Trustees are responsible for protecting a charity's money, data and reputation, and a cyber incident can damage all three. A stolen password can lead to a diverted payment. A locked-up laptop can take donor records with it. A leaked spreadsheet can mean a data breach.
You do not need technical knowledge to oversee this. In a small charity the person who looks after IT may be a volunteer, a staff member who drew the short straw, or an outside supplier. What trustees can do is ask clear questions, expect clear answers, and notice when the answers are vague.
Five questions to ask
- Who has access to our accounts, and is there a second sign-in step on every one? Ask for a list of the accounts the charity relies on: email, banking, the donor or beneficiary database, file storage. Ask who can reach each, and whether a second sign-in step, such as an app prompt or a code, protects them. Ask what happens when someone leaves: is their access removed the same day?
- Are our important records backed up, and has anyone tested getting them back? A backup is only worth having if it can be restored, and if the copy cannot be overwritten by whatever damaged the original. Ask when someone last restored something real.
- What do trustees and volunteers use? Personal email and personal devices are common in charities, and they are hard to protect because the charity does not control them. Ask whether charity business happens on accounts the charity owns, and whether devices used for charity work are kept up to date and locked.
- How do we stop payment fraud? Ask whether there is a rule that bank details are never changed on the strength of an email alone, and that an urgent request that appears to come from a senior person is checked by phone on a number the charity already holds. A second person approving changes to payment details is a simple, strong safeguard.
- What is the plan if something goes wrong, and who is responsible? Ask to see a one-page plan: who to call, what to switch off, who tells whom, and who decides what to report. It should be short enough that people will actually use it.
The test is not whether every answer is perfect. It is whether you get a clear, confident answer you can see evidence for, and whether the gaps come with a plan and a date.
If something does go wrong
Several reporting duties can apply at once, and the clocks can run in parallel. This is a pointer to the official guidance, not legal advice.
- The Charity Commission (for charities in England and Wales) asks trustees to report serious incidents promptly. Loss of funds through fraud or cyber crime is the kind of thing it expects to hear about, although it does not expect a report of every blocked attempt. Trustees should also take immediate steps to limit the harm.
- Report Fraud (formerly Action Fraud) is where cyber crime and fraud are reported to the police. The Commission's guidance advises reporting cyber attacks there, and a crime reference number is often needed for other reports.
- The Information Commissioner's Office must be told about a personal data breach that is likely to risk people's rights and freedoms, without undue delay and no later than 72 hours after the charity becomes aware of it. Every breach, reportable or not, should be recorded.
Charities in Scotland and Northern Ireland report to their own regulators, so check the right one for your charity.
Keeping it proportionate
Cyber security for a charity does not need a large budget, but it does need ownership. Add cyber risk to the risk register, ask for a short update at least once a year, and decide who the named owner is. Funders, insurers and larger partners often ask charities for evidence of their controls, and independent certification such as Cyber Essentials can be a convenient way to give it. We explain what it involves in our guide to Cyber Essentials.
Free official help
The government and the NCSC publish free guidance written for small organisations and charities. Start with Protect your charity from cyber crime and the NCSC's small organisations guide to cyber security. For breaches, see the ICO's 72-hour guide.