HOA Management Company Cybersecurity Questionnaire for Boards

An HOA management company may handle owner names and addresses, assessment balances, bank and payment workflows, invoices, contracts, access credentials, violation records, architectural files, insurance information, resident communications, and board documents. A polished portal does not show whether those records and workflows are governed well.

Boards do not need to become cybersecurity auditors. They do need to ask each finalist the same practical questions, require evidence appropriate to the association's risk, and put material commitments in the management agreement. The goal is not a promise of perfect security. It is a clear, tested system to govern access, reduce avoidable risk, detect trouble, respond responsibly, recover operations, and return the association's data when the relationship ends.

This questionnaire follows the six functions in the NIST Cybersecurity Framework 2.0: Govern, Identify, Protect, Detect, Respond, and Recover. CISA and FTC resources add practical guidance on multifactor authentication, least privilege, backups, service providers, evidence preservation, and breach response. It is general board education, not legal, cybersecurity, privacy, insurance, accounting, banking, employment, or incident-response advice. Requirements vary by state, data type, contract, community, and incident. Use qualified counsel, insurance professionals, financial institutions, and security specialists for the association's facts.

Start with the association's actual exposure

Give every candidate the same high-level profile without sharing live credentials or unnecessary personal data:

• Number of homes, buildings, directors, employees, managers, committees, and recurring vendors.
• Banks, payment processors, lockbox, accounting system, owner portal, email, cloud storage, website, domains, access-control systems, cameras, and integrations.
• Types of owner, employee, financial, legal, insurance, architectural, maintenance, and building-access information handled.
• Who currently owns each account and which people have administrator, payment, approval, export, or recovery access.
• Remote work, personal-device, shared-inbox, vendor-access, and after-hours practices.
• Current cyber, crime, fidelity, directors and officers, and related insurance.
• Known outages, fraud attempts, compromised accounts, data exposures, or difficult transitions.

Ask candidates to state assumptions and exclusions. A company cannot give a meaningful answer if the proposal never defines which systems, data, and responsibilities are in scope.

1. Who governs cybersecurity and privacy?

Ask:

Who is accountable for protecting association systems and data, how often does leadership review the program, and how will our board receive evidence that material controls are operating?

Request:

• The role responsible for cybersecurity and privacy, plus an executive escalation contact.
• The written policy framework used for access, acceptable use, remote work, vendors, backups, incidents, retention, and secure disposal.
• The date of the latest risk assessment and the process for tracking remediation.
• How legal, insurance, banking, accounting, operations, communications, and technology responsibilities are coordinated.
• How employees and contractors acknowledge policies and receive recurring training.
• The process for notifying client associations of a material change in control, key vendor, security program, or risk.

NIST CSF 2.0 places Govern alongside Identify, Protect, Detect, Respond, and Recover. That is useful for a board: cybersecurity should have owners, policy, priorities, oversight, and resources, not merely technical settings.

2. What association assets and data will you control?

Require a system-and-data map for the proposed service. It should identify:

• Accounting, owner portal, payment, banking, invoice, document, email, website, domain, phone, maintenance, access-control, camera, and collaboration systems.
• System owner, contract holder, primary administrator, recovery contact, integration, vendor, data location, and association access.
• Data collected, purpose, users, sharing, retention period, export method, and deletion process.
• Critical operations that would stop if the system, integration, employee, or vendor became unavailable.

The association should know which records belong to it, which company systems contain copies, which vendors receive data, and which credentials must transfer at termination. "It is in our platform" is not an asset inventory.

3. How are identities and privileged access controlled?

Ask the finalist to demonstrate roles for a president, treasurer, director, committee member, homeowner, accountant or auditor, manager, accounting employee, vendor, and system administrator.

Verify:

• Individual accounts instead of shared credentials.
• Multifactor authentication for email, banking, accounting, payment, cloud, administrator, and remote access.
• Whether phishing-resistant MFA is available for privileged or high-risk access.
• Least-privilege roles and separation of administrator, approval, payment, and reconciliation authority.
• Approval for new access and elevated privileges.
• Prompt removal after employment, board, committee, or vendor changes.
• Periodic access reviews and retained evidence.
• Emergency access that is controlled, logged, tested, and reviewed.
• Password-manager use and prohibition on sending credentials through ordinary email or spreadsheets.

CISA advises businesses to use MFA and to grant access and administrator permissions based on need to know and least privilege. Ask the candidate to show the configured control, not only a policy sentence.

4. How will you reduce payment and vendor fraud?

Management companies sit close to assessment deposits, owner refunds, vendor invoices, bank transfers, reserve movements, and changes to payment instructions. Ask for a walkthrough of one owner payment and one vendor payment from source through reconciliation.

