SOC 2 IT requirements for commercial real estate businesses focus on protecting the systems and information included in an examination's scope. Define the services, people, networks, and building technologies involved, then document and operate controls for access, changes, monitoring, incidents, and recovery. Scope depends on the services your organization provides and its commitments to customers.
What is SOC 2, and when might a CRE business need it?
SOC 2 is an independent examination of controls at a service organization, assessed against applicable Trust Services Criteria. It is not a generic IT certification that every property owner or landlord must obtain. A CRE organization may encounter a SOC 2 request when it provides services to customers that rely on its systems or when a customer, investor, or business partner asks for assurance about how information is handled.
Start by identifying the entity and service being examined. A property-management company, a building technology provider, and an individual property may have different systems, responsibilities, and customer commitments. Do not assume every tenant system or vendor platform belongs in the same scope.
SOC 2 reports are commonly described as Type 1 or Type 2. A Type 1 examination addresses whether controls are suitably designed at a specified point in time. A Type 2 examination also evaluates whether controls operated effectively over a period. Agree on the examination type, period, and scope with the auditor and relevant stakeholders before evidence collection begins.
SOC 2 uses five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.
The criteria selected should match the services and commitments under review. Security is central to a SOC 2 examination; the other criteria apply when relevant to the service and its stated commitments. Confirm the selection with the auditor rather than treating all five as automatic requirements.
Takeaway: SOC 2 is scoped assurance about controls, not a blanket certification for every building or system.
Which systems and building technologies belong in scope?
Draw the scope around the service and information being examined, then trace the systems that support it. Depending on the organization, this may include business applications, identity systems, networks, cloud services, endpoints, backups, support processes, and records containing customer or tenant information. Include systems that can affect the service, even when another party operates them.
In a property environment, map the landlord's systems separately from tenant-owned systems. A network supporting property staff may connect to access-control panels, cameras, visitor systems, building automation gateways, intercoms, or amenity Wi-Fi. Those connections matter when they can affect in-scope services, access to information, or operational continuity.
Walk the MDFs and IDFs and record what is actually connected. Note switches, controllers, carrier handoffs, remote-access paths, vendor-managed equipment, and dependencies between systems. A system's location in a telecom room does not establish who owns it. Identify the responsible party, support contact, access method, and change authority for each relevant component.
Third-party systems remain part of the risk picture when a vendor operates them. Document what the vendor provides, what information it can access, how access is approved, and how service issues or security events are escalated. The examination scope and control responsibilities should reflect the actual service arrangement.
Takeaway: Build scope from service dependencies and ownership, not from a building diagram alone.
What IT controls should a CRE organization document and operate?
Controls should match the risks and commitments of the scoped service. A practical control set commonly addresses how access is granted and removed, how systems are configured and changed, how activity is monitored, how incidents are handled, and how data and services are recovered. Policies alone are not enough: the organization needs records showing that the stated processes are followed.
- Access management: Identify authorized users, use appropriate authentication, review access, and remove it when roles or vendor relationships change. Pay particular attention to remote vendor access into access control, cameras, building management systems, and network equipment.
- Change management: Record approvals, testing, implementation, and rollback considerations for changes to in-scope systems. Coordinate changes that could affect shared networks, tenant boundaries, building operations, or security systems.
- Monitoring and incident response: Define who reviews alerts, how issues are escalated, and how incidents are documented. Include clear contacts and responsibilities for vendors whose systems support the service.
- Availability and recovery: Identify critical services and dependencies, set recovery expectations, and maintain and test appropriate backup or recovery procedures. Include carrier connections, network equipment, and operational technology where they support the scoped service.
- Vendor oversight: Maintain a record of service providers, responsibilities, access, and relevant assurance information. Revisit the arrangement when services or access paths change.
- Physical safeguards and documentation: Control access to relevant equipment areas and keep inventories, diagrams, configuration records, and procedures current enough to support operations and examination evidence.
For a CRE portfolio, the control owner may not be the person who manages the vendor contract or the person who can enter the telecom room. Make those handoffs explicit. When a tenant, landlord, carrier, and technology vendor share a dependency, document who approves changes and who communicates service impact.
Takeaway: A control is useful when its owner, operating steps, and evidence are clear.
What evidence should we collect before a SOC 2 examination?
