An ISMS-Oriented Architecture for Intelligent Property Management Based on ISO/IEC 27001:2022
DOI:
https://doi.org/10.5281/zenodo.22854580Keywords:
Information Security Management System (ISMS), ISO/IEC 27001:2022, intelligent property management, information security governance, IT/OT/IoT integration, audit evidenceAbstract
The digital transformation of property management has led to the increasing integration of information technology (IT), operational technology (OT), and Internet of Things (IoT) devices. However, information security management in property enterprises is often separated from daily business processes and relies heavily on manual documentation, resulting in fragmented asset management, inefficient security control implementation, and difficulties in collecting and tracing audit evidence. To address these issues, this study proposes an Information Security Management System (ISMS)-oriented architecture for intelligent property management based on ISO/IEC 27001:2022. A standard–process–function mapping method is introduced to transform information security requirements into executable business workflows and system functions. The proposed architecture integrates asset and risk management, security control implementation, supplier and outsourcing management, incident response, audit evidence management, and security metrics within a unified framework. Particular attention is given to the integrated governance of IT, OT, and IoT assets and to the traceability of security activities throughout property management processes. A prototype system is further designed to demonstrate the implementation of the proposed architecture, and functional verification is used to examine its feasibility in typical property management scenarios. The proposed approach provides a systematic method for embedding ISMS requirements into intelligent property management systems and offers a practical reference for property enterprises seeking to improve security governance, audit readiness, and continuous improvement capabilities.
Downloads
References
Affia, A. O., Nolte, A., & Matulevičius, R. (2023). IoT security risk management: A framework and teaching approach. Informatics in Education, 22(4), 555–588. https://doi.org/10.15388/infedu.2023.30
Bagaa, M., Taleb, T., Bernabe, J. B., & Skarmeta, A. (2020). A machine learning security framework for IoT systems. IEEE Access, 8, 114066–114077. https://doi.org/10.1109/ACCESS.2020.2996214
Fagan, M., Megas, K. N., Scarfone, K., & Smith, M. (2020). IoT device cybersecurity capability core baseline (NISTIR 8259A). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.IR.8259A
Graveto, V., Cruz, T., & Simões, P. (2022). Security of building automation and control systems: Survey and future research directions. Computers & Security, 112, 102527. https://doi.org/10.1016/j.cose.2021.102527
International Electrotechnical Commission. (n.d.). IEC 62443 series: Security for industrial automation and control systems.
International Organization for Standardization & International Electrotechnical Commission. (2022a). ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection—Information security management systems—Requirements. ISO.
International Organization for Standardization & International Electrotechnical Commission. (2022b). ISO/IEC 27002:2022 Information security, cybersecurity and privacy protection—Information security controls. ISO.
International Organization for Standardization & International Electrotechnical Commission. (2022c). ISO/IEC 27005:2022 Information security, cybersecurity and privacy protection—Guidance on managing information security risks. ISO.
Kumar, A., Sharma, S., Goyal, N., Singh, A., Cheng, X., & Singh, P. (2021). Secure and energy-efficient smart building architecture with emerging technology IoT. Computer Communications, 176, 207–217. https://doi.org/10.1016/j.comcom.2021.06.003
Li, G., Ren, L., Fu, Y., Yang, Z., Adetola, V., Wen, J., Zhu, Q., Wu, T., Candan, K. S., & O'Neill, Z. (2023). A critical review of cyber-physical security for building automation systems. Annual Reviews in Control, 55, 237–254. https://doi.org/10.1016/j.arcontrol.2023.02.004
Llaria, A., Dos Santos, J., Terrasson, G., Boussaada, Z., Merlo, C., & Curea, O. (2021). Intelligent buildings in smart grids: A survey on security and privacy issues related to energy management. Energies, 14(9), 2733. https://doi.org/10.3390/en14092733
Minoli, D., Sohraby, K., & Occhiogrosso, B. (2017). IoT considerations, requirements, and architectures for smart buildings—Energy optimization and next-generation building management systems. IEEE Internet of Things Journal, 4(1), 269–283. https://doi.org/10.1109/JIOT.2017.2647881
National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0. National Institute of Standards and Technology.
Qureshi, A., Afaqui, M. S. I., & Salas, J. (2021). IoTFC: A secure and privacy preserving architecture for smart buildings. In D. Wang, W. Meng, & J. Han (Eds.), Security and privacy in new computing environments (pp. 102–119). Springer. https://doi.org/10.1007/978-3-030-66922-5_7
Wendzel, S., Tonejc, J., Kaur, J., & Kobekova, A. (2018). Cyber security of smart buildings. In H. Song, G. Fink, & S. Jeschke (Eds.), Security and privacy in cyber-physical systems: Foundations, principles, and applications. Wiley. https://doi.org/10.1002/9781119226079.ch16
Downloads
Published
Data Availability Statement
Acknowledgements
This work was supported by the 2025 Scientific Research Project of Wuhan Vocational College of Software and Engineering (Project No. SEA2025006).
Conflicts of Interest
The author declares no conflict of interest.
Data Availability
The data generated during the functional verification of the prototype are not publicly available because they contain internal system and operational information. Further information may be available from the corresponding author upon reasonable request.
Issue
Section
License
Copyright (c) 2026 Xiaoxue Yang (Author)
This work is licensed under a Creative Commons Attribution 4.0 International License.
