Cyber Essentials for Charities & Not-for-Profit
Many grant-making bodies and funders now write a recognised security standard into their funding agreements, particularly where the grant involves handling beneficiary or donor data, so certification can genuinely affect what funding you're eligible to apply for. Charities collect and hold real personal information about donors, beneficiaries and often vulnerable individuals, while typically running on stretched budgets with little dedicated IT support, which is exactly the combination that makes basic security gaps more likely and more costly when they're exploited. Payment diversion fraud, where a criminal impersonates a supplier or a senior colleague to redirect a donation or invoice payment, has hit charities of every size and is often preventable with the kind of basic controls Cyber Essentials checks for.
Why it matters for charities & not-for-profit
Many grant-making bodies and funders now write a recognised security standard into their funding agreements, particularly where the grant involves handling beneficiary or donor data, so certification can genuinely affect what funding you're eligible to apply for. Charities collect and hold real personal information about donors, beneficiaries and often vulnerable individuals, while typically running on stretched budgets with little dedicated IT support, which is exactly the combination that makes basic security gaps more likely and more costly when they're exploited. Payment diversion fraud, where a criminal impersonates a supplier or a senior colleague to redirect a donation or invoice payment, has hit charities of every size and is often preventable with the kind of basic controls Cyber Essentials checks for.
This covers registered charities, NGOs and other not-for-profit organisations of any size, particularly those applying for grants or contracts that specify a security requirement, or that hold donor and beneficiary personal data.
Common threats faced
- Donor data theft
- Payment diversion fraud
- Limited IT resource for defence
- Phishing exploiting volunteer access
Steps to get certified
A guided, hands-on path from scoping to certificate, no jargon, no guesswork.
Scoping
We agree the boundary of your assessment: a device, a network, or your whole organisation.
Self-Assessment
Complete a guided questionnaire against the five technical controls, with our support throughout.
Review
We check your submission and flag anything that needs addressing before it goes for formal assessment.
Certification
Your certificate is issued, backed by IASME/NCSC accreditation, valid for 12 months.
Services we recommend for charities & not-for-profit
Charities & Not-for-Profit questions
Yes, and this situation is common among smaller charities. The assessment is designed to be answerable without deep technical expertise, and many of the required controls, like keeping software updated and using strong passwords, are things a volunteer-run charity can put in place without hiring dedicated IT support.
Raise this with the funder directly and as early as possible, since some allow a grace period or accept a plan to achieve certification rather than requiring it on day one. Standard Cyber Essentials can usually be completed relatively quickly once you know what's required, so it's often achievable within a typical funding timeline if you start promptly.
Generally yes, if those personal devices are used to access your charity's email, donor records or other organisational data, since the assessment looks at anything that can reach that information, not just organisation-owned equipment. This is worth flagging early, as it's a common gap in volunteer-heavy charities.
If donations go through a reputable third-party platform, the card payment handling itself usually sits with that provider rather than your charity directly, which reduces your own exposure. What still matters is how your staff or volunteers access the platform's admin area and any donor records you store separately, which is where Cyber Essentials focuses its attention.
Latest from the blog
Browse related sectors
Get certified in as little as 5 days
Tell us a little about your organisation and we'll send an itemised quote, no obligation, no sales call required to get pricing.