Cyber Essentials for housing associations
Who asks housing associations for the certificate, which level to choose, what to gather first, the scope problems the sector brings and the questions it commonly fails.
- Mandated by
- No formal mandate; customer and funder requirements
- Typical scope
- Tenant portals, Repairs operatives' tablets, Housing management systems, Contractors with system access
- Cyber Essentials
- From £1,500, 1 to 2 weeks, IASME fee included
- Cyber Essentials Plus
- From £3,000, 2 to 5 weeks
The Regulator of Social Housing does not mandate Cyber Essentials. Its Governance and Financial Viability Standard requires an effective risk management and internal controls framework, and the certificate is one recognised way to evidence a cyber baseline to the board. Scope covers the housing management system, tenant portals, repairs operatives' devices and every office and home-working device.
Do housing associations need Cyber Essentials?
Not formally. Not mandated by the Regulator of Social Housing. Board assurance, partners' contract terms and central government or NHS contracts under PPN 014 drive demand.
Regulator of Social Housing
Source checkedThe Governance and Financial Viability Standard requires registered providers to have an effective risk management and internal controls assurance framework. It does not name Cyber Essentials (checked 3 November 2026).
Whatever the source, the contract, grant or tender is what binds you. Read it for the level it names, the scope it expects and the date the certificate must be in place, and record the reason at A1.10 when you apply.
Do housing associations need Cyber Essentials or Cyber Essentials Plus?
Cyber Essentials gives the board a recognised baseline. Plus adds independent testing, which audit committees often prefer to a self-declaration, and suits providers with large field estates.
Both levels use the same five controls and the same question set. Plus adds an independent audit of a sample of devices and cloud accounts, on the same scope as a valid Cyber Essentials certificate. Compare the two levels.
What should housing associations gather before starting?
Most of the self-assessment is describing your estate accurately. Have these to hand before you open the question set and the answers take hours, not weeks.
- The housing management system version and where it runs, plus the repairs, asset and finance systems that connect to it (A2.7, A2.9).
- The tenant portal or app, how tenants sign in, and the brute-force protection in place (A5.4, A5.5, A5.7).
- A list of field devices used by repairs operatives and housing officers, with operating system versions and locking settings (A2.8, A5.9).
- Repairs contractors and other partners with accounts on your systems, and when each account ends (A7.3).
- The office and scheme sites with their own internet connections, including sheltered and supported housing offices (A2.3, A2.5).
What scope problems do housing associations bring?
Scope must cover every device and cloud service that reaches organisational data, or a sub-set segregated by a firewall or VLAN that you can justify. These are the boundaries this sector tends to get wrong.
Tenant portals
Self-service portals are external services that need MFA or brute-force protection and a process for changing compromised passwords.
Repairs operatives' tablets
Field devices without locking, or on Android versions the manufacturer no longer patches.
Housing management systems
On-premises housing management systems on ageing Windows Server or SQL Server.
Contractors with system access
Repairs contractors with accounts on the housing management system need MFA and removal at contract end.
Which questions do housing associations commonly fail?
Questions housing associations commonly fail include A5.9, A6.1 and A5.5. This is a typical pattern from assessor experience, not a statistic, but it is worth planning around.
| Question | Why it fails | Fix |
|---|---|---|
| A5.9When a device requires a user to have the device in hand, do you set a locking mechanism on your devices to access the software and services installed? | Field operatives' devices without a screen lock are a common finding in housing assessments. | Enforce a PIN or password of at least 6 characters through device management on every field device and report on compliance. |
| A6.1Are all operating systems on your devices supported by a vendor that produces regular security updates and vulnerability fixes? If you have included firewall or router devices in your scope, the firmware of these devices is considered to be an operating system and needs to meet this requirement. | Housing management servers past end of support. | Upgrade the server or move to the vendor's hosted edition. An unsupported server cannot stay in scope with internet access. |
| A5.5If yes to question A5.4, which authentication option do you use? A. Multi-factor authentication, with a minimum password length of 8 characters and no maximum length B. Automatic blocking of common passwords, with a minimum password length of 8 characters and no maximum length C. A minimum password length of 12 characters and no maximum length D. Passwordless, please describe E. None of the above, please describe | Tenant portals with password-only sign-in and no throttling. | Enable MFA where the portal supports it; otherwise throttle to no more than 10 guesses in 5 minutes or lock after no more than 10 failed attempts. |
Frequently asked questions
Usually. A5.4 asks whether you run or host external services that give users across the internet access to data that should not be public, and a portal showing rent accounts or repairs history does. A5.5 then asks which authentication option protects it, and A5.7 which brute-force protection applies when MFA is not used.
Devices your organisation owns and lends to a contractor are in scope. Contractor-owned devices are out of scope under the v3.3 third-party devices table, but any account your organisation owns is in scope even when a contractor uses it, so contractor sign-ins to the housing management system need MFA and removal when the contract ends.
It covers every device, network, user account and cloud service that accesses your organisation's data or services, including staff-owned phones and laptops under BYOD. You can certify part of the organisation if the excluded networks are segregated by a firewall or VLAN (A2.1, A2.2.2), but the certificate then reads 'Partial Organisation', which a buyer may question.
Twelve months from certification, and buyers under PPN 014 expect it renewed every year of the contract. Renewal is a fresh self-assessment against the question set current at the time, so a certificate first issued under an older version is reassessed against v3.3 and the Danzell question set when it renews.
Related pages
- Android support statusWhich field devices still get security patches
- Android setupScreen lock and updates on operatives' tablets
- Windows Server support statusSupport dates for housing management servers
- Who needs Cyber Essentials?Government, MoD, NHS and other mandates.
- Scope: what is in and outBYOD, home working, cloud and sub-sets.
- How much does it cost?Fixed prices and IASME fee bands.
- Check your readinessFree check against the 2026 question set.
- Cyber Essentials for local government suppliers
- Cyber Essentials for defence suppliers
- Cyber Essentials for software and SaaS companies
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials Danzell Question Set 2026Read on iasme.co.uk (opens in a new tab)
- GOV.UKRSH, Governance and Financial Viability StandardRead on gov.uk (opens in a new tab)
Get certified at a fixed price
Precursor is an IASME Certification Body: Cyber Essentials from £1,500 and Cyber Essentials Plus from £3,000, with the IASME fee included, a free re-test if gaps are found and a written fixed price after a 20-minute scoping call.
- IASME Certification Body
- CREST accredited
- UK offices in Leeds, Newcastle, London and Edinburgh