Cyber Essentials for charities

Charities hold donor and beneficiary data, move money, and often run on donated kit and volunteers' phones. Attackers know it.

Why it matters for charities

• Trustees are responsible. The Charity Commission expects trustees to manage cyber risk as part of their duty of care, and has published guidance with the NCSC on protecting charities from cybercrime and fraud.
• Funders and partners ask. Grant makers, councils and NHS commissioners increasingly ask about cyber security in due diligence, and some contracts require Cyber Essentials.
• Your suppliers are a risk too. In 2026 the Charity Commission issued guidance after a cyber incident at Beacon, a CRM widely used by charities. You can't control a supplier's security, but you can control your own accounts and data.

Things that trip charities up

• Volunteers' own devices. If a volunteer reads charity email on their phone, that phone is in scope. The simplest fix is often to give volunteers web-only access through a browser, with multi-factor login.
• Old donated computers running software that no longer gets updates. These have to be updated, replaced or taken out of scope.
• Shared logins for the office account or the CRM. Give everyone their own login.
• Admin rights everywhere. Day-to-day accounts shouldn't be administrators.

Free help

The NCSC publishes a free Small Charity Guide and free online training for small charities. Many charities can also get discounts and free tech through schemes for the sector, and some qualify for funded Cyber Essentials.

Getting started

1. List the devices, accounts and cloud services used for charity work, including volunteers'.
2. Turn on multi-factor login for email and your CRM.
3. Put a trustee in charge of cyber risk and review it once a year.
4. Work through the Cyber Essentials questions, then certify.