Evolving Risks Require Issuers To Stay Nimble

Issuers, such as social housing providers and public housing authorities (PHAs), that own and operate affordable housing have access to tenants' confidential information while lenders' risks for housing finance agencies (HFAs) are related to homeowners' confidential information. U.S. HFAs, PHAs, and social housing providers could also be exposed to heightened cyber risk from aging technology and data storage systems, with some issuers using on-site servers, rather than cloud storage, to manage critical data.

But with cyber incidents rising, these issuers are responding to increasing threats by stepping up their risk management and IT security. S&P Global Ratings has observed U.S. affordable housing issuers implement various practices to reduce exposure, including transitioning to cloud-based data storage, multifactor authentication, penetration testing, third-party reviews, and increasing employee training.

Cyber Risk As A Factor In U.S. Affordable Housing Issuers Ratings

S&P Global Ratings' assessment of U.S. affordable housing issuers' cyber security strategy is based on how their policies and procedures can be used to prepare for, respond to, and recover from cyber threats to offset financial and operational risk. "Prepare, respond, recover" summarizes an effective strategy. Comprehensive cyber security can help these issuers mitigate cyber threats as they expand digitization of internal systems and reduce administrative inefficiencies through integration of artificial intelligence. In turn, these efforts can prevent or lessen the impacts a successful cyber attack could have on our view of an issuer's creditworthiness.

We incorporate issuers' cyber security preparedness into our assessment of management and governance under our criteria, "Methodology For Rating Public and Nonprofit Social Housing Providers," published June 1, 2021, and our assessment of management and legislative mandate or federal designation in our "Methodology And Assumptions: Housing Finance Agencies And Social Enterprise Lending Organizations" criteria, published Dec. 27, 2016. Generally, we expect issuers to implement good cyber hygiene practices such as instituting detection tools and alerts and setting policies on how to respond to and recover from an attack (see "Cyber Risk In A New Era: Remedy First, Prevent Second," Sept. 17, 2020). If we view an issuer's risk mitigation policies and practices as weaker than industry standards, it could result in a lower rating than that of peers with similar financial metrics that operate with more robust policies.

We view risk management, culture, and oversight as an aspect of governance within our environmental, social, and governance (ESG) credit factors (see "ESG Brief: Cyber Risk Management In U.S. Public Finance," June 28, 2021). Experienced management teams typically implement comprehensive and proactive policies and practices that address evolving risks like cyber security.

Our view of creditworthiness could shift on operational and financial impacts

In the event of a successful cyber attack, S&P Global Ratings would assess the impact to an issuer's credit quality based on the magnitude and type of attack and subsequent financial and operational disruption.

Operational disruption could:

• Lead to inability to collect rental payments; or
• Interrupt billing procedures.

Unplanned financial costs could result from:

• Potential ransomware payments; or
• Expenditures associated with restoring technology systems.

The financial costs could have an immediate credit impact on an issuer's liquidity. However, in our assessment of creditworthiness, we look at whether financial buffers are available, such as cyber insurance, other forms of liquidity, or even dedicated reserves. In addition, prolonged inability to restore operations, effectively manage communication with stakeholders, or limit the loss of sensitive data, could result in reputational damage if third parties and other stakeholders lose confidence in management's leadership and ability to effectively manage difficult situations.

The Changing Dynamic Of The Cyber Risk Insurance Market

As the risk of cyber incidents increases, so does the demand for and cost of cyber insurance. Insurance providers can provide key services such as IT expertise, crisis management, and data recovery. However, with rising premiums and other investment and training requirements, some issuers are weighing the option of forgoing insurance for other risk management solutions (see "U.S. Public Finance Issuers Face Challenges In An Evolving Cyber Insurance Market," Oct. 3, 2023).

Although cyber insurance is often a critical risk mitigant, an issuer might use other elements in its cyber risk management strategy to guard against cyber incidents. These elements could include rapid detection, comprehensive training, strong IT asset management, and cyber risk pools. Some U.S. affordable housing issuers, as well as many local governments, have been turning to cyber risk pools to replace traditional private market insurance, which has become increasingly expensive and difficult to obtain. These pools allow issuers to combine their money to create a fund that will serve as a source for distribution of claims, managed by a third party. Cyber risk pools are similar to traditional insurance with annual premiums, coverage limits, deductibles and business interruption, and data recovery insurance (see "U.S. Local Governments Are Turning To Cyber Risk Pools For Savings And Security Benefits," March 14, 2024).

Vigilance Is Critical

Despite issuers expanding their efforts to protect against cyber attacks by boosting training, replacing IT infrastructure, and implementing other risk mitigants, cyber attacks are becoming more sophisticated and exposing issuers' vulnerabilities. An issuer's ability to monitor and adjust risk management practices to evolve with changing threats illustrates one way management can demonstrate strong governance that we incorporate into our assessment of creditworthiness. Absent these efforts, there could be negative credit implications from weaker financial positions or management and governance, or transparency issues should cyber attacks lead to an inability to provide certain information we consider in our analysis.