Evidence should demonstrate that controls were designed and operated as described. The auditor determines what evidence is appropriate for the examination, but an organization can prepare by keeping records organized by control, owner, system, and period. Avoid waiting until the examination to reconstruct decisions from email or memory.
Useful records may include approved policies, access lists and review records, change tickets, incident logs, vendor reviews, system inventories, network and dependency diagrams, backup records, recovery test results, and training or onboarding documentation. Retain only information needed for the examination and handle sensitive evidence through an approved, access-controlled process.
For buildings, keep the technology record tied to the property and service boundary. Document the demarcation point, MDF and IDF equipment, network segments, connected building systems, vendor remote access, and the party responsible for each item. When a configuration or vendor changes, update the diagram and the supporting ownership record.
A client describes the value of clear technical communication: "Brian clearly explains what is happening and shows you ways to help prevent the issue from happening again. He is great to work with." The speaker's name and industry were not provided, so this example is shared without an unverified attribution. Clear explanations help teams understand the issue, the control owner, and what evidence should exist; they are not an audit opinion.
Takeaway: Evidence is strongest when it is created during normal operations, not assembled after the fact.
How should we prepare without disrupting tenants or building operations?
Begin with discovery, not a building-wide replacement project. Confirm the service under review, identify the information it handles, map supporting systems, and establish landlord, tenant, carrier, and vendor boundaries. Then compare existing practices with the controls needed for the agreed scope. This approach reveals where documentation, ownership, or operating procedures need attention before anyone proposes major changes.
- Confirm the service, legal entity, examination type, criteria, and scope with the auditor and relevant stakeholders.
- Inventory in-scope systems, data flows, locations, vendors, and remote-access paths.
- Assign a named owner to each control and document how the control is performed.
- Identify gaps, prioritize changes by service risk and dependency, and record decisions.
- Collect evidence as controls operate, then review it for completeness before the examination period or evidence request.
Coordinate work with property operations. A network change that appears routine can affect cameras, access control, tenant connectivity, or building systems when dependencies are unclear. Schedule changes with the responsible parties, preserve rollback options where appropriate, and communicate operational impact before work begins.
GDS Technology works with commercial real estate organizations on managed IT, cybersecurity, IT compliance, and property technology infrastructure. Learn about technology support for commercial real estate, IT compliance services, and riser management services. This work can support an organization's control environment and preparation; it does not establish or guarantee a SOC 2 compliance outcome. Treat an examination as one part of a broader operating model: clear scope, documented ownership, practical controls, and reliable records make technology easier to govern and budget.
Takeaway: Walk the closets, map the dependencies, and agree on ownership before changing systems.
Frequently Asked Questions
Does every commercial real estate company need SOC 2?
No. SOC 2 is generally relevant when an organization provides services and customers or other stakeholders need assurance about controls over related systems and information. A landlord is not automatically required to obtain a report. Determine whether a customer commitment, contract, procurement process, or business requirement calls for an examination, then define the service and entity involved.
Are building automation, access control, and cameras always in SOC 2 scope?
No. Their relevance depends on the service being examined and whether these systems support it, affect its security or availability, or connect to in-scope information and networks. Map the systems and connections, identify who operates them, and ask the auditor to confirm the scope. Do not assume a vendor-owned system is irrelevant.
What is the difference between a SOC 2 Type 1 and Type 2 report?
A Type 1 examination evaluates whether controls are suitably designed at a particular point in time. A Type 2 examination also evaluates whether those controls operated effectively over a defined period. The appropriate examination depends on the assurance requested and the organization's readiness. Confirm the intended scope, criteria, and timing with the auditor.
Can an IT provider make our CRE business SOC 2 compliant?
An IT provider may help assess systems, implement or operate agreed controls, organize documentation, and support evidence collection. That work can support preparation for a SOC 2 examination, but it does not make the business compliant or guarantee an examination result. The organization remains responsible for its services, decisions, control ownership, and commitments. The auditor evaluates controls within the agreed scope.
What should we do first if our building technology is poorly documented?
Start with a scoped inventory and ownership map. Record the systems that support the service, their network connections, responsible parties, vendor access, and relevant operating procedures. Prioritize unknown dependencies that could affect service availability or information security. Use the findings to plan documentation and control improvements before deciding whether equipment needs replacement.
