TPRM for UK Housing Associations: 2026 Guide

Originally published on 21 February 2025. Updated and substantially rewritten on 27 October 2026.

What’s new in this update: This article has been substantially rewritten to reflect developments in 2025 and 2026. It now covers: recent incidents at the Housing Ombudsman Service, L&Q and Choice Housing; the Regulator of Social Housing’s Sector Risk Profile 2026 and the Competence and Conduct Standard; UK GDPR processor obligations and the Data (Use and Access) Act 2025; regulatory expectations in England, Scotland, Wales and Northern Ireland; the Cyber Security and Resilience Bill and its implications for managed service providers; funding conditions from Homes England, data sharing with councils, and expectations of community-led providers; risks from connected homes, including sensors used for Awaab’s Law compliance and the telecare digital switchover; and a prioritised list of supplier categories, practical priorities for security leaders, Key Findings and an FAQ.
‍

Key Findings

UK housing associations remain legally and regulatorily accountable for the cyber security of the suppliers that process residents’ data. In 2026, incidents, regulation and the market all raised the stakes.

Cyber is the top risk on housing association risk registers. Inside Housing’s Risk Register Survey 2026 found cyber security was the most commonly cited risk for the third consecutive year, named by 84% of the 100 housing associations reviewed.
The Regulator of Social Housing now names suppliers. The RSH Sector Risk Profile 2026, published on 22 October 2026, states that landlords should understand the cyber risks of their own systems, connected technologies and third-party suppliers. It also reports that insurers increasingly price data governance into premiums.
A supplier breach disrupted the sector’s own watchdog. In October 2026 the Housing Ombudsman Service took its case management system and complaints portal offline after unauthorised access at a third-party supplier. A month earlier, emails and webform messages from about 12,000 L&Q residents were accessed.
Accountability stays with the housing association when a supplier is breached. Under UK GDPR the association normally remains the data controller. In the Capita case the Information Commissioner’s Office fined the controller £8m and the processor £6m.
New obligations in 2026 extend further into the supply chain:
- Since 1 October 2026, the Competence and Conduct Standard has covered contractor staff of social landlords in England.
- Since 19 June 2026, the Data (Use and Access) Act 2025 has required every organisation to handle data protection complaints itself.
- The Cyber Security and Resilience Bill will regulate medium and large managed service providers once it becomes law.
Housing associations are starting to assess shared suppliers together. Five housing associations are currently building a shared supplier community on Risk Ledger. They are following a model in which ten councils jointly mapped 300 common suppliers and identified 20 concentration risks they could not see individually.
‍

Introduction

In October 2026, social housing residents in England spent more than a week unable to submit or track a complaint online with the Housing Ombudsman Service. The disruption originated with a supplier. The Ombudsman reported a third-party IT security incident affecting the case management system that supplier provides, and warned residents that some contact details may have been copied. The body that holds social landlords to account for failures of service had its own service halted by a failure in its supply chain.

Weeks earlier, a targeted cyber attack on L&Q gave an unauthorised party access to emails and webform messages from around 12,000 residents. L&Q, a landlord of 105,000 homes, notified both the Information Commissioner’s Office (ICO) and the Regulator of Social Housing (RSH). Read together, the two incidents show where exposure in the sector now concentrates: in the web channels, portals and outsourced platforms that sit at, or beyond, the edge of an organisation’s own network.

That exposure follows from the way housing associations work. To repair homes, support tenants, collect rent and allocate lettings, they have to pass detailed records on residents, many of them in vulnerable circumstances, to contractors, software vendors, IT providers, support partners and local authorities. Each transfer extends the organisation’s attack surface into systems it neither owns nor can directly monitor. Moreover, many of those suppliers serve a large share of the sector at once.

The expectations placed on boards have broadened since the first edition of this guide in February 2025:

The RSH’s Sector Risk Profile 2026 now asks landlords to understand the cyber risks of their third-party suppliers alongside their own systems. It also notes that insurers increasingly factor data governance into premiums.
The Competence and Conduct Standard has applied to contractor staff since 1 October 2026.
The Cyber Security and Resilience Bill is close to bringing medium and large managed service providers under direct regulation.
Since 19 June 2026, every organisation handling personal data has had a statutory duty to handle data protection complaints itself. That includes complaints about how a supplier treated residents’ information.

This guide sets out which suppliers matter the most to housing associations, and what UK GDPR and housing regulators across the four nations require. It covers how funding conditions and council partnerships raise the bar for smaller and community-led providers. It then makes the case that associations sharing the same suppliers gain a clearer and more current picture of risk by assessing those suppliers together, and achieve significantly enhanced efficiencies and effectiveness in managing supply chain risk.

