Short answer: secure property management software should give each person only the access required for current work, require strong authentication, preserve evidence of important actions, control integrations and exports, and remove access promptly when responsibilities change. Review the controls as a connected operating process, not as a one-time settings exercise.
CISA recommends multifactor authentication for remote and privileged access and favors phishing-resistant methods where practical. Its hardening guidance also emphasizes role-based access, least privilege, account review, and session control. AppFolio describes MFA, role-based access, encryption, and monitoring in its security guidance, while Buildium documents configurable user roles and account settings. This independent checklist is educational and does not certify JHA Solutions or another product against a security, privacy, insurance, contractual, or regulatory standard.
Start with the property-management data map
List the information the system holds and where it moves: owner records, resident contact details, leases, applications, maintenance photos, access instructions, vendor documents, financial records, reports, exports, messages, and connected services. Assign a business owner to each data group. A permission review cannot be meaningful when nobody knows which records are sensitive or who should approve access.
Build roles around work, not job titles
Define the minimum actions needed for leasing, maintenance, accounting, field operations, ownership reporting, and administration. Separate viewing, creating, editing, approving, exporting, deleting, inviting users, changing billing, and managing integrations. A cleaner may need property access instructions and turnover tasks but not resident screening or owner banking records. A vendor may need assigned work orders but not the full portfolio.
Protect privileged and remote access
Require MFA for administrators and remote access, then expand it to all supported accounts. Prefer phishing-resistant authentication where the platform and operating environment permit it. Keep emergency recovery methods controlled, document who can use them, and test recovery before an actual lockout. Shared administrator accounts destroy accountability and should be replaced with named access.
Control the account lifecycle
Every account should have an owner, approved role, creation date, last activity, review date, and status. Use a joining, changing, and leaving process: approve new access, revise it when duties change, and revoke sessions, tokens, integrations, shared links, and physical access when a relationship ends. Review privileged accounts more often than ordinary accounts.
Review integrations and service accounts
Calendar feeds, email senders, payment systems, listing channels, automation tools, APIs, and browser extensions can hold access after the employee who configured them leaves. Record the integration owner, purpose, permissions, credential location, rotation method, last use, and removal plan. Disable abandoned connections instead of assuming inactivity makes them harmless.
Preserve an audit trail for consequential actions
Log sign-ins, role changes, exports, deletions, approvals, payment or payout changes, document access, integration changes, and security-setting changes where the product supports them. Logs need protected timestamps, actor identity, target record, action, and result. Decide how long evidence is retained based on business, contractual, insurance, and legal requirements.
Download the access-control review
Download the editable software security and access-control checklist (CSV). It records control ownership, evidence, test frequency, findings, action owners, due dates, and approval. Replace its examples with a reviewed policy before relying on it.
Test exports, backups, and recovery
An available export button is not a recovery plan. Export representative properties, leases, contacts, transactions, work orders, files, and audit records; verify completeness and readability; protect the resulting files; and document restoration responsibilities. Pair this review with the software data export and exit checklist so security and portability are tested together.
Prepare for an incident before one occurs
Define how staff report a suspicious sign-in, lost device, exposed link, incorrect recipient, malicious attachment, or unusual export. Name the person who can disable access, preserve evidence, contact providers, assess notification duties, and communicate internally. Do not improvise legal notification decisions from a generic internet checklist.
Evaluate software with a repeatable test
During a product review, create realistic roles and try to exceed them. Test session revocation, MFA recovery, export permissions, shared links, integration removal, and audit visibility. Use the five-workflow software demo test and the implementation checklist to include security in selection and rollout rather than postponing it until after launch.
Frequently asked questions
Does every property manager have to follow the FTC Safeguards Rule?
No universal conclusion should be drawn from the business label alone. The rule applies to covered financial institutions based on their activities and circumstances. Obtain qualified legal advice about scope. Its risk-assessment concepts may still be useful as a control reference without claiming applicability or compliance.
How often should access be reviewed?
Review access whenever a role changes or a relationship ends. Many teams also perform a scheduled quarterly review, with more frequent checks for privileged, financial, export, and integration access. Choose and document a cadence appropriate to the risk.