Cybersecurity for Charities: A Practical Guide for Trustees and Staff

Most charities can cut their cyber risk with five steps: individual accounts with MFA, a check before any payment change, regular backups, up-to-date devices and a plan for what to do after an attack. The Charity Commission is clear that trustees stay responsible for this, even when they delegate the work.

What trustees are responsible for

The Charity Commission's guidance, Protect your charity from cyber crime (published 27 November 2024, for England and Wales), says trustees must be aware of the risks, take reasonable steps to protect the charity and respond properly to attacks. You may delegate cyber security to an IT team or provider, but all trustees remain responsible for making sure the charity is protected.

Charities are targets for the same reasons as businesses. They store data about employees, volunteers, donors and beneficiaries, use online banking and fundraise online.

The attacks charities see most

The Commission names phishing as the most common type of attack: a message that tricks someone into visiting a malicious site to steal passwords or bank details, or to install malware. Attackers often pose as a trustee or the charity's bank. Ransomware, which locks your files and demands payment, is a common form of malware.

Criminals also set up fake websites that copy a real charity to steal donations. That is not an attack on your systems, but it can damage trust in your name, and the Commission asks charities to report it.

Five steps that cover most of the risk

Manage volunteer and short-term access

Volunteers often need a calendar, a shared folder or a mailbox for a few weeks. Give them a named account with only that access and set an end date. When a volunteer finishes, remove the access the same day. Our offboarding checklist covers the steps in more detail.

Is Cyber Essentials worth it for a charity?

Cyber Essentials is the UK government's recommended minimum standard, built on five controls: firewalls, secure configuration, security update management, user access control and malware protection. The NCSC lists self-assessment costs starting at £320 plus VAT. UK organisations with turnover under £20 million that certify their whole organisation are entitled to cyber liability insurance arranged by IASME. Some funders and partners ask for it, so check before you apply for grants or contracts.

What to do if you are attacked

If an attack is happening now, the Charity Commission directs charities to the Report Fraud 24/7 helpline on 0300 123 2040. Contact your bank if money may have moved, and your IT support to contain the problem. Afterwards, trustees should consider whether it is a serious incident to report to the Commission; its serious incident guidance explains how.

For nonprofits outside the UK

The same steps apply. In the US, CISA's cyber guidance for small businesses sets out MFA for administrator accounts, prompt patching, tested backups and an incident response plan approved by leadership. Check which reporting rules apply where you operate.

BPro's IT support for charities and not-for-profits covers staff and volunteer access, devices, Microsoft 365 and backups, with a single helpdesk route.