Resources Categories
INDUSTRY FACT FILE · REAL ESTATE, CONSTRUCTION & FACILITIES
Industry Overview: Real Estate, Construction and Facilities in India
Who builds, sells, leases and runs India's homes, offices, malls, parks and sites, the obligations that apply, who buys cybersecurity and why each type of company needs a distinct approach.
|
In this document 1. Why real estate and facilities cybersecurity matters now 2. The ecosystem at a glance 3. Categories of real estate, construction and facilities companies 4. The regulatory, standards and occupier framework at a glance 5. Government, public-sector and private participants 6. Who buys cybersecurity inside a property or construction company 7. Why each type of company needs a different approach 8. How Codec Networks works with real estate, construction and facilities companies |
|
Sector scope Sector: residential and commercial developers, EPC and construction companies, commercial property groups and REITs, co-working operators, facility management companies and smart building platforms. Primary service proposition: building management and IoT security, CCTV and access control assessment, ERP and portal security and a 24x7 building SOC. Hospitality, logistics parks and smart cities have separate fact files. |
1. Why real estate and facilities cybersecurity matters now
Real estate and construction are among India's largest economic engines. Knight Frank and CII estimated the real estate sector at about US$482 billion in 2023, roughly 7.3 per cent of economic output, with a projected US$1.5 trillion by 2034; industry estimates put construction employment at around 71 million people, second only to agriculture. Demand is being pulled by the National Infrastructure Pipeline of about ₹111 lakh crore, PMAY-Urban 2.0's target of one crore urban houses approved in August 2024, record office leasing of more than 80 million square feet in 2025 led by global capability centres, and a listed REIT market that reached five trusts with the listing of Knowledge Realty Trust in 2025.
|
~7.3% Real estate's share of India's economic output in 2023 (Knight Frank–CII) |
150,000 Live camera feeds reached in the 2021 Verkada breach (US FTC) |
US$2.77 bn Business email compromise losses reported to the FBI in 2024 |
6 hours To report cyber incidents to CERT-In |
Every part of that activity now runs on connected systems. Developers sell through CRM, booking portals and broker apps that hold buyers' KYC, PAN and bank details; contractors run sites on ERP, progress-billing and subcontractor portals that release large payments; and finished buildings depend on building management systems, lifts, fire systems, CCTV, access control, parking and visitor apps that vendors and integrators maintain remotely, often over flat networks shared with tenants. Facility management companies operate these systems across dozens of client sites from a single platform, and co-working operators put hundreds of unrelated businesses on one network.
The incidents are real. In March 2021 a hacker used a support account to reach about 150,000 live camera feeds on the Verkada cloud video platform, including hospitals and offices, which led to a US$2.95 million FTC penalty in 2024. Target's 2013 breach of 40 million payment cards began with credentials stolen from its HVAC contractor. In January 2020 Maze ransomware forced Bouygues Construction to take its information systems offline and employee data was later published; weeks later facility services group ISS World shut down its global IT environment after a malware attack. In November 2016 a denial-of-service attack on building automation left two apartment blocks in Lappeenranta, Finland without heating. In India, Ansal Housing disclosed to the stock exchanges in April 2021 that it had suffered repeated ransomware attacks on its IT systems since February with possible data loss, and the FBI reported US$2.77 billion of business email compromise losses in 2024—a fraud that targets property deals and contractor payments everywhere.
The obligations are cross-sector but growing. CERT-In's Directions require incidents to be reported within six hours and ICT logs kept for 180 days; its 2025 audit guidelines expect risk-based independent audits that include OT such as building systems; listed developers, contractors and REIT managers disclose cyber incidents under SEBI's LODR Regulations; RERA imposes registration, escrow and disclosure duties that depend on accurate project and buyer records; the DPDP Act and Rules govern buyer, tenant, resident, visitor and employee data, with most obligations from May 2027; and since April 2025 CCTV cameras sold in India must meet MeitY's essential security requirements with STQC testing. Corporate occupiers, GCCs, lenders and insurers add their own questionnaires before signing a lease or a facility.
|
Key takeaway In real estate, construction and facilities, cybersecurity is tenant safety, deal integrity and data trust in one. Building systems, the vendors who reach them, the portals that sell and lease and the payments that build must be protected together. |
2. The ecosystem at a glance
Figure 1: India's real estate, construction and facilities ecosystem.
