Cyber Essentials for Housing Associations and Their Suppliers

Why the sector is exposed

• Tenant records combining identity, financial and safeguarding information.
• Housing management and repairs systems connected to contractor portals.
• Large mobile workforces using tablets and phones in the field.
• Long contractor supply chains where security maturity varies widely.
• Public funding and local authority relationships that carry their own assurance expectations.

Where Cyber Essentials fits

The five control areas map directly onto the sector's real risks: enforced MFA stops the credential-phishing route into housing management systems, patching closes the vulnerabilities used against remote access, and secure configuration covers the field devices that are easiest to lose.

Mobile and field workers

Operatives' tablets and phones are in scope wherever they access work data. That means auto-lock, supported operating systems, malware protection appropriate to the platform, and either mobile device management or a documented BYOD policy. This is the most common scoping gap we see – see BYOD rules and remote workers.

If you are a supplier to housing associations

• Repairs, maintenance, grounds and compliance contractors are routinely asked for Cyber Essentials at onboarding.
• Software and hosting suppliers holding tenant data are often asked for Cyber Essentials Plus.
• Certificate scope must cover the field teams and the systems used on the contract, not just the office.

More context in Cyber Essentials for supplier onboarding.

Cost, timescale and next step

• Cyber Essentials £320 + VAT, priced by organisation size.
• 24 to 48 hours when prepared; two to four weeks with an MFA or device clean-up first.
• Cyber Essentials Plus £1,400 + VAT where a buyer or board requires audited evidence.

Organisations wanting governance depth beyond technical controls, including risk management and business continuity, should look at IASME Cyber Assurance.