What recent incidents reveal about third-party risk in social housing

The most significant recent incidents affecting social housing have begun at the edges of organisations: a platform run by a supplier, a public website and an intrusion delivered by email. In each case, the organisation’s ability to tell residents and regulators what had been exposed depended on information it did not fully control.

Recent cyber incidents affecting UK social housing

Organisation	Date	What was affected	Supplier involvement	Regulators notified
Housing Ombudsman Service	October 2026	Case management system, complaints portal, webchat, Learning Hub and landlord portal; names, addresses and phone numbers may have been copied	Confirmed: system provided by a third-party supplier (not named)	Information Commission
L&Q	September 2026	Website, plus emails and webform messages from around 12,000 residents	Not disclosed	Information Commissioner’s Office and Regulator of Social Housing
Choice Housing	February 2025	IT systems across the organisation, shut down as a precaution; no evidence of data loss found	None reported; attack understood to have started with an email	“All relevant authorities”
Capita Pension Solutions	March 2023	Pension, staff and customer records of 6.6 million people; 325 of more than 600 client organisations affected	The breach occurred at the processor	Information Commissioner’s Office; The Pensions Regulator engaged

Sources: Housing Ombudsman Service (October 2026); Inside Housing (September and October 2026); Irish News (February 2025); Information Commissioner’s Office (October 2025)

‍

Housing Ombudsman Service: when a shared sector platform fails

On 13 October 2026 the Ombudsman disclosed unauthorised access to data held in a case management system provided by a third-party supplier. It took the system offline. Residents could no longer submit or view complaints, use webchat or webforms, or reach the Learning Hub, and landlords lost access to the landlord portal. Inside Housing reported that names, addresses and telephone numbers may have been copied, and that the Ombudsman could not yet say how many people were affected. For scale, the Ombudsman made findings in more than 20,000 cases in 2025-26.

A week later, services remained offline and the Ombudsman was still awaiting a full account from its supplier. The supplier has not been named.

Two features matter for housing associations. First, the platform holds data submitted by residents and landlords from across England, so a single supplier failure created exposure for the whole sector. Second, the controller depended on the supplier’s investigation to establish what had happened. That is the position any association will be in when a processor is breached.

L&Q: the public-facing layer as the point of entry

In September 2026, an unauthorised party accessed emails and webform messages sent to L&Q by around 12,000 residents.

L&Q took its website offline and contacted affected residents directly.
It warned residents of an increased risk of phishing and fraud attempts.
It informed the ICO and the RSH.
L&Q said its wider operating systems, including information relating to suppliers and partners, remained secure.

L&Q has not said whether a third party was involved. The incident still carries a lesson for supplier risk. Websites, contact forms and the email systems behind them are frequently built, hosted or maintained by external providers, and they collect some of the most personal correspondence a landlord receives.

Choice Housing: disruption across a whole organisation

Choice Housing, Northern Ireland’s largest housing association, was alerted to an attack in the early hours of 14 February 2025. The attack is understood to have started with an email. The association shut down systems as a precaution, which delayed work for tenants, and later said it had found no evidence of data loss. The case shows how quickly operational disruption spreads across an organisation of more than 10,000 homes, even when no data leaves it.

Taken together, these incidents show that a housing association’s exposure depends heavily on platforms and providers it does not operate. When one of them fails, the speed and accuracy of the association’s own response is limited by what the supplier can tell it. That limit also extends to the supplier’s own suppliers, as the knock-on effects of fourth-party breaches show.

Which suppliers matter most to housing associations

Housing associations should rank suppliers by two tests: how sensitive the data a supplier holds is, and how quickly services stop if that supplier fails. A small number of suppliers score highly on both, and they deserve most of the assurance effort. Many others, such as low-risk providers of goods, need only proportionate checks.
‍

Housing association supplier categories by data sensitivity and operational dependency

Supplier category	Data typically shared	Operational dependency	Priority
Housing management, CRM and housing register systems	Full tenancy, rent, repairs, anti-social behaviour and vulnerability records	Critical: rent, lettings, repairs and complaints run on them	Highest
IT managed service providers, cloud and hosting	Privileged access to most systems and data	Critical: an outage or compromise can halt the whole organisation	Highest
Resident portals, websites, contact forms and email platforms	Resident correspondence, identity and case details	High: primary channels for repairs and complaints	High
Repairs, voids, gas, electrical and building safety contractors and their subcontractors	Names, addresses, access notes, vulnerability flags, photographs of homes	High: statutory safety checks and Awaab’s Law timescales depend on them	High
Telecare, alarm monitoring, sensors and door entry	Health-related alerts, environmental and occupancy data	High: resident safety	High
Support and care partners in supported housing	Health, safeguarding and criminal offence data	High for residents in vulnerable circumstances	High
Payments, rent collection, debt recovery and tracing	Bank details, arrears, income	High: cash flow	High
Local authority partners (nominations, homelessness, Housing Benefit)	Medical need, homelessness status, benefit data	High: lettings and rental income	High
Payroll, HR and pensions administration	Staff financial and personal data	Medium	Medium
Outsourced contact centres	Full history of resident interactions	Medium to high	Medium
Print, mail, scanning and document management	Bulk resident correspondence	Medium	Medium
Development partners and golden thread platforms	Building safety information, some resident data	Medium; regulatory for higher-risk buildings	Medium

