Decide which gaps to address first and what proof to ask IT and vendors for. Ratings cover the next 12 months. They reflect the protections shown in the records we reviewed.
How the review was done
We interviewed the property manager and the office lead, read the records the owner supplied, reviewed vendor answers and watched staff open settings screens on their own computers. We followed the method in NIST SP 800-30 Rev. 1.
This was a consulting review. We tried no logins, scans or tests, collected no passwords and changed nothing.
Systems and data in scope
Leasing office computers and Wi-Fi
Office email accounts
Property management software accounts
Vendor-run online rent payment portal
Gate access control and vendor remote access
Camera recorder and its office network connections
Resident and applicant records
Backups and recovery records
Outside this review
Resident devices and home networks, systems inside vendor businesses, payment processing behind the portal, door hardware and life safety compliance. The existing survey covers physical findings.
What the ratings assume
The supplied records describe the current setup. When a record is missing, we treat that safeguard as unproved. The owner supplied no incident history. Vendor answers and incomplete account lists leave questions open. Each risk says what still needs an answer.
Read the five-level rating scales
How likely is harm?
The chance of an event and harm together, during the next 12 months.
How likely is harm?
Level
Meaning
1Very low
Harm needs an unusual event and several safeguards to fail.
2Low
Harm is possible, but limited access or existing checks make it unlikely.
3Moderate
A plausible event could cause harm through a known gap.
4High
An accessible weakness and few effective checks make harm likely.
5Very high
Harm is expected during routine exposure with almost no effective barrier.
How bad could it be?
The most serious plausible outcome if the event causes harm.
How bad could it be?
Level
Meaning
1Very low
One routine task needs correction, with no sensitive records affected.
2Low
A brief office disruption affects a few tasks or nonsensitive records.
3Moderate
Leasing or access work stops for a day, or a limited record set is exposed.
4High
Several days of disruption, broad resident record exposure or lost access evidence.
5Very high
Prolonged loss of essential operations, widespread record theft or serious safety consequences.
Score = likelihood × impact. Very low is 1 to 3, low is 4 to 6, moderate is 7 to 11, high is 12 to 19, and very high is 20 to 25. We set these cutoffs for this review. NIST doesn't prescribe them, and they aren't measured odds.
Within each level, higher scores come first. Ties follow risk ID order. Tell the owner about safety concerns immediately, whatever the score. Related risks can share a cause, so keep their scores separate.
External exposure
Start with the asset list
The client lists its own domains and public IP addresses in writing. We review public DNS, mail records, certificates and what each listed name answers, using public sources.
Any active test needs written permission that names the assets. For this sample, we reviewed the owner's existing IT test for F09.
Sample property records
The made-up names below stand in for the property's systems. The recorder is the same finding carried from survey F09 into cyber risk R01.
External exposure review for the fictional property
System
Sample result
Next action
Recorder remote access Very high
recorder.property.example 192.0.2.24
The owner's IT test returned the recorder's remote-access service. This is survey F09 and cyber risk R01.
IT removes the unnecessary internet path and repeats the agreed check. The manager keeps the result and approved remote access method.
Property website Low
property.example
Cloudflare serves the site and the certificate is current. No security contact file is published.
IT publishes a security contact file and adds the hosting provider to the asset list.
Property email Moderate
property.example
Incoming mail goes to Microsoft 365 and the approved-senders record is published. The domain only asks receivers to report faked mail, so it still gets delivered.
IT confirms every real sender passes, then asks receivers to quarantine faked mail. This stays separate from the R02 sign-in review.
F09 stays open until IT supplies the repeat check
F09 records reachability. F07 records the installer's default account on the same recorder. The recommendation in R01 remains to close the internet path and replace that account. The supplied evidence establishes no successful login or incident.
Public guidance covers exposed devices, default passwords, older software, fake sign-in requests and file recovery. We checked those threats against the property's account, network and backup records. These sources describe threats in general. They don't show an incident at this property.
3
Risk register
Twelve risks, highest first. Each record explains its rating, gives the owner's choices and shows how to check that the work is complete.
The owner approves each decision. Record the choice, who is responsible, the target date and the proof received. To accept a risk, give a reason and an end date. Keep work open until its completion check is met. Then rate the remaining risk.
R01
Recorder access from the internet
Very high
Likelihood 4 × impact 5 = 20
Systems and data
Camera recorder and recorded footage
Who or what could cause harm
An outside attacker using common account details.