The control map should address:

• Vendor identity, tax records, insurance, conflicts, and duplicate detection.
• Independent callback verification using a trusted contact before changing bank instructions.
• Invoice intake, coding, contract and budget review, approval, release, and cleared evidence.
• Dollar, vendor, fund, project, and emergency approval rules.
• Separation of vendor setup, approval, payment release, and reconciliation.
• Bank alerts, positive pay or comparable controls when available, transfer limits, and reserve-account restrictions.
• Owner refund and credit-balance approval.
• Returned payments, unmatched deposits, stale checks, and suspicious activity.
• Monthly reconciliation by a preparer and reviewer with source statements.

Run a tabletop test: an urgent email appears to come from a board officer or vendor asking for a wire or new account number. The candidate should verify through an independently sourced channel, preserve the attempt, alert the right people, and avoid letting urgency bypass authority.

5. How are email, devices, and remote work protected?

Ask:

• Are company-managed devices required for employees handling association data?
• How are devices encrypted, updated, monitored, locked, inventoried, and wiped after loss or separation?
• How are personal devices restricted or managed?
• What controls address phishing, malicious attachments, impersonation, and suspicious login activity?
• How are email forwarding, shared mailboxes, delegation, and retention controlled?
• How is remote access secured, and are administrator tasks separated from ordinary browsing and email?
• How quickly are critical software and device vulnerabilities evaluated and remediated?
• How are lost devices, compromised accounts, and suspicious messages reported after hours?

Request a sample training calendar and incident-reporting card. Training should cover realistic management-company risks such as fake vendor changes, board impersonation, document-sharing links, payment urgency, password reuse, and accidental owner-data disclosure.

6. How are software vendors and integrations evaluated?

The management company may rely on an accounting platform, portal, payment processor, bank, lockbox, cloud provider, email service, document-signing tool, call center, mailing vendor, maintenance system, access-control vendor, and support contractors.

Request:

• A current list of material service providers in the proposed workflow.
• The data and privileges each provider receives.
• Due-diligence, contracting, onboarding, monitoring, and offboarding procedures.
• Breach-notification, confidentiality, data-use, subcontractor, retention, deletion, audit, and transition terms.
• The process for reviewing integrations, API keys, support accounts, and dormant connections.
• How the company verifies that a provider corrected a reported vulnerability.

FTC breach-response guidance tells organizations to examine service-provider access and verify remediation. The board does not need every confidential vendor report. It does need enough evidence to understand critical dependencies and contract protections.

7. What logging and detection evidence exists?

Ask which systems log sign-ins, failed authentication, administrator changes, exports, payment actions, bank-detail changes, permissions, document access, deletion, and integration activity. Then ask:

• Who reviews alerts, during what hours, and under what escalation criteria?
• How long are useful logs retained?
• Can the association receive relevant audit history during normal operations and transition?
• How are unusual downloads, impossible travel, repeated failures, mass changes, or unexpected payment behavior investigated?
• How are false positives closed and material findings preserved?

Detection should match the systems in scope. A generic statement that a cloud provider "handles security" does not explain who notices suspicious use of a legitimate account.

8. Are backups independent, tested, and useful?

CISA guidance for service providers and small and midsize organizations emphasizes automatic backups that are readily retrievable and separated from the operating network. Ask the finalist to describe:

• Which association systems and records are backed up by the company, by the software vendor, or not at all.
• Backup frequency, retention, encryption, access, geographic or provider separation, and immutability where appropriate.
• The difference between a backup, a vendor's availability design, a file export, and an association records archive.
• The date and result of the latest restore test.
• Recovery priorities and target time for accounting, payments, communications, documents, and owner service.
• The manual process available during an outage.

Ask for evidence of a recent restore test with sensitive details removed. A dashboard showing successful backup jobs does not prove the team can restore usable operations.

9. What happens during a suspected incident?

Require an incident-response plan that covers account compromise, fraudulent payment, ransomware, lost device, exposed document, malicious insider, vendor incident, portal outage, and unavailable employee.

The plan should identify:

• Intake and twenty-four-hour reporting channels.
• Severity classification and decision authority.
• Containment, credential changes, payment holds, and preservation of evidence.
• Security, legal, insurance, banking, law-enforcement, vendor, board, and communications roles.
• How scope, affected data, affected people, and operational impact are determined.
• Notification analysis under applicable law and contract.
• Factual owner and board communication with an identified spokesperson.
• Recovery validation, monitoring, lessons learned, and remediation tracking.

