continuous monitoring. CRE operators need to protect tenant records, leasing and payment data, building systems, access control, cameras, and cloud platforms while proving that safeguards work consistently.
What does SOC 2 compliance mean for a commercial real estate company?
SOC 2 is an independent examination framework developed by the AICPA. It evaluates whether an organization has designed and operated controls to protect customer information and systems according to applicable Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy.
For a CRE operator, property manager, co-working provider, or PropTech vendor, SOC 2 is not a building certification. It is a way to demonstrate that the people, processes, applications, and vendors handling sensitive business information have accountable controls around them.
The scope may include leasing platforms, tenant portals, payment workflows, accounting integrations, visitor systems, cloud storage, support tools, cameras, access control administration, and building-management-related data. The exact scope should follow the services and data that create risk for tenants, owners, investors, and business partners.
Security is usually the starting point because it addresses protection from unauthorized access. Availability matters when tenants and building teams depend on platforms for access, communications, work orders, visitor management, or operational continuity.
Atlanta-area CRE organizations also need to account for the realities of multi-tenant properties: shared riser infrastructure, carrier coordination, third-party building systems, distributed management teams, and storm-related outage exposure. A control that looks adequate for a single office can fail when several tenants and vendors rely on the same environment.
Takeaway: SOC 2 turns technology risk into documented, testable business controls rather than a one-time IT project.
What should be included in a SOC 2 compliance checklist for CRE?
Start by defining the service boundary. Document which legal entities, properties, applications, teams, data types, integrations, and vendors are included. A vague scope creates gaps, especially when leasing, operations, accounting, and property technology use different systems.
- Inventory systems and data. List cloud applications, servers, endpoints, network equipment, access-control consoles, video-management systems, tenant portals, payment tools, shared drives, and integrations. Identify what information each system stores, transmits, or can access.
- Classify sensitive information. Identify tenant contact information, lease documents, payment data, employee records, credentials, visitor records, access logs, camera footage, incident reports, and building plans. Assign an owner and retention expectation for each important data category.
- Map access. Document who can access each critical system, why they need access, whether multi-factor authentication is enabled, and how access is removed when employees, contractors, or property vendors leave.
- Establish security baselines. Define standards for endpoint protection, patching, encryption, password management, mobile devices, backups, logging, remote access, network segmentation, and physical access to MDF and IDF spaces.
- Control change management. Require risk review, approval, testing, and rollback planning for meaningful changes to tenant-facing applications, building connectivity, access control, surveillance, integrations, and identity systems.
- Prepare for incidents. Maintain an incident-response plan with clear escalation contacts, decision authority, communications steps, evidence preservation, and post-incident review. Include scenarios such as ransomware, exposed tenant data, a compromised administrator account, or unavailable building technology.
- Test recovery. Verify that backups can be restored and that critical processes can continue when an application, carrier connection, site, or vendor platform is unavailable. A backup that has never been restored is not proof of recovery capability.
- Manage vendors. Assess vendors that handle sensitive information or support critical operations. Keep agreements, security documentation, review dates, and follow-up actions in one accountable process.
GDS Technology can help CRE teams align this work with broader IT compliance services, including practical ownership of evidence, policies, infrastructure controls, and remediation priorities.
Takeaway: The strongest checklist connects every important system and data flow to a named owner, documented control, and repeatable review.
Which SOC 2 security controls matter most in a multi-tenant property environment?
Identity and access management should receive immediate attention. Each staff member, contractor, and vendor should use an individual account, with access limited to the systems required for their role. Shared administrative credentials make it difficult to investigate incidents or prove accountability.
Require multi-factor authentication for email, cloud administration, remote access, financial tools, and systems that administer access control or surveillance. Review privileged accounts regularly, and disable access promptly when a relationship ends or responsibilities change.
Protect building technology as deliberately as business IT. Access-control panels, cameras, video recorders, Wi-Fi, switches, building controllers, and their management interfaces should be inventoried, segmented where appropriate, patched under a controlled process, and restricted to authorized administrators.
Network documentation is particularly valuable in CRE. Maintain current records for risers, demarcation points, carrier circuits, MDF and IDF equipment, VLANs, tenant handoffs, and responsible parties. This shortens outage resolution and reduces the risk of an unauthorized or poorly understood connection affecting multiple occupants.
Logging is another core control. Retain meaningful records of administrative changes, authentication events, alert investigations, access changes, and security incidents. Logs are useful only when someone reviews important signals and knows how to respond. Our article on SIEM, SOC services, and incident response explains why alert collection alone is not the same as accountable response.
Physical safeguards matter as well. Restrict access to equipment rooms, document key and badge access, secure cabinets and network closets, and create procedures for vendors working in sensitive areas. These controls support both security and availability in properties where infrastructure is shared.
