ISO 27001 for real estate: the proof your clients ask for

A property manager holds more personal data than most owners assume. Rental applications arrive with passport copies, salary slips and credit information. Owner files contain bank details, floor plans and keys to the building. A single mis-sent email or a stolen phone can expose all of it.

Institutional owners, corporate tenants and public bodies have started to put this risk into their supplier questionnaires. They want to know whether you run an information security management system (ISMS). A certificate number the purchasing department can check is easier to file than a paragraph in your quote.

ISO 27001:2022 gives the answer in a form that buyers know. It starts with a risk assessment, and that assessment decides which Annex A controls you apply and why. The 2022 edition also covers cloud services, data protection and cyber risks, which matches how property firms work today.

• About ISO 27001:2022

The standard does not prescribe a technology. It asks you to look at how information moves through your business and to protect the points where it can leak or get lost. In property work these are the usual places:

Tenant screening

Applications with ID copies and income proofs arrive by email and stay in inboxes long after the flat is let.

Key and access management

Key registers, access codes and badges decide who can enter which building. The risk sits in the moment a caretaker or contractor leaves and the access stays.

Viewings and handovers

Tablets and phones carry handover reports and photos of occupied flats. If the device is lost or shared, the data goes with it.

Property management software

Tenant ledgers and service charge statements live in a cloud platform. User rights, backups and the contract with the provider all matter.

Building technology

Heating control, door systems and cameras sit on the network and are often maintained remotely by third parties.

Document exchange with third parties

Craftsmen, notaries, banks and valuers receive plans and ownership details as email attachments, often unencrypted.

The requirements follow the high level structure of the standard, from context and leadership to operation, performance evaluation and improvement. For a property firm each one translates into a small, concrete piece of work.

Most agencies and management firms are smaller than the standard seems to assume. The work scales with your size, and the first steps are modest.

1. 01

   Find out where the data lives

   Note every place that holds tenant and owner data: property software, shared drives, mailboxes, phones, paper folders.

2. 02

   Name one responsible person

   Someone in management owns the topic, even if it takes only a few hours a month.

3. 03

   Fix access

   Define who sees which files, switch on multi-factor login and write down what happens to accounts and keys when someone leaves.

4. 04

   Check your suppliers

   Review the contracts with your software provider, IT support and the firms that maintain building systems.

5. 05

   Put it in writing

   Document the risk assessment, the policy and the Statement of Applicability. Short documents are enough if they match what you do.

6. 06

   Take the self-assessment

   The questions show which requirements you already meet and which are still open.

• ISO for small and medium businesses

You answer 48 yes/no questions online. Thirteen of them are mandatory requirements of the standard and must all be answered yes. Of the other 35 questions, at least 24 must be yes. The assessment is free, and you do not need an account to buy the certificate.

Once you have passed and paid, the certificate arrives within 4 hours. It is issued by G6 Agency AG under licence from SICE, and SICE reviews every assessment before issue. There is no on-site audit. Each certificate carries a number and a QR code, so a client or tender office can verify it on a public page. You can paste the PDF into a supplier questionnaire as it is.

The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. The certificate is valid for 3 years and is confirmed each year by that short re-audit. Billing is an automatic yearly subscription that you can cancel at any time in your customer account, effective at the end of the current year. Swiss and Liechtenstein customers pay 8.1% VAT, already included. If you add further standards, you get 20% off for two and 30% off for three or more, also on the yearly fee.

• Start the free self-assessment
• See pricing
• How it works

That depends on what the client wrote into the questionnaire or tender. Some ask only for an ISO 27001 certificate that they can verify. Others name a specific route, such as the classic route with an on-site audit by a certification body. Read the wording before you apply, and ask the purchasing department if it is unclear.

The guides below compare the routes and explain how the cost and the effort differ.

• Compare certification routes
• Certification without an on-site audit
• Certification cost