What could happen
An attacker could take control of the recorder, erase footage or stop recording.
What makes it possible
The survey found the recorder answering from the internet (F09) and still using the installer's default admin account (F07). Together they give an outsider a way in.
What we reviewed
The owner's IT person sent a test showing the recorder answers from the internet, and the recorder vendor answered our access questions. We reviewed both and did not try to connect.
Why these ratings
The internet connection makes attempts plausible. The default account makes harm easier. Losing control of the recorder could remove essential evidence. Whether anyone has broken in remains unknown.
What still needs an answer
IT still needs to confirm the current internet connection and any account changes.
Ask IT to remove the internet path the property doesn't need, and have the vendor replace the default account with one account per approved person. Agree first on who can get back in if something goes wrong.
Who is responsible
IT and recorder vendor
When to start or decide
Start today
How to check the work
The manager receives a repeat test from IT, an approved account list and proof that recording and playback still work.
Risk after the work
Rate again after both F07 and F09 are closed. A password change alone leaves the internet connection open.
Compare the owner's choices
Fix itClose internet access and replace the default account.
Reduce itLimit the approved remote connection while preparing the permanent change.
Hand it to a vendor or insurerHave the recorder vendor do the work. The owner approves it and checks the result.
Accept itKeep internet access only with a dated reason from the owner and an end date.
Someone using a stolen email account could read resident messages and send false rent payment instructions.
What makes it possible
The office lead showed that the shared leasing mailbox needs only a password to sign in. Staff said payment changes arrive by email. They have no separate callback check.
What we reviewed
We interviewed the office lead and watched staff open the email security screen on October 21.
Why these ratings
Everyday email gives fraudsters a way to reach staff. A stolen password could open the mailbox. Someone with mailbox access could reach many residents and read payment conversations.
What still needs an answer
The email provider still needs to confirm which sign-in and account recovery options are available.
Our recommendation
Reduce it
Ask IT for sign-in that a fake login page can't capture, such as a security key, and separate access for each staff member. Call back on a known number before changing payment instructions.
Who is responsible
IT and office lead
When to start or decide
Begin within 2 days
How to check the work
IT supplies a report showing how accounts are protected. The office lead shows a recorded payment-change callback exercise using a known contact.
Risk after the work
Rate again after checking sign-in and account recovery. Keep the callback check even with stronger sign-in.
Compare the owner's choices
Fix itEnd the shared password and require stronger sign-in for every office user.
Reduce itUse stronger sign-in, limit access and call back separately about payment changes.
Hand it to a vendor or insurerAsk the email provider which protections it supports and the insurer what the policy covers.
Accept itRecord the fraud and privacy risk that remains and set an owner review date.
Recorder admin accounts and who controls related accounts
Who or what could cause harm
A former staff member or someone using an account left open.
What could happen
Someone with access after leaving could change recorder settings or remove footage.
What makes it possible
The survey checked accounts against staff records and found that departed staff still had admin access. The manager has no completed departure checklist for office systems.
What we reviewed
We reviewed the survey account list, the check against current staff and the manager's departure checklist file.
Why these ratings
An existing admin account gives someone a direct way to make changes. That control could let them remove footage and delay review of an event.
What still needs an answer
Who controls gate and camera accounts still needs an answer. Access to those systems remains unconfirmed.
Check every account against a current role. Ask IT to remove departed staff access and end their signed-in sessions. Keep needed records and confirm who can recover each system before making changes.
Who is responsible
Property manager and IT
When to start or decide
Begin within 2 days
How to check the work
The manager signs one list matching accounts to current roles. IT confirms removed access and ended sessions, with someone assigned to recover each system.
Risk after the work
Rate again once the recorder accounts match current roles and the people responsible for other systems have answered.
Compare the owner's choices
Fix itRemove departed staff access and add a same-day departure checklist.
Reduce itLimit remaining admin rights to approved roles.
Hand it to a vendor or insurerHave each provider supply its account list and check it against current staff.
Accept itRecord each temporary access exception, why it is needed and when it ends.
Office computers, camera network and resident records
Who or what could cause harm
An attacker who already has access to one connected device.
What could happen
One device under attacker control could give access to office systems and resident files.
What makes it possible
The survey network records show cameras, recorder and office computers on one shared network. The owner supplied no approved limits on traffic between them.
What we reviewed
We reviewed the IT network switch export and the marked port list from the survey.