FTC guidance recommends quickly mobilizing a response team, stopping additional loss, preserving forensic evidence, involving appropriate experts and counsel, reviewing service-provider access, determining legal requirements, and communicating without misleading people. The management contract should define how quickly the association is informed of an incident that materially affects its systems, data, funds, or operations.

10. Can the company recover association operations?

Ask the candidate to run a tabletop exercise based on the proposed service:

1. The primary manager's email account is compromised before a large vendor payment.
2. The owner portal and accounting platform are unavailable before the assessment due date.
3. A payment processor reports possible exposure of owner information.
4. The management company loses access to its office and primary systems.
5. The assigned manager and supervisor are both unavailable.

For each scenario, identify the first hour, first day, owner communication, board decisions, payment controls, manual work, recovery evidence, and post-incident review. The answer should connect people, systems, vendors, contracts, insurance, and records.

11. What insurance and contract protections apply?

Ask the association's own broker and counsel to review the proposal. Request current evidence and a clear explanation of:

• Cyber, crime, fidelity or employee dishonesty, errors and omissions, and general liability coverage.
• Limits, deductibles, exclusions, social-engineering terms, funds-transfer fraud, dependent business interruption, privacy events, ransomware, and incident-response services.
• Whether the association is an insured, additional insured, client, loss payee, or neither under relevant coverage.
• Contract limits of liability, indemnity, disclaimers, notice periods, claim cooperation, governing law, and survival after termination.
• Responsibility for forensic, legal, notification, credit-monitoring, restoration, fraud, and business-interruption costs.

Insurance is not a substitute for controls, and a certificate does not explain exclusions. Put promised security duties and incident cooperation in the agreement.

12. Will the association keep usable access and data?

Before signing, require a sample export and transition plan. Include:

• Owners, units, charges, payments, credits, delinquencies, and collection status.
• General ledger, chart of accounts, budgets, bank reconciliations, invoices, approvals, vendors, and tax files.
• Governing documents, minutes, communications, requests, maintenance, architecture, violations, insurance, contracts, and projects.
• Original attachments, metadata, audit history, open tasks, users, roles, and retention context.
• Domains, websites, phone numbers, payment accounts, bank access, integrations, recovery contacts, and vendor relationships.

Confirm formats, timing, fees, secure transfer, final accounting, read-only period, credentials, successor cooperation, retention, and deletion. At least two current association representatives should understand the recovery path for critical association-owned systems.

Evidence to request from finalists

Use a proportionate request. A small association does not need to receive a warehouse of confidential security material. It can ask for:

• A completed questionnaire signed by an accountable officer.
• Relevant independent assessment or assurance summaries, with scope and date.
• Penetration-test or vulnerability-management summary and remediation status.
• Access-control and offboarding procedure.
• Employee training cadence and reporting instructions.
• Vendor-management process and material provider list.
• Backup and restore-test summary.
• Incident-response and business-continuity summaries.
• Current insurance evidence and broker contact.
• Sample audit logs, data exports, and transition package.
• Material exceptions and the expected remediation date.

Confidential evidence can be reviewed under a nondisclosure agreement by a qualified adviser. A refusal to share sensitive technical details is not automatically a red flag; a refusal to provide any credible evidence of governance, testing, response, recovery, or accountability is.

Cybersecurity comparison scorecard

Score every finalist against the same evidence:

1. Governance, accountable roles, risk review, and policy maintenance.
2. System, data, vendor, and critical-operation inventory.
3. Individual access, MFA, least privilege, offboarding, and access reviews.
4. Payment, vendor-change, bank, reserve, refund, and reconciliation controls.
5. Managed devices, email protection, remote work, updates, and staff training.
6. Vendor due diligence, contracts, integrations, monitoring, and offboarding.
7. Logging, alert review, investigation, and audit-history availability.
8. Independent backups, restore testing, continuity, and recovery priorities.
9. Incident reporting, containment, evidence, legal analysis, communication, and remediation.
10. Insurance, contract duties, liability, costs, access, exports, and secure transition.

Write down any promised control, report, response time, transition duty, or evidence that materially affects the decision. Move it from the sales answer into the final agreement, implementation plan, or recurring service report.

Official guidance and live checks

• NIST Cybersecurity Framework 2.0 for Small Business
• NIST CSF 2.0 Quick-Start Guides
• CISA small and medium-sized business resources
• CISA guidance on multifactor authentication
• CISA guidance for managed service providers and small and midsize businesses
• FTC cybersecurity resources for small business
• FTC data-breach response guide for business

Use current official guidance, the proposed systems, the management contract, and qualified professional review to scale this questionnaire to the association. The best finalist will not claim that risk disappears. It will show who owns the work, which controls operate, how evidence is produced, what happens when a control fails, and how the association stays in control of its money, records, and relationships.