Cyber Essentials for estate agents is a UK government-backed certification that proves your agency has five baseline technical controls in place, built to stop the most common cyber attacks before they reach tenant, landlord, and buyer data. Estate agents handle bank details, ID scans, and deposit records across branch networks and third-party portals like Rightmove and Zoopla, which puts more sensitive data at risk than a typical small business handles day to day.
Why Cyber Essentials matters for estate agents
Estate agencies sit on a pile of high-value data: landlord bank details, tenant referencing files, right-to-rent ID documents, and deposit scheme records. A branch office breach doesn't just cost money — it can trigger a GDPR reporting obligation on top of the reputational damage.
Corporate landlords, build-to-rent operators, and lettings franchises are writing Cyber Essentials into their supplier onboarding checklists more often as 2026 progresses. Mortgage lenders and deposit protection schemes also ask about basic security controls during due diligence conversations, even when they don't name the certification outright.
Cyber essentials for estate agents isn't optional anymore for agencies chasing corporate instructions — it's becoming the entry ticket. The agencies that get certified early win the tender conversations the ones without it never see.
OneClickComply's compliance automation for property and real estate firms breaks down how branch networks specifically complicate certification scope — worth reading alongside this guide if you run more than one office.
How to get Cyber Essentials as an estate agent
Map the data you hold and where it lives
Before touching any technical control, list what data flows through your agency and where it sits.
- Tenant referencing files and credit checks
- Landlord bank details for rent transfers
- ID scans and right-to-rent documents
- Deposit scheme records (DPS, MyDeposits, TDS)
- CRM logins and portal credentials (Rightmove, Zoopla, OnTheMarket)
Lock down firewalls and router configuration
Every branch router is in scope, not just head office.
- Change every default admin password on branch routers
- Disable remote administrative access unless it's actively needed
- Segment guest Wi-Fi from the network running your CRM
- Block unused inbound ports at the firewall level
Set secure configuration on every device and account
Default settings are the easiest way to fail a Cyber Essentials assessment.
- Remove software nobody in the branch actually uses
- Disable auto-run for external drives and USB devices
- Enforce automatic screen lock after inactivity
- Delete or rename default admin accounts on new machines
Enforce user access control across branches
Staff turnover in lettings is high, and access control usually lags behind it.
- Give every staff member a unique login — no shared branch accounts
- Remove leaver access from CRM and portals within a defined window
- Restrict admin rights to IT staff or the agency principal only
- Turn on multi-factor authentication for email and CRM logins
- Review portal user lists quarterly, not annually
Deploy malware protection on every device
This one's simple in principle, inconsistent in practice across multi-branch agencies.
- Install antivirus software on every laptop, desktop, and server
- Block unauthorised application installs on staff devices
- Scan email attachments automatically before they open
- Extend coverage to any personal devices used for work email
Patch and update software on a schedule
Cyber Essentials requires high and critical vulnerabilities to be patched within 14 days of a fix becoming available — this single requirement trips up more estate agencies than any other control, usually because of an old router or an unsupported CRM plugin nobody's tracking.
- Set operating system updates to install automatically
- Patch mobile devices used to check email or the CRM on the move
- Retire software that's no longer supported by its vendor
- Track patch status per device, not just per office
Automate evidence collection instead of chasing screenshots
The manual route works: spreadsheets, screenshots of settings, and a folder of PDFs for the assessor. It's also the slowest part of the process for agencies running more than two branches, because evidence has to be pulled from every device and every router separately.
OneClickComply automates evidence collection across branches, pulling configuration data and patch status into one dashboard instead of a shared drive full of screenshots. Cyber essentials for estate agents gets faster when the evidence gathers itself instead of waiting on branch managers to send screenshots back.
Renew certification annually and track expiry
Cyber Essentials lapses after 12 months. A missed renewal resets your compliance status and can knock you out of a landlord's approved supplier list without warning.
- Calendar the renewal date the moment you certify
- Re-run the self-assessment questionnaire ahead of the deadline
- Check nothing has changed in your branch network since last year
- Confirm renewal before it appears on a client's supplier audit
Automate your Cyber Essentials evidence
Stop chasing screenshots across branches — OneClickComply handles it.
Comparing certification options for estate agents
| Option | Best for | Key limitation |
|---|---|---|
| Cyber Essentials (self-assessment) | Single-branch agencies with a simple network | Self-declared — some corporate landlords want the audited version |
| Cyber Essentials Plus (external audit) | Multi-branch agencies chasing corporate lettings contracts | Requires an on-site or remote technical audit, not just a questionnaire |
| Spreadsheet-based manual tracking | Agencies with one IT contact and few branches | Evidence gathering doesn't scale past two or three offices |
| OneClickComply automated platform | Agencies renewing annually across multiple branches | Best value once you're past a single-branch setup |
Verdict: single-branch agents can self-assess Cyber Essentials manually and pass without much friction; agencies with three or more branches or corporate landlord contracts should automate evidence collection from the start or the annual renewal becomes a full week of chasing paperwork.
Common mistakes estate agents make with Cyber Essentials
- Forgetting branch-level routers. Head office gets locked down, but a satellite branch's router still has the default admin password.
- Leaving ex-staff logins active in portals. Lettings turnover is fast, and Rightmove or CRM access often outlives the employee by weeks.
- Assuming Cyber Essentials covers GDPR. It doesn't — it's a technical control certification, not a data protection framework. Tenant data handling still needs separate GDPR compliance.
- Missing the 14-day patch window. Assessors check this specifically, and an unpatched router or plugin is the single most common reason for a failed assessment.
- Certifying once and forgetting renewal. A lapsed certificate can quietly drop an agency off a corporate landlord's approved supplier list.
If an assessment does fail, the fix path is usually narrow and specific — see how to handle a failed Cyber Essentials assessment for the exact remediation steps assessors expect.
Frequently asked questions
One last thing
The 14-day patch requirement is the quiet reason most branch-network estate agents stumble on their first Cyber Essentials Plus audit — not weak passwords, not missing antivirus. A single router in a satellite office running firmware from three years ago fails the whole assessment on its own. Check every branch's router firmware date before submitting, not just the head office network.