Why these ratings
The shared network and recorder gaps make access to office systems plausible. An attacker there could expose records and interrupt several days of work.
What still needs an answer
IT still needs to confirm device protection and traffic limits. Gate panel connections need separate evidence.
Ask IT for separate networks for cameras and office computers, with only approved traffic between them. Require a plan in stages, steps to undo changes and vendor checks that recording and office work still function.
Who is responsible
IT and the vendors involved
When to start or decide
Plan within 7 days
How to check the work
The manager receives an updated diagram, IT results showing which traffic is allowed and vendor confirmation that required tasks still work.
Risk after the work
Rate again with R01 after the remote connection and network changes. These risks overlap, so keep their scores separate.
Compare the owner's choices
Fix itRemove connections the office and camera systems do not need.
Reduce itAllow only recorded traffic needed for approved work.
Hand it to a vendor or insurerHave IT and the vendors supply the design and proof that the changes work.
Accept itKeep the shared network only with a dated owner exception and review plan.
Leasing records, resident files and office computers
Who or what could cause harm
An attacker locking files, staff deletion or storage failure.
What could happen
Lost files could stop leasing and resident service if the only backup is also damaged or unusable.
What makes it possible
The owner supplied backup job emails but no restore record. The office lead said the backup drive stays attached to the office computer.
What we reviewed
We reviewed the backup job records and interviewed the office lead on October 21.
Why these ratings
File loss is plausible. A backup left attached shares risks with the computer. If files cannot be restored, essential office work could stop for longer.
What still needs an answer
IT still needs to show which files are backed up, how copies are kept separate and how long recovery takes.
Our recommendation
Reduce it
Ask IT to confirm what is backed up, protect a separate copy and show that selected files can be restored in a controlled exercise. Agree how long the office can work without each system.
Who is responsible
IT and property manager
When to start or decide
Within 7 days
How to check the work
The manager watches IT restore selected files from a separate copy. IT supplies the dates, the files covered and the time recovery took.
Risk after the work
Rate again after the restore exercise. A backup job email still leaves file recovery unproved.
Compare the owner's choices
Fix itReplace the unproved backup setup with a recovery process the owner has checked and approved.
Reduce itProtect a separate copy and prove that the most needed records can be restored.
Hand it to a vendor or insurerSet backup duties with the provider and ask the insurer what business interruption the policy covers.
Accept itApprove how much recent work could be lost and how long systems could be down. Set an end date.
Someone using a gate vendor's remote account left open between visits.
What could happen
Unauthorized changes could disrupt entry or alter who can use the gates.
What makes it possible
The gate vendor said its remote account remains enabled between visits. The manager could not supply an approved user list, access expiry or remote session record.
What we reviewed
We reviewed the vendor questionnaire and owner access records on October 21. We did not try to connect to the gates.
Why these ratings
An account left open gives someone a plausible way in. How it is protected remains unproved. Gate changes could disrupt resident entry across the property.
What still needs an answer
The vendor still needs to explain remote sign-in protection, network connections and safe emergency operation.
Our recommendation
Reduce it
Require one account per approved vendor user, agreed access times, stronger sign-in and records of remote sessions. Have the gate vendor confirm safe operation before changing access.
Who is responsible
Property manager and gate vendor
When to start or decide
Within 7 days
How to check the work
The manager receives the vendor user list, approved access times and end dates, and results showing that the gates work safely after the change.
Risk after the work
Rate again after the vendor answers and supplies its check results. Gate network connections need their own evidence.
Compare the owner's choices
Fix itEnd always-on remote access if the vendor can use another approved way to do the work.
Reduce itApprove short access periods and keep a record of each remote session.
Hand it to a vendor or insurerPut access, notice and account removal duties in the vendor agreement.
Accept itApprove an exception with an end date, a responsible role and extra checks.
A staff member sharing a link by mistake or someone who should not receive it.
What could happen
An open file link could expose application documents beyond the leasing team.
What makes it possible
Staff showed a folder setting that lets anyone with the link view applicant uploads. The owner supplied no schedule for how long to keep rejected applications.
What we reviewed
We reviewed the office lead's sharing screen and the owner's document policy file on October 21. We did not open resident documents.
Why these ratings
Everyday link sharing and access for anyone with the link make exposure likely. The folder shown covers a limited set of applications. Wider exposure remains unconfirmed.
What still needs an answer
The owner still needs to check how many files there are, what sensitive details they hold and who else received them.