Source: Risk Ledger analysis, drawing on the Regulator of Social Housing Sector Risk Profile 2026 and UK GDPR special category data definitions

Suppliers that hold the most sensitive data

The highest-value data concentrates in three places:

Housing management and CRM platforms, which bring together each household’s full record.
Support and care partners, whose records on health, disability and safeguarding fall squarely within special category data.
Debt recovery and tracing agencies, which combine financial data with location data.

A breach at any of these exposes residents to harms that a password reset cannot fix, from targeted fraud to physical risk. These suppliers warrant the deepest assurance before appointment and continuous oversight afterwards. In particular, associations need to know where the data is hosted, who can access it and how quickly the supplier will report an incident.

Suppliers whose failure stops services

Some suppliers hold little personal data but would halt core services if they failed:

An IT managed service provider with administrative access to the whole estate.
A repairs contractor responsible for statutory gas and electrical checks.
A telecare monitoring centre.

The RSH is explicit that landlords remain responsible for tenants’ safety even where services or safety checks are delivered by contractors or managing agents. Awaab’s Law adds time pressure: when a contractor’s systems or a sensor platform fail, the statutory clock keeps running. For these suppliers, resilience and recovery commitments matter as much as data controls.

Concentration and fourth-party exposure

Many housing associations use the same small group of housing software vendors, IT providers and national contractors. Those suppliers in turn rely on their own subcontractors, cloud hosts and software components. A single incident at a shared supplier at any level (from direct third party to fourth or even fifth party level) can therefore impact many housing associations at once, as the Housing Ombudsman case showed for a platform the whole sector feeds data into. Vendors’ own figures point to that concentration. Civica, for example, stated in 2021 that it worked with 400 social housing organisations.

Concentration of this kind is invisible to an association that assesses only its own direct suppliers. Seeing it requires mapping suppliers across organisations and tracing their dependencies to the fourth party and beyond. That mapping is the basis for identifying concentration risk before an incident exposes it.

UK GDPR: accountability stays with the housing association

When a housing association uses a supplier to process residents’ personal data, it normally remains the data controller under UK GDPR. If that supplier is breached, the association still answers to residents and to the Information Commissioner’s Office for how the data was protected, how quickly the breach was reported and how affected people were told. Outsourcing moves the processing to the supplier. The legal duties stay with the association.

What Articles 28 and 32 require of supplier relationships

Article 28 of UK GDPR allows controllers to use only processors that provide sufficient guarantees of appropriate technical and organisational measures. It requires a written contract that sets out, among other things:

that the processor acts only on the controller’s documented instructions;
that the processor keeps the data secure;
that further sub-processors are engaged only with the controller’s authorisation, under the same obligations;
that the processor helps the controller meet its breach-notification duties;
that the processor allows audits.

Article 32 requires security appropriate to the risk. For a housing association, that risk is raised by the health, safeguarding and criminal offence data that support and care partners routinely hold.

These are not paperwork exercises. The Capita case showed the ICO assessing each party against its own obligations. It fined the controller for failing to keep data secure (Articles 5(1)(f) and 32) and separately fined the processor under Article 32. For associations, the practical test is whether due diligence before appointment and the controls set in the contract can be evidenced. Supplier records copied forward from a procurement file several years ago will not meet that test.

When the breach happens at a supplier

Under Article 33, a controller must notify the ICO of a reportable breach without undue delay and, where feasible, within 72 hours of becoming aware of it. Processors must tell the controller without undue delay. Where the breach is likely to result in high risk to individuals, Article 34 adds a duty to inform those affected directly.

The gap between those duties is where supplier incidents become hard to manage. A controller can only report what its supplier tells it. In October 2026 the Housing Ombudsman reported that it was awaiting further information from its supplier to understand the full impact. Some Capita clients learned of additional affected members in stages over the following year. Contracts with high-priority suppliers therefore need a notification window measured in hours, not days. They also need commitments on what information the supplier will share and how quickly.

The Data (Use and Access) Act 2025: what changed in 2026

The Data (Use and Access) Act 2025 completed its phased commencement on 19 June 2026, when all outstanding provisions came into force. Two changes matter most for supplier risk.

First, every controller must now provide a process for data protection complaints and handle them before they escalate to the regulator. Complaints about how a contractor, contact centre or software provider treated residents’ data will therefore arrive at the housing association first. The association will need its suppliers’ cooperation to investigate them.

