Cyber security for charities: five questions trustees should ask

If your systems stopped tomorrow, could your charity still deliver its purpose?

Trustees play a vital role in protecting their charity’s purpose. To do that effectively, boards need evidence that key risks are being managed. Cyber security belongs firmly within that conversation.

Imagine arriving on Monday morning to discover that your charity cannot access its email, case-management system, finance platform or shared files. Staff cannot see beneficiary records. Volunteers do not know where they are needed. Payroll and supplier payments are approaching. Fundraising activity has stopped. Nobody knows whether sensitive information has been stolen or when systems will be restored.

The immediate questions would not be especially technical.

Which services must continue? How will we protect vulnerable beneficiaries? Can we still make essential payments? Who decides whether an incident must be reported? What should we tell employees, donors, commissioners and the public?

These are questions of governance, resilience and stewardship. They sit squarely within the trustee board’s responsibilities.

Why cyber security matters to charity trustees

Technology now underpins almost every aspect of a modern charity. It supports fundraising, financial management, safeguarding, service delivery, communications and the handling of personal information.

That dependence creates risk. A cyber incident may cause more than an IT outage. It can interrupt services, expose sensitive data, divert management attention, create unexpected costs and undermine confidence among beneficiaries, donors, funders and employees.

Smaller charities are not exempt. They may hold valuable personal and financial information, rely heavily on email and online banking, or depend on a small number of people and technology suppliers. Limited internal capacity can also make recovery more difficult.

The latest Cyber Security Breaches Survey 2025/2026 found that 28% of UK charities identified a cyber breach or attack during the preceding 12 months, equivalent to approximately 57,000 charities. The survey also cautions that some incidents go unidentified or unreported, so the true prevalence may be higher.

The purpose of citing that figure is not to manufacture urgency. It is to demonstrate that cyber incidents are a credible operational risk. Trustees should approach them in the same way they would other material risks to the charity’s objectives: understand the exposure, establish accountability, test the arrangements and monitor whether risk is being managed.

What charity trustees need to know about cyber security

Trustees are not expected to configure security systems or supervise the IT team. They should, however, be able to determine whether the charity is taking reasonable and proportionate steps to protect its people, funds, information and services.

The Charity Commission guidance on protecting charities from cyber crime makes the position clear: cyber security may be delegated to an employee, IT team or external provider, but all trustees remain responsible for making sure the charity is appropriately protected.

Delegation is therefore necessary, but it is not the same as transferring accountability.

Trustees should be particularly cautious where assurance rests on statements such as:

• “Our IT supplier looks after cyber security.”
• “Our data is in the cloud.”
• “We have never experienced an incident.”
• “We have backups.”
• “Cyber is covered in our risk register.”

Each statement may be true, but none demonstrates by itself that the charity can withstand and recover from a serious incident.

An external IT provider may deliver valuable support without being responsible for every aspect of security. Cloud services still require appropriate access controls and configuration. An incident may have occurred without being detected. Backups may exist but prove incomplete or difficult to restore. A risk register may document the risk without showing that controls work.

Trustees should seek evidence, not absolute certainty.

Five cyber security questions for charity trustees

1. Which charity services could stop after a cyber incident?

The board should understand which systems and suppliers support the charity’s most important activities.

This is not simply a list of applications. Trustees need to know what the operational consequences would be if a core system became unavailable for a day, a week or longer. Could essential services continue manually? Could staff contact beneficiaries safely? Could the charity process grants, salaries and urgent supplier payments?

The answer establishes where resilience matters most.

2. What information would be at risk?

Charities may hold personal information about beneficiaries, children, donors, employees, volunteers and supporters. Some of it may be highly sensitive.

Trustees should understand what important information the charity holds, where it is stored, who can access it and whether access remains appropriate. Particular attention should be given to former employees and volunteers, privileged administrator accounts, shared credentials and third parties with access to systems.

The objective is not to review every user account at board level. It is to obtain confidence that access is controlled, reviewed and removed promptly when no longer required.

3. How can trustees check that cyber security measures work?

Policies and management explanations are useful, but they do not always reflect what is happening in practice.

Independent, evidence-based testing can help identify the gap between assumed and actual protection. Depending on the charity’s size and risk profile, this might include:

• reviewing multi-factor authentication and privileged access;
• assessing security settings within Microsoft 365 or Google Workspace;
• checking endpoint security coverage;
• scanning internet-facing systems for significant vulnerabilities;
• examining joiner, mover and leaver controls;
• reviewing backup arrangements and evidence of restoration testing;
• assessing oversight of managed service providers;
• evaluating readiness for Cyber Essentials.

Not every charity requires every test. The response should be proportionate to its services, information, technology dependence and available resources.

4. Could the charity get essential services running again?

An incident-response plan is useful, but it must work under pressure.

Trustees should know who would lead the response, which external specialists would be contacted, how decisions would be recorded and how the charity would communicate if normal systems were unavailable. Arrangements should also cover legal, regulatory, insurance and stakeholder considerations.

A practical exercise can reveal issues that a written plan will not. For example, contact information may only be stored on inaccessible systems. Authority to make urgent decisions may be unclear. The IT provider and insurer may assume that the other will coordinate the response.

A short, realistic exercise can expose these dependencies before they become part of a live crisis.

5. What cyber security updates do trustees need?

Trustees need concise information that helps them exercise oversight. Large volumes of technical data are rarely useful.

A proportionate trustee dashboard might cover:

• significant incidents and lessons learned;
• multi-factor authentication coverage;
• critical vulnerabilities and overdue remediation;
• backup restoration test results;
• completion of priority actions;
• material supplier issues;
• employee training and phishing results;
• exceptions requiring risk acceptance or investment.

Reporting should explain the business consequence, not simply display technical measures. It should also distinguish between management assertion and independently verified evidence.

Cyber security checks for charities of different sizes

A small charity may reasonably focus on a limited set of essential controls: secure email, multi-factor authentication, payment authorisation, reliable backups, supported devices and a simple response plan. The Charity Commission’s cyber-crime guidance recognises that straightforward and inexpensive measures can materially reduce exposure.

A medium-sized charity may need greater assurance over access management, sensitive data, outsourced technology, continuity arrangements and the consistency of controls across multiple systems or locations.

A large or complex charity may require formal cyber-risk reporting, internal and external assurance, supply-chain oversight, incident exercises and investment plans for legacy technology.

Proportionality should not become an excuse for inaction. Equally, good governance does not mean imposing enterprise-level requirements on every small charity. The right question is: are the arrangements reasonable for the potential harm to beneficiaries, services, funds and information?

How independent checks help trustees understand cyber risks

The strongest trustee boards do not try to eliminate every cyber risk. That would be unrealistic and unaffordable. Instead, they understand which risks matter most, make informed choices and obtain evidence that critical controls and recovery arrangements work as intended.

A proportionate independent review can help trustees move beyond reassurance by:

• identifying vulnerabilities that may disrupt services or expose sensitive information;
• testing whether key controls operate as management believes;
• assessing whether recovery arrangements are likely to work in practice; and
• translating technical weaknesses into clear priorities for the board.

Our Cyber & IT Assurance team supports charities through trustee briefings, cyber health assessments, independent control testing and incident-response exercises. Our work is tailored to the charity’s size, risk profile and resources, with a clear focus on protecting beneficiaries, funds and essential services rather than imposing unnecessary technical complexity.

Start with one simple question:

If our systems stopped tomorrow, could we still deliver our charitable purpose?

If the answer is unclear, that does not necessarily mean the charity is insecure. It means trustees may need better evidence.