Our recommendation
Fix it
Have IT limit links to approved roles. Ask the owner to approve how long files are kept and how they are removed, after checking business and legal needs.
Who is responsible
Office lead and IT
When to start or decide
Within 7 days
How to check the work
The manager sees the revised access report, the owner-approved schedule for keeping files and a record of expired links being removed.
Risk after the work
Rate again after checking the file list. Whether earlier copies were recovered still needs proof.
Compare the owner's choices
Fix itRemove open links and approve who may read each folder.
Reduce itLimit new uploads and check existing links and how long files need to be kept.
Hand it to a vendor or insurerAsk the platform vendor for proof of sharing and file removal settings. Check privacy coverage separately.
Accept itRecord any sharing exception, why it is needed and when it ends.
A leasing account could export more resident information than staff need for their work.
What makes it possible
The manager showed that every leasing user can export resident records in bulk. The owner supplied no approved list matching account permissions to staff tasks.
What we reviewed
We watched staff open the software account settings and reviewed owner access policy records on October 21.
Why these ratings
The export option makes misuse or a mistake plausible. The screen showed one export process. Wider admin access remains unconfirmed.
What still needs an answer
The vendor still needs to confirm what exports contain, which protections apply and the full list of account roles.
Our recommendation
Reduce it
Approve the tasks each role needs. Ask the software vendor to limit bulk exports and supply a report of approved permissions and past exports.
Who is responsible
Property manager and software vendor
When to start or decide
Within 14 days
How to check the work
The manager signs a list matching permissions to tasks and sees the vendor's permission report and a check of an approved task.
Risk after the work
Rate again once export contents and limits are confirmed. Include necessary exports in the records review.
Compare the owner's choices
Fix itRemove bulk export rights that leasing staff do not need.
Reduce itRequire approval and review for exports that staff still need.
Hand it to a vendor or insurerHave the software vendor apply the approved account roles and record their limits.
Accept itRecord each broader permission, why the work needs it and its review date.
Recorder software and the camera connections it needs
Who or what could cause harm
An attacker using an uncorrected software weakness.
What could happen
An uncorrected flaw could interrupt recording or allow unapproved changes.
What makes it possible
The survey showed an older recorder version than the supplied release summary. Support status and whether an update would work with this setup remain unproved.
What we reviewed
We reviewed the version screen staff showed and the release summary the owner supplied for the survey.
Why these ratings
Whether this version has a flaw an attacker can use remains unknown. That uncertainty supports a lower likelihood. Recorder failure could still lose important evidence.
What still needs an answer
The vendor still needs to confirm the model, support status, relevant security fixes and what connected equipment needs.
Request support and release records for this model. Have the vendor propose any needed update, checks that it works with the cameras, a backup, steps to undo it and playback checks.
Who is responsible
IT and recorder vendor
When to start or decide
Within 14 days
How to check the work
The manager receives model and support records, the vendor's approved version decision and recording and playback results after any change.
Risk after the work
Rate again using confirmed support records. A flaw still needs evidence beyond the version date.
Compare the owner's choices
Fix itHave the vendor resolve a confirmed support or security gap.
Reduce itLimit access while the vendor checks how to update safely.
Hand it to a vendor or insurerHave the provider supply support records and proof that any change works.
Accept itRecord why a confirmed gap remains and when the owner will review it.
Vendor-run rent payment portal and payment records
Who or what could cause harm
A service failure at the portal vendor or a company it depends on.
What could happen
Residents could be unable to pay online and staff could lose a reliable view of pending payments.
What makes it possible
The part of the vendor agreement supplied sets no recovery target. The manager supplied no approved resident notice or process to check payment records during an outage.
What we reviewed
We reviewed the contract pages, vendor answers and office procedure file supplied by the owner on October 21.
Why these ratings
An outage is possible. Whether the service has reliability problems remains unproved. Several days without a clear payment record could disrupt resident service and payment checks.
What still needs an answer
The vendor still needs to answer in writing about recovery targets, backups, companies it depends on and who must notify the owner.
Our recommendation
Hand it to a vendor or insurer
Request written terms for recovery, notices, data exports and ending the service. Have the manager approve how to contact residents and check payment records during an outage. Ask the insurer what business interruption the policy covers.
Who is responsible
Owner and payment portal vendor
When to start or decide
Within 14 days
How to check the work
The owner receives the vendor recovery and export answers, an approved outage procedure and a record of staff walking through it together.