Second, the regulator’s governance changed. The ICO became the Information Commission on 30 September 2026, although it continues to be known as the ICO.

How the ICO views the housing sector

The ICO has paid particular attention to housing. In December 2023 it published advice to housing organisations after receiving complaints from residents. It noted a lack of understanding of data protection law among some organisations in the sector. It also stressed that poor practice falls hardest on residents who need extra support.

In April 2024 it reprimanded Clyde Valley Housing Association after the launch of a new customer portal exposed residents’ names, addresses, dates of birth and anti-social behaviour case documents to other residents. The exposure lasted five days because a resident’s report was not escalated. The incident was not a cyber attack. It shows how a new digital channel, built and launched with external providers, can create a reportable breach on its first day if testing and escalation fail.

What regulators expect from housing associations on supplier cyber risk

Housing associations are not operators of essential services under the NIS Regulations, and the National Cyber Security Centre’s Cyber Assessment Framework (CAF) is not mandatory for them. Their supplier cyber risk is still regulated, through a combination of data protection law, housing regulators’ standards, building safety law and, for some, charity law. Each of these places the burden of assurance on the board.
‍

Laws and regulatory expectations with a supplier cyber risk angle for UK housing associations

Instrument	Jurisdiction	Status	Supplier angle
UK GDPR, Data Protection Act 2018 and Data (Use and Access) Act 2025	UK	Law	Processor contracts, security appropriate to risk, breach notification within 72 hours, and handling of data protection complaints
RSH Governance and Financial Viability Standard	England	Regulatory standard	Adherence to all relevant law; an effective risk management and internal controls assurance framework; annual board certification of compliance
RSH Sector Risk Profile 2026	England	Regulatory expectation	Landlords should understand the cyber risks of their own systems, connected technologies and third-party suppliers; boards should test recovery and self-refer material issues
RSH consumer standards, including the Competence and Conduct Standard	England	Regulatory standard	Landlords remain responsible for safety delivered by contractors; contractor staff in scope from 1 October 2026
Building Safety Act 2022: golden thread	England (higher-risk buildings)	Law	Building information held digitally and secure from unauthorised access, often on third-party platforms
Awaab’s Law	England	Law	Statutory timescales for hazards that depend on contractors and connected devices
Scottish Housing Regulator framework	Scotland	Regulatory	Cyber security incidents and contractor failures reported as notifiable events
Welsh Regulatory Framework 2025	Wales	Regulatory	Board assurance on data quality; cyber and data resilience reviewed in regulatory judgements
Department for Communities regulatory standards	Northern Ireland	Regulatory	Risk management standard; cyber security, data protection and monitoring of key third parties flagged in the 2026 risk profile
Charity Commission serious incident reporting	England and Wales (registered charities)	Law	Significant data breaches must be reported; exempt charities are not covered
Cyber Security and Resilience Bill	UK	Forthcoming	Medium and large managed service providers regulated, with 24-hour and 72-hour incident reporting and duties to notify affected customers

Sources: legislation.gov.uk; Regulator of Social Housing (2015 to 2026); Scottish Housing Regulator (2025 and 2026); Welsh Government (2025 and 2026); Department for Communities NI (2026); Charity Commission; UK Parliament (October 2026)

England: RSH standards and the 2026 Sector Risk Profile

The Governance and Financial Viability Standard requires private registered providers to adhere to all relevant law. It also requires an effective risk management and internal controls assurance framework, and boards must certify compliance in their annual accounts. Because data protection law is part of “all relevant law”, a material failure in supplier data protection can become a governance question as well as a data protection one.

The RSH’s Sector Risk Profile 2026, published on 22 October 2026, makes the supplier dimension explicit. It states that landlords should understand the cyber risks associated with their own systems, connected technologies and third-party suppliers. It expects boards to ensure that cyber risks are identified, assessed and managed, and that business continuity and recovery arrangements are regularly reviewed and tested. The profile also restates that boards should self-refer to the regulator if they find or suspect a material issue. Since 2024, landlords with 1,000 or more homes have also been subject to proactive inspection. L&Q’s notification to the RSH in September 2026 shows that cyber incidents are now treated as regulatory events as well as data protection events.

Building safety, Awaab’s Law and contractor accountability

For higher-risk residential buildings, the Building Safety Act 2022 requires a golden thread of building information that is kept digitally and secure from unauthorised access. The regulations also require that changes are recorded with the name of the person making them and the date (SI 2023/909). That information usually sits on third-party platforms, often after it has passed from a principal contractor to the accountable person at handover.

