Shield Your Property Data: Security Checklist for Owners

Property management depends on information: applications, leases, contact details, payment records, maintenance notes, vendor documents, bank information, and owner reports. The owner should ask how the company identifies sensitive data, limits access, detects problems, responds, and restores records after an incident.

The National Institute of Standards and Technology organizes the Cybersecurity Framework 2.0 around six functions: Govern, Identify, Protect, Detect, Respond, and Recover. The Federal Trade Commission's business guidance adds concrete lessons such as collecting only information the business needs, controlling access, using secure authentication, protecting information in storage and transit, segmenting networks, securing remote access, and requiring reasonable safeguards from service providers. Together, these sources provide a useful structure for owner diligence.

1. Govern: assign responsibility and set the rules

• Who is accountable for security policy, access decisions, vendor review, incident response, and owner communication?
• Which legal, contractual, insurance, and platform requirements apply?
• How are exceptions documented, reviewed, and closed?
• How often are policies, risk assessments, and response contacts reviewed?

Governance should cover both technology and operations. Shared accounts, excessive permissions, uncontrolled exports, and unclear offboarding can create risk even when the software has strong safeguards. Assign a person to each access review and corrective action, and record the due date and result.

2. Identify: know the data and where it moves

Create an inventory of sensitive information, systems, user roles, devices, integrations, and vendors. Map how information enters the business, where it is stored, who can reach it, where copies are exported, and how it is deleted. The FTC advises businesses not to collect and retain personal information without a legitimate need. Less unnecessary data means less information to protect.

Prioritize the systems that support money movement, identity information, lease records, and privileged administration. Document the operational effect if each system is unavailable or altered. This gives the team a basis for protection and recovery priorities.

3. Protect: limit access and reduce avoidable exposure

• Give each user an individual account and only the access needed for the role.
• Use available multifactor authentication and strong authentication practices.
• Review access when a person changes roles and remove it promptly at departure.
• Protect sensitive data during storage and transmission.
• Keep software, endpoints, and network controls maintained.
• Train staff to recognize phishing, unusual payment requests, and unsafe handling.

Property management platforms are part of this review. AppFolio's trust page describes its own security teams, continuous monitoring, incident-response practices, data protection, security testing, authentication, identity-verification services, transaction monitoring, infrastructure controls, and data governance. Owners should treat these as first-party descriptions and request current documentation appropriate to their risk and configuration.

4. Detect: make unusual activity visible

Ask what logs, alerts, and reports are available for failed sign-ins, permission changes, exports, payment changes, or other high-risk events. Decide who reviews them and what triggers investigation. Ask for the person who reviews an alert, the escalation trigger, and a recorded disposition.

5. Respond: prepare before an incident

Maintain an incident-response plan with current contacts, escalation criteria, legal and insurance notification paths, system-isolation steps, evidence-preservation instructions, and communication authority. Run a tabletop exercise using a property-management scenario, such as a compromised mailbox or unauthorized vendor-payment change. Record gaps and assign corrective work.

6. Recover: verify restoration and improve

Backups should be appropriate to the systems and data involved, protected from unauthorized change, and tested through restoration. Recovery also includes rebuilding access, validating records, communicating accurately, and updating controls after the event. A backup that has never been tested is not the same as a demonstrated recovery process.

Questions owners can ask a management company

1. Show how sensitive data and user access are inventoried, reviewed, and removed.
2. Explain how platform and service-provider safeguards are evaluated.
3. Show who reviews alerts and how an incident is escalated to the owner.
4. Describe the most recent restoration test and how its result was recorded.

A useful sample is a redacted offboarding record with the role, access removed, reviewer, and date. It shows the process without exposing credentials or tenant data.

Put these security questions alongside the commercial and multifamily service scope, then request direct evidence for the controls that matter to your property.

Primary sources

• NIST Cybersecurity Framework 2.0 for Small Business
• FTC: Start with Security, A Guide for Business
• AppFolio Trust

Contact Coastline Equity to discuss management controls and reporting for your property.

Security requirements vary by organization, system, contract, and data type. Ask for current evidence and qualified advice when needed.