Risk after the work
Rate again after reviewing vendor answers. Service disruption remains possible after contract and insurance changes.
Compare the owner's choices
Fix itChoose a supported payment process with an approved backup plan.
Reduce itPractice resident notices and payment checks using approved records.
Hand it to a vendor or insurerSet written vendor recovery duties and confirm what insurance covers. The owner keeps responsibility for checking the result.
Accept itApprove how long the property can work without the portal and record the vendor answers still needed.
A visitor connecting a personal device to the office wireless network.
What could happen
A visitor device could reach office systems if the guest network is not kept separate.
What makes it possible
The manager showed a separate guest network name. IT supplied no record proving it is separate from the office network. The office lead said visitors use the guest sign-in posted at the desk.
What we reviewed
We reviewed the Wi-Fi screen staff showed, interviewed the office lead and read supplied network records on October 21.
Why these ratings
Visitors regularly connect to guest Wi-Fi. Whether they can reach the office network remains unproved, which keeps likelihood low. Access to an office device could interrupt a day's work.
What still needs an answer
IT still needs to prove that the guest and office networks are separate beyond having different names.
Our recommendation
Reduce it
Ask IT for the guest network design and an agreed connection check carried out by IT. Keep visitor access separate from office systems and record who is responsible for approved access.
Who is responsible
IT and property manager
When to start or decide
Within 14 days
How to check the work
The manager receives the IT network diagram and results showing that guest access is kept separate. Required office work stays available.
Risk after the work
Rate again using IT evidence. Our review includes no scans, connection attempts or control of devices.
Compare the owner's choices
Fix itHave IT correct any confirmed gap between guest and office networks.
Reduce itPause guest access if IT cannot promptly prove it is kept separate.
Hand it to a vendor or insurerHave the network provider supply its design and proof that it works.
Accept itApprove any unresolved connection between the networks with a reason and end date.
Every three months, led by the property manager and approved by the owner.
Check open actions each month. When work is complete, keep the proof and update likelihood, impact and the owner's decision. Ask IT and vendors for fresh records before reducing a rating.
Re-check earlier when
A staff member leaves or changes duties
A vendor changes, renews or ends its access
A gate, camera, email or payment system changes
A suspected account misuse, data loss or outage is reported
A vendor warns of a relevant weakness or ends support
An attacker could take control of the recorder, erase footage or stop recording.
Our recommendation
Ask IT to remove the internet path the property doesn't need, and have the vendor replace the default account with one account per approved person. Agree first on who can get back in if something goes wrong.
Someone using a stolen email account could read resident messages and send false rent payment instructions.
Our recommendation
Ask IT for sign-in that a fake login page can't capture, such as a security key, and separate access for each staff member. Call back on a known number before changing payment instructions.
Someone with access after leaving could change recorder settings or remove footage.
Our recommendation
Check every account against a current role. Ask IT to remove departed staff access and end their signed-in sessions. Keep needed records and confirm who can recover each system before making changes.
One device under attacker control could give access to office systems and resident files.
Our recommendation
Ask IT for separate networks for cameras and office computers, with only approved traffic between them. Require a plan in stages, steps to undo changes and vendor checks that recording and office work still function.
Lost files could stop leasing and resident service if the only backup is also damaged or unusable.
Our recommendation
Ask IT to confirm what is backed up, protect a separate copy and show that selected files can be restored in a controlled exercise. Agree how long the office can work without each system.
Unauthorized changes could disrupt entry or alter who can use the gates.
Our recommendation
Require one account per approved vendor user, agreed access times, stronger sign-in and records of remote sessions. Have the gate vendor confirm safe operation before changing access.
An open file link could expose application documents beyond the leasing team.
Our recommendation
Have IT limit links to approved roles. Ask the owner to approve how long files are kept and how they are removed, after checking business and legal needs.
An uncorrected flaw could interrupt recording or allow unapproved changes.
Our recommendation
Request support and release records for this model. Have the vendor propose any needed update, checks that it works with the cameras, a backup, steps to undo it and playback checks.
Residents could be unable to pay online and staff could lose a reliable view of pending payments.
Our recommendation
Request written terms for recovery, notices, data exports and ending the service. Have the manager approve how to contact residents and check payment records during an outage. Ask the insurer what business interruption the policy covers.
A visitor device could reach office systems if the guest network is not kept separate.
Our recommendation
Ask IT for the guest network design and an agreed connection check carried out by IT. Keep visitor access separate from office systems and record who is responsible for approved access.