Awaab’s Law adds statutory timescales for investigating and remedying hazards, and is extending to further hazards in 2026 and 2027. The RSH is clear that landlords remain responsible for tenants’ safety where checks are delivered by contractors. From 1 October 2026, the Competence and Conduct Standard requires relevant frontline and contractor staff to demonstrate the necessary skills and conduct. This extends regulatory attention to the people suppliers send into residents’ homes.

Scotland, Wales and Northern Ireland

Scotland. Registered social landlords must report notifiable events to the Scottish Housing Regulator. Its 2025/26 report records 427 events from 115 landlords and lists cyber security incidents among the examples. The previous year’s report also cites contractors and delivery partners going into administration. In 2019 the regulator wrote to all landlords after fraud linked to a breach of an external source and pointed them to Cyber Essentials.

Wales. The Welsh Government’s revised regulatory framework, issued in August 2025, strengthens requirements for boards to seek assurance on data underpinning their reporting. Some 2026 regulatory judgements reviewed associations’ cyber and data resilience as part of their scope.

Northern Ireland. The Department for Communities’ Sector Risk Profile 2026 cites Governance Standard 2, which requires a robust approach to the assessment and management of risk. It lists cyber security and data protection among the sector’s significant risks. It also warns that boards which fail to monitor key third parties, such as contractors, leave their association exposed to those organisations’ failures.

Charities and serious incident reporting

Housing associations that are registered charities must report serious incidents to the Charity Commission, including when there has been a significant data breach. The duty applies to all registered charities except exempt charities. Many registered providers are exempt charities, so each association should confirm its own position before an incident occurs, not during one.

Coming next: the Cyber Security and Resilience Bill

The Cyber Security and Resilience Bill will bring medium and large managed service providers into regulation for the first time, with the Information Commission as their regulator. In-scope organisations will have to notify the regulator of significant incidents within 24 hours and submit a full report within 72 hours. They will also have to tell affected customers.

Housing associations are not in scope. Many depend on providers that will be, and those associations will benefit from stronger security baselines and earlier warnings. Associations served by small IT providers should expect no such protection, because micro and small providers are excluded. The Bill entered House of Lords report stage on 26 October 2026 and has not yet received Royal Assent.

Where the NCSC Cyber Assessment Framework fits

Although the CAF does also not apply to housing associations as a requirement, it remains a useful benchmark. Its supply chain principles give boards a structured way to test whether supplier oversight is proportionate to risk. Associations should describe any use of it as voluntary alignment and avoid presenting it as compliance.

Funding, councils and community-led housing

Public funders and council partners already attach data protection and system-security conditions to the housing associations they work with. Smaller and community-led providers face the same conditions, often with the least capacity to meet them. Evidence of their own security, and of their suppliers’ security, is becoming part of what it takes to win and keep public money and partnerships.

Homes England grant conditions

Grant under the £39 billion Social and Affordable Homes Programme 2026 to 2036 is paid through a standard-form grant agreement. Recipients must supply information on request and follow publication requirements. Lawyers advising registered providers have highlighted that the revised agreements introduce stricter admin-user security controls on Homes England’s grant management system, alongside stronger controller-to-controller data protection obligations. The published example agreement for unregistered bodies makes two relevant demands:

the recipient must regularly review its security arrangements for accessing and operating that system;
data shared with the department, Homes England and local authorities must be handled within the recipient’s data protection obligations.

These are contractual duties, and they reach suppliers indirectly. An association whose development partner, consultant or outsourced finance team handles grant data or system credentials carries the risk if that party mishandles them.

Data sharing with local authorities

Housing associations and councils exchange personal data continuously:

Nominations: councils share applicants’ details, including medical need and homelessness status.
Housing Benefit and discretionary housing payments: the two sides exchange claims and payment information.

Data-sharing agreements typically commit each party to appropriate technical and organisational measures. One council’s nominations agreement, for example, also requires staff vetting, information security training and secure email.

These flows also make each organisation part of the other’s supply chain. A council assessing its own third-party risk will increasingly look at the housing associations it shares data with. Associations assessing theirs should treat council systems and portals as dependencies to be understood, not assumed. Further local oversight is coming for supported housing, where the government plans a locally led licensing regime with national standards and licence conditions set at council level.

Smaller and community-led providers

Community land trusts, housing co-operatives and small associations hold the same categories of resident data as large landlords and use many of the same suppliers. They do this with a fraction of the staff. Where councils fund them, the councils increasingly expect governance comparable to that of registered providers. Bristol City Council’s standard for community-led housing applies to groups funded through council land or grant. It requires them to adhere to all applicable law, to maintain an effective risk management and internal controls process, and to certify compliance annually. This closely mirrors the RSH standard.

We found no published requirement from Homes England, the Greater London Authority or a council for housing partners to hold Cyber Essentials. Government policy nonetheless points in that direction:

Central government contracts involving personal data already require it under PPN 014.
In October 2025, ministers urged leading companies to require Cyber Essentials in their supply chains.
The Scottish Housing Regulator pointed landlords to the scheme as early as 2019.

