Sector guide

Cyber Essentials for charities and non-profits

Charities are increasingly targeted precisely because they hold donor and beneficiary data while typically running some of the smallest security budgets of any organisation type, often with no in-house IT security function at all. At the same time, funders and grant-giving bodies are more likely than they used to be to ask about an organisation's security posture as part of due diligence.

Charities are increasingly targeted precisely because they hold donor and beneficiary data while typically running some of the smallest security budgets of any organisation type.

Cyber Essentials tends to fit well here because it's recognisable and affordable relative to the alternative of building a bespoke security programme. The scoping challenges are also distinctive: volunteers using their own devices, high turnover of staff and volunteers that makes access control harder to keep tidy over time, and a patchwork of free or donated software tools that's common in the sector but not always properly secured.

None of this makes certification harder in principle, it just means the starting point is often less tidy than a typical small business, and worth checking before committing any budget.

Worth knowing

The starting point is often less tidy than a typical small business, mainly volunteer devices, staff turnover, and a patchwork of donated tools, but none of that makes certification harder in principle.

Run the free 5-minute readiness check for a no-cost, no-obligation look at where the organisation stands today.