3. Categories of real estate, construction and facilities companies
|
Category |
Who they are |
Typical ownership |
Key regulatory basis |
|
Residential developers |
Apartments, townships, plotted and affordable housing; sales through CRM, portals and brokers |
Listed and private developers, PSU housing boards |
RERA and state rules; SEBI LODR (listed); DPDP; CERT-In |
|
Commercial developers and REITs |
Office parks, IT SEZs, malls, warehouses; leased to corporates and GCCs |
Listed REITs, institutional and private groups |
SEBI REIT Regulations; SEBI LODR; CERT-In; DPDP; occupier contracts |
|
EPC and construction companies |
Buildings, roads, metro, industrial and infrastructure projects; site-based operations |
Listed and private contractors, PSU construction companies |
CERT-In; SEBI LODR (listed); client and lender contracts; DPDP for workforce data |
|
Co-working and flexible workspace operators |
Managed offices, hot desks and enterprise suites on shared networks |
Private operators, some listed |
CERT-In; DPDP; member and enterprise client contracts |
|
Facility management companies |
Integrated FM, security, housekeeping and maintenance across client sites |
Private and listed FM groups, global subsidiaries |
CERT-In; client contracts; DPDP; MeitY CCTV requirements for systems they install |
|
Smart building and proptech platforms |
BMS, IoT, tenant apps, visitor and parking platforms, listing portals |
Start-ups, OEM subsidiaries, platforms |
CERT-In; DPDP; MeitY CCTV requirements; customer security requirements |
|
Government and PSU property bodies |
Housing boards, development authorities, PSU construction and estate management |
Central and state bodies |
CERT-In; government IT security requirements; DPDP; NCIIPC where systems are notified |
4. The regulatory, standards and occupier framework at a glance
|
Instrument or expectation |
What it means for property, construction and facilities companies |
|
CERT-In Directions (28 April 2022) |
Cyber incidents reported within six hours of noticing them; ICT logs kept for a rolling 180 days in India; clock synchronisation; designated point of contact |
|
CERT-In audit policy guidelines (25 July 2025) |
Risk-based, independent cyber audits covering IT, OT (including building systems), cloud and applications, with closure of findings |
|
RERA 2016 and state rules |
Project registration, escrow of buyer funds, disclosures and timelines enforced by state RERAs—all of which depend on accurate project, collection and buyer records held in ERP and CRM |
|
SEBI REIT Regulations 2014 (SM REITs from 2024) and LODR |
Governance, valuation and unit-holder reporting for REITs; listed entities disclose cyber incidents in the quarterly corporate governance report |
|
DPDP Act 2023 and DPDP Rules 2025 |
Notices, consent, safeguards, retention limits and breach intimation for buyer, tenant, resident, visitor, member and employee data—including CCTV footage; most obligations from May 2027 |
|
MeitY essential requirements for CCTV (in effect 9 April 2025) |
CCTV cameras under the Compulsory Registration Order must meet security requirements tested by STQC—relevant to developers, FM companies and integrators specifying cameras |
|
Building codes and occupier requirements |
National Building Code 2016, ECBC 2017 and fire rules for building systems; corporate occupier, GCC, lender and insurer security questionnaires; ISO/IEC 27001 and IEC 62443 as the common language |
|
How these apply Most Indian cyber obligations are cross-sector and depend on size, listing status and the data you hold; RERA and REIT duties depend on your registrations; CCTV requirements depend on what you buy and install. Confirm against the official instruments and your occupier contracts. |
5. Government, public-sector and private participants
- The Ministry of Housing and Urban Affairs runs PMAY-Urban, the Smart Cities Mission and model laws such as the Model Tenancy Act (2021); state RERAs regulate projects and promoters.