For smaller providers, Cyber Essentials is a credible, low-cost way to show funders and council partners a verified security baseline. It is equally reasonable for those providers to ask the same of their own small suppliers before handing them residents’ data.

Why one-to-one supplier assessment does not scale in housing

Security questionnaires remain one of the most useful sources of evidence about a supplier. They capture controls, policies and dependencies that no external tool can observe. The difficulty in housing lies in how they are used. Hundreds of associations ask many of the same suppliers similar questions in different formats, typically once a year, with small teams. The model produces a large volume of evidence that is hard to compare and quickly out of date.

The same suppliers, assessed again and again

A national repairs contractor, housing software vendor or IT provider may serve dozens of housing associations. Under one-to-one assessment, each association sends its own questionnaire, chases its own responses and stores the answers in its own spreadsheet. Across the sector, the supplier completes broadly the same exercise many times, with slightly different wording, scoring and evidence requests. [SME input needed: Risk Ledger data on how many housing customers share the same suppliers.]

The costs fall on both sides. Associations spend analyst time chasing responses when that time could go on judging the risk the answers reveal. Suppliers, particularly small contractors without a dedicated security function, respond with diminishing care. The resulting evidence varies in quality and format, so a board cannot easily compare one supplier with another. Nor can it compare its own picture with that of peers using the same supplier.

For many associations, the limit is people. Northern Ireland’s Sector Risk Profile 2026 notes that most associations, particularly smaller ones, are exposed to key person risk. In practice, supplier assurance often rests with one or two staff who also carry wider security, data protection or IT responsibilities. [Evidence needed: sector data on supplier assessment workload or security team size in housing.]

Point-in-time answers in a changing supply chain

An annual questionnaire records a supplier’s position on the day it was completed. Supply chains move faster than that. Contractors take on new subcontractors to meet demand. Software providers change hosting arrangements. A vulnerability in a widely used product can affect many suppliers within days. None of these changes reaches the association until the next assessment cycle, or until an incident forces it into view.

The same risk profile warns boards not to mistake verbal reassurance, or a confusing amount of detail, for clear, written, evidenced assurance. A questionnaire answered once and filed away sits uncomfortably close to that warning. Assurance that boards can rely on needs to be kept current, linked to evidence and checked against what is happening in the supply chain now. That points towards continuous monitoring of the suppliers that matter most.

What external scanning can and cannot show

External attack-surface scanning gives a useful, regularly refreshed view of a supplier’s internet-facing exposure, such as email security settings, open ports and certificate hygiene. It is a sensible complement to questionnaires, especially for large supplier populations. It cannot see how a supplier controls access to residents’ data internally, which subcontractors it relies on, what its contract obliges it to do in an incident, or how quickly it would tell the association about a breach. Those questions decide how an association fares when a supplier fails, and they can only be answered by the supplier. The limits of external scanning are set out in more detail elsewhere.

The weakness, then, lies in each association asking suppliers its own questions, in isolation, on its own timetable. Where many organisations depend on the same suppliers, assessing those suppliers once and sharing the results gives every party a more consistent and more current view. It does this at a fraction of the combined effort. Councils have already shown how that works in practice, as the next section sets out.

A collective model: what councils have shown, and how housing is following

When organisations that depend on the same suppliers assess those suppliers once and share the results, each of them sees more of the supply chain than it could alone. They also see it sooner and at lower cost. Local authorities in London and the South East have already put this into practice. A group of housing associations is now building the same model for the social housing sector.

Why the council experience applies to housing associations

Councils and housing associations are different kinds of organisation, but their supplier risk has the same shape:

Budgets and teams: both operate under tight budgets with small security teams.
Resident data: both hold sensitive data on residents, many of them vulnerable, and pass it to contractors and software providers to deliver services.
Shared suppliers: both rely heavily on suppliers that also serve many of their peers.
Accountability: both answer to regulators, auditors and the public for how that data is protected.

The two sectors also share many suppliers directly, from housing and revenues software to repairs contractors and IT providers. For these reasons, the council experience is a useful guide to what a collective approach can achieve in housing.

What ten councils found

Ten councils, working through the regional warning, advice and reporting points ISfL (Information Security for London) and SEGWARP (the South East’s equivalent), set out to understand the suppliers they had in common. [Confirm current figures before publication.] Together they identified 300 suppliers. Of these, 180 were connected through the platform, and 60% were already present on it with an existing security profile. That meant the councils could review those suppliers’ evidence without starting a fresh assessment.

Mapping suppliers across the group also surfaced 20 dependencies that individual councils had not seen. These were shared suppliers and supplier-of-supplier relationships that created common exposure. [SME input needed: one or two concrete examples of what those dependencies were, anonymised if necessary, and what the councils did about them.]

