Charities and housing associations under the Cyber Security and Resilience Bill
Charities and housing associations are not regulated sectors under the Cyber Security and Resilience Bill (CSRB), so most will not be directly regulated. The main exceptions are organisations selling cloud or managed IT services, or a supplier designated by a regulator. Most will feel the Bill through their IT suppliers.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
Where charities and housing associations stand
The Cyber Security and Resilience Bill (CSRB) does not list charities or housing associations as sectors. That does not make them low-risk: the Cyber Security Breaches Survey 2025/2026 found 28% of charities identified a breach or attack in the past year, and only 9% reviewed risks from immediate suppliers. See our statistics page.
Routes into scope
| Route | Example | Key test |
|---|---|---|
| RMSP | A housing group selling ongoing IT management to smaller associations | Ongoing management with access to customer systems; not micro or small |
| RDSP | A charity running a cloud platform used by other organisations | Meets cloud definition; not micro or small |
| Critical supplier | A specialist care or technology charity supplying a regulated health body | Direct supply; significant impact if disrupted; regulator designation |
| Data centre | A group with its own facility | 10 MW for enterprise use |
Shared IT is the route most likely to be overlooked. If a group company supports sister organisations and outside bodies under contract, assess that company by itself, including the size rules for linked organisations. We have found no specific guidance for this situation yet.
The RDSP and RMSP definitions also have a public oversight test. A body controlled by public authorities, or whose board is mostly appointed by them, is excluded unless it earns more than half of its income commercially. Check this if your governance has public appointees.
How your suppliers' duties reach you
Even when you sit outside the Bill, the IT companies you rely on may not. Regulated managed service providers (RMSPs) and digital service providers (RDSPs) must, after giving their regulator a full notification, notify UK customers likely to be adversely affected. A notice must describe the incident and explain why the provider thinks you are affected.
That makes three things worth doing now:
- List which suppliers hold access to your systems, and which are likely to be regulated.
- Check that each contract names who receives incident notices, and that the mailbox is monitored.
- Decide who acts on a supplier notice, including whether it triggers your own UK GDPR assessment.
Questions from funders and public-sector customers
Commissioners that are regulated may ask how you protect the systems used to deliver their services. Those requests come through contracts, so the Bill's size exclusions do not stop them. A short answer covering who owns cyber risk, your recovery plan and who to contact in an incident will usually be a good start.
What trustees and boards should ask
The survey found 30% of charities have board members or trustees responsible for cyber security. A board can start by asking:
- Who are our critical IT suppliers, and would they tell us about an incident?
- Could we keep delivering services to vulnerable people if systems were down for a week?
- Does any part of the group sell technology services?
Sources
Frequently asked questions
Not as a sector. A charity is only caught if a specific route applies, such as providing a regulated digital or managed service or being designated as a critical supplier. Having charitable status does not itself give an exemption.
It may. The test comes from Commission Recommendation 2003/361/EC, which looks at whether a body carries on an economic activity, whatever its legal form. Take advice if your charity trades and is near the limits.
There is no housing subsector. A housing association would need to be caught through another route, such as running a large data centre or selling managed IT services to other organisations.
It is possible if it directly supplies a regulated operator, relies on IT for that supply, and a regulator concludes disruption would be likely to have a significant impact on the economy or society. Designation requires consultation and notice.