Key figure: SOC 2 evaluates up to 5 Trust Services Criteria, with Security serving as the common foundation for every SOC 2 examination.
Takeaway: In CRE, a SOC 2 control environment must protect both information systems and the operational technology that supports the tenant experience.
What evidence should a CRE organization collect for a SOC 2 audit?
Auditors need evidence that controls operated during the examination period, not simply policy documents. Build an evidence calendar that identifies what to collect, who collects it, when it is due, where it is stored, and how it supports a particular control.
Useful access-control evidence includes user-access reviews, terminated-user removal records, multi-factor authentication reports, privileged-account lists, help-desk tickets, approval records, and screenshots or exports that demonstrate settings were enforced.
For infrastructure, preserve patch reports, endpoint-protection status, vulnerability-remediation records, backup job results, restoration-test results, network diagrams, change tickets, security-alert reviews, and incident documentation. Keep the evidence readable and tied to the relevant system or property.
Vendor evidence may include a vendor inventory, risk ratings, contracts, data-processing terms, security questionnaires, SOC reports where available, and documentation of exceptions or follow-up actions. A vendor relationship should not be treated as low risk simply because the platform is familiar or widely used.
CRE teams should also capture operational evidence for building-related systems in scope: approved camera-access changes, access-control administrator reviews, carrier escalation procedures, low-voltage work documentation, and records showing who can modify tenant-impacting settings.
Therese, a commercial real estate client, described the value of clear preventive guidance: “Brian clearly explains what is happening and shows you ways to help prevent the issue from happening again. He is great to work with.” That mindset matters in SOC 2 readiness. Evidence collection should expose recurring weaknesses early, not become a scramble before an audit.
For systems that support tenant safety and property operations, coordinate security evidence with your business video surveillance systems and access-control governance rather than managing each platform in isolation.
Takeaway: Evidence is strongest when it shows a control’s owner, operating date, system scope, result, and follow-up action.
How can Atlanta CRE operators maintain SOC 2 readiness after the audit?
SOC 2 readiness is a management discipline, not a certificate to place in a proposal folder. Establish a recurring operating cadence for access reviews, patching, vulnerability remediation, backup checks, vendor reviews, policy updates, security awareness, incident exercises, and executive risk review.
Assign ownership across business and technology teams. Property operations may own building-system inventory and vendor coordination; finance may own payment workflow controls; HR may own onboarding and offboarding triggers; IT may own identity, endpoint, network, cloud, and recovery safeguards.
Measure exceptions openly. If a legacy camera system cannot support modern authentication, a vendor has not delivered requested documentation, or a property has an undocumented network closet, record the risk, owner, interim mitigation, and target remediation date. Hidden exceptions become audit surprises and business continuity problems.
Test realistic scenarios. For Atlanta properties, include a carrier outage, severe-weather disruption, unavailable leasing system, compromised email account, ransomware event, lost mobile device, and a contractor whose access should have been removed. Recovery planning should account for tenant communications and the operational impact on leasing, common areas, and access.
Review whether your managed service provider can produce the operational records that the program needs. A dependable Technology Partner should help maintain the underlying discipline: documented infrastructure, protected endpoints, monitored alerts, tested recovery, and clear accountability across sites.
GDS Technology supports commercial real estate organizations with commercial real estate technology support, cybersecurity, cloud services, structured cabling, and continuity-focused planning. For a SOC 2 effort, the goal is to reduce risk while making properties easier to operate, lease, and support.
Takeaway: Continuous readiness protects tenant trust, supports resilient operations, and prevents controls from decaying after the audit period ends.
Frequently Asked Questions
Is SOC 2 required for commercial real estate companies?
SOC 2 is not generally required by law for commercial real estate companies. However, investors, enterprise tenants, lenders, partners, and customers may request it when a company handles sensitive tenant data or provides technology-enabled services. It can also provide a structured way to manage security and operational risk.
Which SOC 2 criteria should a CRE company choose?
Security is the core criterion and is included in every SOC 2 examination. Availability may be relevant for tenant portals, access control, communications, and property operations. Confidentiality, privacy, and processing integrity depend on the data handled, contractual commitments, payment workflows, and services included in the audit scope.
Does access control and video surveillance fall within SOC 2 scope?
They can fall within scope when those systems store sensitive records, affect tenant operations, connect to corporate networks, or are administered as part of the service being examined. Scope should reflect risk, data flows, administrative access, vendor relationships, and the impact an outage or unauthorized change could have.
How long should a company prepare before a SOC 2 audit?
Preparation time depends on the starting maturity, audit scope, available evidence, vendor complexity, and whether controls already operate consistently. Begin with a gap assessment, then prioritize high-risk items such as identity controls, incident response, recovery testing, vendor governance, and evidence collection before choosing an examination period.