The value lay as much in the shared view as in the time saved. A dependency invisible to any one council became visible once the group’s supplier lists were brought together. For more on how public bodies have applied this model, see securing public sector supply chains.

Housing associations building their own community

Five housing associations are now using Risk Ledger and are establishing their own community on the platform, aiming to replicate what the councils achieved for suppliers common to social housing. [Customer proof needed: description of the five (named, or by region and size), when the community started, early results such as suppliers mapped or shared dependencies found, and a short quote from a member’s security lead.]

A sector community has particular value in housing. Many associations rely on the same housing management platforms, national repairs contractors and IT providers. When a vulnerability or incident affects one of those suppliers, members can establish quickly which of them are exposed and coordinate their response. Each association would otherwise have to work through its own supplier list alone.

What a shared model changes in practice

On Risk Ledger, suppliers complete one standardised security profile, keep it up to date and share it with every client they connect to. The network now includes more than 19,000 suppliers. Several changes follow for a housing association:

Faster assurance: suppliers already on the network can be reviewed against current, comparable evidence.
Deeper visibility: suppliers’ own dependencies are mapped, bringing fourth-party and concentration risk into view.
Faster response: when a new threat emerges, members can see which connected suppliers are affected without waiting for each to respond to a fresh request.

Joining is free for suppliers, which matters in a sector where many contractors are small businesses. Those suppliers also get tools to manage and improve their own security, helping to turn suppliers into security enablers and ending the cycle of answering the same questions for every client.

A collective model does not remove each association’s legal accountability for its own suppliers, as Sections 4 and 5 make clear. It makes that accountability easier to discharge on evidence, because associations work from shared, current information about the suppliers they have in common. For the wider case behind the approach, see towards collective supply chain security.

Priorities for housing association security leaders

The priorities are to know which suppliers hold residents’ data or keep services running, to contract for fast and useful breach notification, to extend assurance to contractors and connected devices, and to stop assessing shared suppliers in isolation. None of them needs a large team. Each needs a decision about where limited effort goes first.

Map critical suppliers against two tests. Rank every supplier by the sensitivity of the data it holds and how quickly services would stop if it failed, using the categories in Section 3. Include the subcontractors behind repairs and safety contracts and the providers of sensors, telecare and door entry. Supplier registers held by procurement rarely capture these suppliers.
Review processor contracts against Article 28. For the highest-priority suppliers, check that contracts include the Article 28 terms, audit rights and controls over further sub-processors. Set a breach-notification window short enough to let the association meet its own 72-hour duty. Specify what the supplier must disclose and when, because the Housing Ombudsman and Capita cases both showed controllers waiting on their suppliers for basic facts.
Ask IT providers how they will meet the Cyber Security and Resilience Bill. Medium and large managed service providers will soon have to report significant incidents within 24 hours and tell affected customers. Ask now whether your provider expects to be in scope. Ask too how it will notify you, and what you will receive. If your provider is too small to be covered, treat that as a reason for closer contractual oversight.
Put telecare and the digital switchover on the risk register. The RSH has flagged the analogue-to-digital switchover as a risk to telecare and connected safety systems. Identify which providers monitor alarms and sensors, what data they hold and how their systems will behave during and after migration. For residents who depend on these services, a failure is a safety incident.
Report supplier cyber risk to the board in the regulator’s terms. Frame board reporting around the expectations in the RSH Sector Risk Profile 2026: understanding third-party cyber risk, testing continuity and recovery, and knowing when to self-refer. Boards in Scotland, Wales and Northern Ireland should map the same reporting to their own regulator’s notifiable events and risk standards. Reporting that uses the regulator’s language is easier for a board to challenge and easier to evidence at inspection.
Rehearse a supplier-platform outage. Most incident exercises assume the association’s own network is compromised. Run at least one built on the Housing Ombudsman scenario: a supplier-hosted system goes offline and data may have been copied, while the supplier’s investigation is still incomplete. Test how residents would be contacted, who decides on ICO and regulator notification, and how services continue manually.
Set proportionate expectations for small suppliers. A sole trader carrying out void clearances should not receive the same questionnaire as a housing management platform. For smaller suppliers, a recognised baseline such as Cyber Essentials, together with clear data-handling terms, may give better assurance than a lengthy questionnaire answered in haste. Reserve detailed assessment for suppliers that hold sensitive data or keep services running.
Assess shared suppliers with peers. Identify the suppliers your association has in common with others in your region or peer group. Then join or form a community that assesses those suppliers once, shares the evidence and coordinates when one of them is affected. This is the step that makes the other seven sustainable for a small team, and it brings fourth-party exposure into view.

