How secure is the smart building? IoT from the basics to the IT-Label inspection

First the basics: what is IoT in a building?

IoT stands for Internet of Things: devices that measure, switch and send data over a network. In an office building, there are often hundreds of them. For example:

• sensors that measure if a room is in use, and how warm or stuffy it is;
• the building management system that controls heating, cooling, ventilation and lighting;
• access gates, card readers and smart locks;
• cameras and the recorder that stores the images;
• lifts, sun shading and charging points in the car park;
• smart meters and the inverters of solar panels;
• printers, meeting room screens and booking systems.

Together, they make a building comfortable, energy efficient and easy to manage. You can read how this works in IoT in real estate: a smart building explained simply. This article is about a different question: how secure is all of this?

Why IoT is vulnerable

A laptop gets updates every month and the IT department manages it. With smart devices in a building, this is often different. The most common weak points:

• Default passwords. Many devices come with a password such as "admin". This is not always changed during installation.
• No updates. The manufacturer releases updates, but nobody installs them. Or the manufacturer stops the updates after a few years.
• A long life. A building and its installations often last twenty years. The software of a device is often out of date much sooner.
• No owner. The installer puts in the device, the facilities team uses it and the IT department does not know about it. Nobody feels responsible.
• One shared network. Cameras, sensors and laptops are all on the same network. A weak device then becomes a door to the rest.
• Remote access. Suppliers log in from outside for maintenance. If that access is badly secured, someone else can also use it.
• Out of sight. Devices are in ceilings, technical rooms and cabinets. What you do not see, you also do not check.

What can go wrong?

Two well-known examples show what can happen.

Mirai, 2016. In October 2016, large websites such as Twitter, Netflix and Spotify were hard to reach for hours. The attack came from hundreds of thousands of cameras, recorders and routers that attackers had taken over. The attackers got in with a short list of default passwords. The owners of the devices did not notice anything.

Target, 2013. At the end of 2013, at the American retail chain Target, criminals stole the data of about 40 million payment cards. The criminals got in with the login details of a supplier of climate installations. That supplier had access to the network for maintenance. From there, the criminals could go further into the network.

The lesson of both examples: the risk is not only in the device, but in how it is connected, who has access and if someone keeps an eye on it.

What do the rules say?

Lawmakers also look more and more at smart devices:

• Cyber Resilience Act. This European law sets requirements for products with software, such as secure default settings and updates. Since 11 September 2026, manufacturers must report flaws that are actively abused. From 11 December 2027, all requirements apply. Read more in Cyber Resilience Act: what does the CRA mean for real estate?
• European requirements for wireless devices. Since 1 August 2025, new wireless devices with an internet connection must meet security requirements, for example on passwords.
• The Dutch Cybersecurity Act (Cyberbeveiligingswet). Since 15 August 2026, this law asks many organisations to secure their network and information systems, also the physical environment they are in. Read more in Cybersecurity Act and the digital building layer.

The new rules apply mainly to new products. The devices that are already in a building stay the responsibility of the owner and the user.

How an IT-Label inspection looks at IoT

What does this look like in practice? We walk through an imaginary office building with four floors, a few tenants, a car park and a building management system. This is an example, not a report of a real inspection. The steps show what an inspector looks for.

Step 1: the overview

The inspector starts with a question to the building manager: which smart systems are there, and who manages them? In our example, there is a list of the installations, but the cameras in the car park and the charging points are not on it. Another supplier put these in later. A full overview is the basis of everything: what is not on the list, does not get updated.

Step 2: the network

Do the building systems have their own network, separate from the office network, the guests and the other tenants? In our example, the building management system has its own network. But the meeting room screens and the printers of one tenant are on the same network as the laptops. That is a point to look at.

Step 3: physical access

Are the control cabinets, the camera recorder and the network cabinets locked? Are there devices that anyone can get to? In our example, the camera recorder is in an open cabinet in the bicycle storage. A locked cabinet or a different place solves this.

Step 4: remote access

How do suppliers log in for maintenance? Is this agreed, secured and recorded? And can this access be switched off when it is not needed? In our example, the installer of the climate system has a fixed connection that is always open. Nobody knows exactly who uses it.

Step 5: passwords and updates

Were the default passwords changed? Is there an agreement on who installs updates, and how often? In our example, the passwords of the building management system were changed, but those of the charging points were not. There is no agreement on updates.

Step 6: power and outages

What still works when the network or the power fails? Do the doors then open or stay closed? Can people still get in and out of the building? In our example, the access gates run on emergency power, but the network switch that controls them does not.

Step 7: recording

Is everything in the documentation? And does the demarcation list record who is responsible for what: the owner, the tenant or the supplier? This prevents a problem from getting stuck between two parties.

At the end of the round, the owner knows what goes well and what can be better. In our example, the improvements are simple: the missing devices on the list, a separate network for the tenant's devices, a lock on the cabinet, a better agreement with the installer and new passwords.

Ten questions for owner and tenant

Do you want to start yourself? Go through these questions with your building manager or IT partner:

1. Is there a list of all smart systems in the building?
2. For each system, is it known who manages it?
3. Do the building systems have their own network?
4. Are tenants and guests separate from the building systems?
5. Were all default passwords changed?
6. Is there an agreement on updates?
7. Do the devices still get updates from the manufacturer?
8. How do suppliers log in, and can this access be switched off?
9. Are control cabinets, recorders and network cabinets locked?
10. What still works when the network or the power fails?

Can you not answer a question? Then you know where to start.

Frequently asked questions

Is a smart building less secure than a normal building?

Not by itself. A smart building has more devices on the network, so there are more places to watch. With a separate network for the building systems, good passwords, updates and clear agreements, you can secure a smart building well.

Who is responsible for the IoT systems: the landlord or the tenant?

That depends on the agreements. Often the owner is responsible for the building systems, such as climate and access, and the tenant for their own devices. Record this in a demarcation list, so that nothing gets stuck between two parties.

Must the building management system have its own network?

We strongly recommend it. A separate network prevents a problem on the office network from also affecting the climate or the access of the building, and the other way around.

Does the Security Audit also look at cameras and sensors?

Yes. The IT-Label Security Audit looks at printers, cameras and other devices that are on the network without protection or without anyone knowing. It also looks at whether the office network is separate from the building systems, such as access and climate.

Does IoT count for the IT-Label?

The IT-Label rates a building in six areas: connectivity, infrastructure, performance, scalability, integration and Smart Building. Smart building systems are part of integration and Smart Building. The IT-Label looks at the digital infrastructure that these systems run on.

Start with the basics

Smart systems make a building better, if the basics are in order. Do you want to know how secure the IT and the smart systems in your office are? Request a Security Audit. Do you want to know where your building stands digitally? Start with a pre-inspection. And do you want someone to keep a constant eye on the IT of your building? Read more about IT-Label Smart Control.

Sources: European Commission, Cyber Resilience Act; Dutch National Cyber Security Centre; CISA, on Mirai.