Cyber Security for Property Groups and Franchise Networks
One office in the network gets breached. Every brand in it is in the headline.
A franchise network shares a name, and often shares suppliers, systems and data. That leaves head office carrying a risk it does not directly control. We already look after more than 1,200 estate agency businesses, and we help groups get consistent protection across a whole network rather than office by office.
You Hold Exactly What a Criminal Wants, in Every Office
Estate agency and letting businesses have to register with HMRC for anti-money laundering supervision under the Estate Agents Act 1979, and trading without that registration is a criminal offence. Meeting it means collecting passports, proof of address and source of funds from buyers, sellers, landlords and tenants, and then keeping it.
So every office in the network holds verified identity documents, bank details and the timing of live transactions. Multiply that across the branches and a group is holding one of the richest identity datasets in the country, spread over sites with different IT, different suppliers and different habits.
Where Property Networks Actually Get Hit
The individual office is the way in. The network is what pays for it.
What costs you money
- Deposit and rent redirection, where a criminal changes payment details on a live tenancy or a sale
- A compromised branch mailbox used to invoice landlords, tenants and buyers in your name
- Ransomware on a branch system that takes an office offline in the middle of a chain
- Identity theft from anti-money laundering files, which are worth more per record than almost anything else you hold
- Cloned branch websites and fake listings taking deposits from people who think they are dealing with you
What costs the whole network
- One franchisee’s breach reported under the brand that everybody shares
- An ICO report within 72 hours, and questions about who the data controller actually was
- Head office carrying reputational damage for a system it does not own
- Security that varies office by office, so the honest answer to any question is that it depends
- A corporate landlord or build to rent partner asking the group for evidence it cannot give
That is the franchise problem in one line. The risk sits at office level and the consequence sits at brand level.
Who This Is For
Property groups, franchisors and multi-brand networks where head office carries brand risk for offices it does not directly run. Also single businesses that have grown to several branches and have no one view of what is protected where.
Franchisors and Head Offices
You are accountable for the brand, but the systems sit with the franchisees. You need a standard you can set, support and actually check, rather than hope for.
Multi-Branch Agencies
Several offices, grown or acquired, each with its own history of IT decisions, and nobody holding a clear picture of the whole.
Groups Being Asked for Evidence
A corporate landlord, a lender, an insurer or a build to rent partner wants proof at group level, and today the honest answer is that it varies by office.
Why Property Networks Work With Us
We already look after more than 1,200 estate agency businesses. That means we know how these offices actually run, what they will adopt and what they will quietly ignore, which matters far more than the theory when you are rolling something out across a network.
We Have Done This at Scale:
Protecting one office is straightforward. Getting consistency across dozens of them, with different owners and different budgets, is a different job, and it is the one we do.
We Set a Standard You Can Enforce:
A baseline a small branch can meet without its own IT department, so head office can ask for it, check it, and mean it.
We Start With What Is Already Exposed:
Before recommending anything, we look at which branch domains can be spoofed, whose credentials are already circulating on the dark web, and where the gaps sit across the network.
We Evidence It, Not Just Fix It:
Cyber Essentials and Cyber Essentials Plus give the group something to show a corporate client, an insurer or a partner, rather than a description of good intentions.
If that fits the way your network is run, we would be glad to have a conversation.
Cyber Essentials or Cyber Essentials Plus Across a Network
Most offices start with Cyber Essentials. A group moves to Cyber Essentials Plus when a corporate landlord, a build to rent partner or a public sector contract wants independent verification rather than self assessment. For a network the more useful question is not which level, but whether every office is at the same one.
Cyber Essentials
For most branches this is the right entry point. It covers the five technical controls set out by the National Cyber Security Centre: firewalls, secure configuration, security update management, user access control and malware protection.
Cyber Essentials Plus
CE Plus covers the same five controls, but a qualified assessor verifies them through hands-on testing. At group level it is usually what a corporate partner means when they ask whether your network is certified.
| Cyber Essentials | Cyber Essentials Plus | |
|---|---|---|
| Assessment type | Self-assessment questionnaire (SAQ) | Independent technical audit |
| Evidence | Your answers, reviewed by an assessor | Hands-on testing on a sample of user devices |
| External vulnerability scan | Not required | Included |
| Time once submitted | ~24 hours to certificate via CyberSmart | ~2 weeks if controls match the SAQ |
| Cost level | Lower | Higher |
| Best for | First-time certification, most SMEs | Government suppliers, regulated sectors, higher-assurance use cases |
Start With What Anyone Can Already See
If a branch domain can be spoofed, anyone can send an email that looks like it came from that office. Our free DMARC check tells you, domain by domain, whether yours can. It takes seconds, it needs nothing from your IT, and it is a sensible first pass across a network with a lot of domains.
Read Next
Property transactions are where this money actually goes missing.
FAQs
Who is responsible when a franchisee has a breach?
It depends on who is the data controller for the data involved, and in a franchise network that is often less clear than people assume. The practical answer is that the ICO obligation follows the controller, but the reputational damage follows the brand. That mismatch is the reason head offices end up setting a network-wide standard rather than leaving it to each office.
Do estate agents have to be registered for anti-money laundering?
Yes. Estate agency businesses, including letting and property management agents acting for landlords, must register with HMRC for money laundering supervision under the Estate Agents Act 1979. Trading as an estate agency business without that registration is a criminal offence. Meeting the requirement is also why offices hold so much identity documentation in the first place.
How quickly do we have to report a data breach?
The ICO requires a notifiable personal data breach to be reported without undue delay, and not later than 72 hours after you become aware of it. Failing to notify when you should have can attract a penalty of up to 8.7 million pounds or 2 per cent of global turnover, whichever is higher. In a network the hard part is usually finding out quickly enough that the clock has started.
Can you set one standard across offices we do not control?
Yes, and that is normally the right approach. The standard has to be something a small branch can actually meet without its own IT department, otherwise head office is asking for something it cannot enforce. We help set that baseline, roll it out and give head office a way to see who has met it.
What is the quickest thing we can check across the network?
Whether your branch domains can be spoofed. If they can, anyone can send an email that looks like it came from that office, which is how deposit and rent redirection usually starts. It is free to check and needs nothing from your IT team.
Do you only work with franchise networks?
No. We work with single multi-branch agencies too, and with individual offices. The network conversation is simply different, because the question stops being is this office protected and becomes is every office at the same level.
Talk to Someone Who Knows Property Networks
Whether a corporate partner has asked the group for evidence, an office has had a near miss, or you simply want to know what is already exposed across your branches, we can help you take a practical next step. No pressure, and no jargon.
Contact Us
