Resources Categories

Back

INDUSTRY FACT FILE · REAL ESTATE, CONSTRUCTION & FACILITIES

Main Products and Services in Real Estate, Construction and Facilities

What India's developers, contractors, property groups, co-working operators and facility managers sell and deliver, the project, building and enterprise systems behind each activity, and where those systems create cybersecurity and compliance exposure.

In this document

1. How property, construction and facilities companies earn their money

2. Products and services by company type

3. The building layer: BMS, lifts, fire, CCTV and access control

4. The enterprise layer: ERP, CRM, portals, apps and project data

5. The systems behind the products and services

6. Trends that change the attack surface

7. Mapping operations to Codec Networks engagements

1. How property, construction and facilities companies earn their money

Revenue stream	How it works	Security relevance
Residential sales	Units sold off-plan and on completion through CRM, portals and brokers; collections into RERA escrow	Buyer KYC and payment data; booking and receipt integrity; collection fraud
Commercial leasing	Office, retail and warehouse space leased to corporates, GCCs and retailers	Occupier security questionnaires; tenant data; building system uptime
Construction contracts	EPC and item-rate contracts billed on progress; subcontractor and supplier payments	Payment diversion; site ERP outages; tender and BIM confidentiality
Co-working and managed offices	Memberships, enterprise suites and services on shared infrastructure	Member data and networks; access control; enterprise client requirements
Facility management and maintenance	Integrated FM, security, housekeeping and maintenance under SLAs	Client systems operated remotely; CCTV and access platforms; workforce data
REIT distributions and asset management	Rental income distributed to unit holders; asset and property management fees	Reporting integrity; portfolio-wide building risk; SEBI disclosure

2. Products and services by company type

Company type	Main products and services	Key systems
Residential developers	Apartments, villas, plots, affordable and mid-income housing	ERP, CRM, booking portals, broker apps, document management, resident apps
Commercial developers and REITs	Office parks, SEZs, malls, warehouses; leasing and asset management	Lease management, BMS, CCTV, access control, parking, tenant apps, REIT reporting
EPC and construction companies	Buildings, infrastructure, industrial and metro projects	Site ERP, progress billing, BIM and CDE, subcontractor portals, site cameras and IoT
Co-working operators	Hot desks, private offices, enterprise suites, meeting rooms	Member apps, access control, Wi-Fi, booking and billing platforms
Facility management companies	FM, security, housekeeping, energy and maintenance services	CAFM and helpdesk, VMS and cloud CCTV, visitor and patrol apps, workforce systems
Smart building and proptech platforms	BMS and IoT platforms, tenant experience apps, listing and brokerage portals	Cloud platforms, APIs, IoT gateways, mobile apps, listing databases

3. The building layer: BMS, lifts, fire, CCTV and access control

A modern building is run by a building management system (BMS) that controls heating, ventilation and air-conditioning, lighting, pumps and energy through controllers speaking BACnet, Modbus, KNX or proprietary protocols. Lift groups, fire detection and suppression, public address, parking and water systems have their own controllers, increasingly bridged to the BMS and to cloud dashboards. Security runs on IP cameras feeding a video management system (VMS) or a cloud video platform, access control panels and readers, visitor management kiosks and apps, and turnstiles that depend on them.

Much of this estate is installed by integrators at construction stage, handed over with default settings and maintained remotely by OEMs and FM contractors for the life of the building. Controllers run for decades on unpatched firmware, protocols carry no authentication, and the building network often shares switches with corporate IT and tenant services. A breach of a cloud video platform such as the 2021 Verkada incident exposes every camera connected to it; an exposed BMS, as in the Lappeenranta heating outage, affects every occupant at once.

4. The enterprise layer: ERP, CRM, portals, apps and project data

Above the building sits the enterprise layer. Developers run ERP for projects, procurement, billing and collections; CRM and booking portals for leads, bookings, KYC, agreements and receipts; broker and channel-partner apps; and document management systems holding agreements, approvals and RERA filings. Contractors run site ERP, progress billing and subcontractor portals that release large running-account payments, and share BIM models and drawings through common data environments with consultants and clients.