Conclusion: A shared supply chain needs collective defence

The Housing Ombudsman incident opened this guide because it captures the sector’s position precisely. A platform used by residents and landlords across England was compromised through a supplier. Every organisation that depended on it was left waiting on the same incomplete information. Few housing associations would have listed that platform among their critical suppliers, yet all of them were exposed through it.

That is the condition the sector now has to manage. Housing associations hold some of the most sensitive personal data in the public realm and provide homes and services that residents cannot easily replace. Much of the work behind those services runs through contractors, software vendors, IT providers and partners. Law and regulation have drawn the consequence clearly:

UK GDPR: accountability stays with the association when a processor fails.
The Regulator of Social Housing: boards are now expected to understand the cyber risks of their third-party suppliers, test their recovery arrangements and self-refer when material issues arise.
Insurers, funders and council partners: they apply the same expectation through premiums, grant conditions and data-sharing agreements.

Meeting those expectations one association at a time has reached its practical limits. Small security teams cannot keep pace with supply chains that change continually. Suppliers cannot give considered answers to the same questions from every client. The more useful unit of analysis is the sector as a whole. That means the housing management platforms, national contractors and IT providers that many associations share, and the dependencies beneath them that no single organisation can see from where it stands.

Housing associations already cooperate on procurement frameworks, performance benchmarking and good practice. Extending that cooperation to supplier security is a natural next step. Associations that map their common suppliers together, share evidence of how those suppliers are secured and coordinate when one of them is compromised will be better placed to protect residents, satisfy regulators and recover quickly. The suppliers that serve the sector gain as well, through fewer duplicate requests and clearer expectations. A supply chain the sector shares is one the sector can only secure together.

‍

Frequently asked questions (FAQs)

What is third-party risk management for housing associations?
Third-party risk management is how a housing association identifies, assesses and monitors the risks created by the suppliers, contractors and partners that hold its data or deliver its services. In housing this includes repairs contractors, housing management software, IT providers, telecare and sensor providers, and council data-sharing partners. It also covers those suppliers’ own subcontractors.

Which suppliers pose the greatest cyber risk to housing associations?
The highest-risk suppliers combine sensitive data with operational dependency. They include housing management and CRM platforms, IT managed service providers, resident portals and contact channels, repairs and safety contractors, and telecare and alarm providers. Support partners and debt recovery agencies hold some of the most sensitive resident data, including health, safeguarding and financial information.

Is a housing association responsible if its supplier has a data breach?
Usually, yes. Under UK GDPR the housing association normally remains the data controller, so it stays accountable to residents and the Information Commissioner’s Office when a processor is breached. It must notify the ICO of a reportable breach within 72 hours of becoming aware of it. In the 2023 Capita breach, the ICO fined the controller and the processor separately.

Does the Regulator of Social Housing expect landlords to manage supplier cyber risk?
Yes. The Governance and Financial Viability Standard requires an effective risk management and internal controls assurance framework. The RSH Sector Risk Profile 2026, published on 22 October 2026, states that landlords should understand the cyber risks of their own systems, connected technologies and third-party suppliers. It also expects boards to test business continuity arrangements.

Do housing associations have to comply with the NIS Regulations or the NCSC Cyber Assessment Framework?
No. Housing associations are not operators of essential services under the NIS Regulations 2018, and the Cyber Assessment Framework is not mandatory for them. Some use it as a voluntary benchmark. Their binding obligations come from UK GDPR, housing regulators’ standards, building safety law and, for registered charities, charity law.

Will the Cyber Security and Resilience Bill apply to housing associations?
Not directly. The Bill brings medium and large managed service providers into regulation, with 24-hour and 72-hour incident reporting and a duty to notify affected customers. Housing associations that use those providers will benefit indirectly; those using small IT providers will not. The Bill entered House of Lords report stage on 26 October 2026.

Do housing associations need Cyber Essentials to receive Homes England funding?
We found no published Homes England requirement for Cyber Essentials. Homes England’s Social and Affordable Homes Programme 2026 to 2036 grant agreements do impose data protection obligations and security controls on users of its grant management system. Cyber Essentials remains a credible, low-cost way to show funders and council partners a verified security baseline.

Does Awaab’s Law create new cyber security risks?
Indirectly, yes. Many landlords are deploying damp, mould and environmental sensors to help meet Awaab’s Law timescales, which adds new suppliers and data flows. Sensor data linked to a property or tenant is personal data. The analogue-to-digital telephone switchover adds further risk to telecare, alarm and door entry systems.

How can smaller housing associations assess suppliers with limited resources?
Start with the few suppliers that hold the most sensitive data or would stop services if they failed. Set proportionate expectations for small suppliers, such as Cyber Essentials, and reuse assessments where suppliers already maintain a standardised profile. Join a peer community so that suppliers serving several associations are assessed once and the results are shared.
‍