- SEBI regulates REITs and listed-company disclosure; MeitY and CERT-In set cyber obligations; MeitY's CCTV essential requirements govern cameras sold in India.
- BIS and the Bureau of Energy Efficiency issue the National Building Code and ECBC; municipal corporations and fire authorities approve and inspect buildings.
- Listed developers, REITs and institutional investors own the large office, retail and residential portfolios; PSU housing boards and construction companies deliver public projects.
- EPC contractors, MEP specialists and subcontractors build the assets; facility management companies and security agencies run them.
- BMS, lift, fire, CCTV and access control OEMs, integrators and proptech platforms supply and remotely maintain the systems every building depends on.
6. Who buys cybersecurity inside a property or construction company
|
Stakeholder |
What they care about |
What they buy |
|
Board, MD and CFO |
Project cash flow, escrow, disclosure, investor and lender confidence |
Board advisory, fraud controls, crisis exercises |
|
CIO and CISO |
IT, applications, building systems, audits, occupier questionnaires |
Audits, assessments, SOC, GRC programmes |
|
Projects and site heads |
Site ERP, billing, subcontractors, site connectivity |
Payment controls, site system reviews, BEC simulation |
|
Property and facility managers |
Building uptime, tenant comfort, vendor access |
BMS and building network assessments, vendor access controls |
|
Security and loss-prevention heads |
CCTV, access control, visitor management |
CCTV and access control testing, surveillance privacy |
|
Sales, leasing and customer experience |
Booking portals, apps, broker channels, buyer data |
Portal and app testing, DPDP programme |
|
Finance and accounts payable |
Vendor payments, collections, bank-detail changes |
Master-data controls, BEC defence |
|
Legal, compliance and company secretarial |
RERA, SEBI, DPDP, contracts |
Compliance mapping, disclosure support |
7. Why each type of company needs a different approach
|
Company type |
Highest-consequence risk |
Starting point for assurance |
|
Residential developer |
Ransomware or data theft hitting CRM, bookings and buyer KYC at launch |
ERP and CRM security, backups, DPDP programme |
|
Commercial developer or REIT |
Building system takeover or CCTV exposure in a landmark asset |
BMS and security system assessment, segmentation, SOC |
|
EPC and construction company |
Payment diversion and ransomware across site ERP |
Payment controls, BEC simulation, backup testing |
|
Co-working operator |
A member's device reaching other members and door controllers |
Network segmentation, access control testing |
|
Facility management company |
One platform credential exposing dozens of client sites |
VMS and platform assessment, vendor assurance evidence |
|
Smart building or proptech platform |
Insecure APIs and IoT devices exposing many buildings |
Application, API and IoT security testing |
|
Government and PSU property body |
Citizen and allottee data and public infrastructure |
CERT-In-aligned audits, portal testing, DPDP |
8. How Codec Networks works with real estate, construction and facilities companies
Codec Networks is a CERT-In empanelled information security auditing organisation certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For real estate, construction and facilities companies we deliver building management and IoT security assessments using building-aware methods, CCTV and access control testing aligned to MeitY requirements, building network segmentation and vendor remote access design, ERP, CRM, portal and app security testing, payment fraud defence, DPDP programmes for buyer, tenant and visitor data, a 24x7 building SOC and crisis exercises with property, FM and security teams—connected from finding to closure.
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. It is not legal, safety or regulatory advice. Obligations differ by company type, listing status, RERA registrations, projects and occupier contracts; confirm them against the official CERT-In, MeitY, SEBI, RERA, DPDP and building-authority instruments and your contracts.