Property groups, REITs and FM companies add lease management, tenant experience apps, computer-aided facility management (CAFM) and helpdesk platforms, energy dashboards and investor reporting. Co-working operators run member apps that open doors, book rooms and bill cards. These platforms hold buyer, tenant, member and visitor personal data in volume, connect to payment gateways and banks, and are increasingly cloud-hosted—so identity, configuration and API security decide whether a single credential exposes one site or a whole portfolio.

Highest-risk moments

Building handover and commissioning when default credentials and open remote access are left behind, vendor remote sessions into BMS and security systems, launch weekends when CRM and bookings peak, bank-detail changes on running-account bills, shared platform credentials across client sites, and tenant or member devices on flat building networks are where property, construction and facilities incidents typically begin or escalate.

5. The systems behind the products and services

Title: Figure 2: Where cyber risk sits across the property lifecycle. - Description: Figure 2: Where cyber risk sits across the property lifecycle.

Figure 2: Where cyber risk sits across the property lifecycle.

Product / service	Systems that deliver it	Key cyber and compliance touchpoints
Design and tender	BIM, CAD, common data environments, e-tender portals	Design and tender confidentiality, access reviews, DLP
Construction	Site ERP, progress billing, subcontractor portals, site cameras	Payment and master-data controls, portal testing, site connectivity review
Sale and leasing	CRM, booking portals, broker apps, KYC, lease management	Portal and app testing, DPDP for buyer and tenant data, collection controls
Building OT	BMS, HVAC, lifts, fire, parking, energy	Building system assessment, segmentation, vendor access brokering, OT monitoring
Security systems	CCTV, VMS, cloud video, access control, visitor management	CCTV and access control testing, MeitY ER evidence, surveillance privacy
Operations and FM	CAFM, helpdesk, tenant and member apps, REIT reporting	Platform and API testing, identity controls, SOC monitoring

6. Trends that change the attack surface

Trend	What is changing	Security implication
Smart and green buildings	BMS, IoT sensors, energy analytics and ECBC-driven automation in new assets	Far more building-to-cloud connections and vendor access to secure
Cloud CCTV and access control	Cameras and doors managed through cloud platforms across portfolios	One credential or API flaw exposes every site; MeitY CCTV requirements apply
Proptech and tenant apps	Apps for booking, access, payments, visitors and amenities	Application, API and mobile security become tenant-facing risks
REIT and institutional ownership	Portfolios owned by listed trusts and global investors	Portfolio-wide assurance, SEBI disclosure, investor and lender questionnaires
GCC and enterprise occupiers	Global firms leasing record space with their own security standards	Landlords and FM companies must evidence building security
Regulatory formalisation	CERT-In audit guidelines, DPDP, CCTV essential requirements	Evidence-based assurance replaces informal practice

7. Mapping operations to Codec Networks engagements

If the company operates…	Recommended starting engagement
Buildings with BMS, lifts, CCTV and access control	Building system and security system assessment, segmentation design, vendor access brokering
ERP, CRM and booking portals that sell and collect	ERP and portal security testing, backup and recovery validation, collection controls
Construction sites with running-account billing	Payment fraud controls, BEC simulation, site ERP and portal review
Cloud video or access platforms across many sites	Platform and API testing, identity and credential controls, MeitY ER evidence
Co-working or multi-tenant shared networks	Network segmentation, access control testing, member app and API testing
Buyer, tenant, member or visitor data in volume	DPDP programme, surveillance privacy review, breach playbooks

Talk to Codec Networks

Contact

Codec Networks Pvt. Ltd.

New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001

Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana

Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124

Email: mktg@codecnetworks.com Web: www.codecnetworks.com

Note: Descriptions are general and based on public information available as of October 2026. Systems and exposures differ by building, project and company.