The ransomware attack on AddComm highlighted how vulnerable digital supply chains can be. A third-party provider is compromised, and housing associations must warn tenants of potential data breaches and phishing risks.
For housing associations, supplier management must go beyond procurement and service-level agreements. It also includes:
The key question is simple: what happens if a supplier fails, and how quickly can you recover?
Once an incident is identified, an initial notification must be submitted within 24 hours to the national Computer Security Incident Response Team and the relevant authority. In practice, this is more complex than it sounds.
Incidents often begin as something seemingly minor—such as a system issue, unusual behaviour in a tenant portal, or a process that suddenly stops working. At that stage, the facts are usually incomplete. Critical information about cause, timeline and impact often sits with the supplier or even their subcontractors.
This creates a dependency: organisations may need to report and communicate while still waiting for technical analysis and logs.
This is precisely why it is risky to be fully dependent on a supplier for facts and impact analysis during the first 24 to 72 hours. If personal data is involved, GDPR obligations also apply. Organisations must not only report, but also explain what happened, what data was affected, and what actions are being taken.
c) Governance: “no one was responsible” is no longer acceptable
Digital resilience requires clear leadership decisions. How much risk is acceptable? Who takes decisions during an incident? And how are decisions made under pressure regarding communication, recovery and reporting?Without clear agreements, organisations quickly fall into a familiar trap: everyone is involved, but no one is accountable.This is why cyber resilience starts with governance. In practice, this means:
- one board member or executive with ultimate accountability for digital resilience
- a crisis team with predefined roles (board, IT, legal, communications)
- a decision-making protocol for the first 24 hours of an incident
The objective is not to script every scenario, but to ensure that, when an incident occurs, it is immediately clear who leads, what information is required, and which decisions must be taken and when.
Cyber resilience is therefore not an IT project. It is a board-level responsibility that must be organised just as rigorously as financial or operational risk management.
What housing associations should do
a) Create a single overview of critical processes and suppliers
Not all systems are equally important. Start by identifying 10–15 processes that directly affect tenants, such as:
- tenant portals
- repair requests
- payment processes
- communications with housing applicants
For each process, link the key suppliers and IT services.
The goal: a single overview (ideally one page) clearly showing:
- which processes could fail
- which suppliers are involved
- what data may be affected
- who to contact first
- which decisions may require board involvement
b) Formalise and test incident arrangements
The 24-hour reporting requirement makes clear agreements with suppliers essential.
At a minimum, define:
- when and how you are informed of incidents
- who conducts forensic investigations and who bears the cost
- what logging and reporting is available
- what continuity arrangements apply
In the critical early days of an incident, it must be clear who does what.
c) Run a scenario exercise with the internal crisis team
A short table-top exercise often provides more insight than extensive policy documentation.
Choose a realistic scenario, for example:
- a supplier breach with potential leakage of tenant data
- a tenant portal outage disrupting services
Discuss key questions explicitly:
- who decides
- who communicates
- who reports
- what must be done within the first 24 hours
For organisations seeking deeper insight, a realistic cyber simulation can be highly effective. This allows boards and management to experience an incident in real time: what information is available, who takes the lead, and what reporting obligations apply?
Practical next step
Many housing associations recognise that digital risks increasingly require board-level attention, but are still looking for a practical way to organise governance.
This is where we can provide targeted support.
- In-house cyber simulation or crisis training
We deliver realistic cyber simulations for boards, management teams and crisis teams. Participants experience how an incident unfolds in practice, what information is—and is not—available, and which decisions must be taken under time pressure. This quickly highlights where governance, communication and decision-making require strengthening.
- Incident response plan for housing associations
We have also developed a practical incident response plan tailored specifically to housing associations. It helps organisations define roles and responsibilities, outline required actions during an incident, and structure reporting and communication processes.
For organisations aiming to structurally strengthen their digital resilience, we also support the full compliance journey—covering governance, supply chain arrangements, incident processes and preparation for the Cybersecurity Act.
Would you like to receive the incident response plan for housing associations or explore what a cyber simulation could mean for your organisation?
Please feel free to contact Reny Stark, Partner Technology & Data, at:
r.stark@lexence.com
Roadmap
Would you like to gain a comprehensive overview and determine which digital obligations should truly be prioritised within your organisation?
Download the Digital Compliance Roadmap 2026 below and discover where to focus your strategic efforts today.
