Cyber Essentials for Museums & Galleries
A June 2026 report from the Commons Public Accounts Committee warned that the UK's national museums and galleries remain exposed to cyber-attacks, pointing directly at the ransomware attack that took the British Library's digital services offline for months and criticising DCMS for facilitating discussions after such incidents without driving through any concrete, verified changes across the sector. Museums and galleries increasingly run collection management systems, ticketing and e-commerce platforms, and donor and membership databases online, often on ageing or under-resourced IT with little dedicated security support, which is exactly the combination attackers look for. Funders including Arts Council England, the National Lottery Heritage Fund and DCMS itself are also starting to expect a recognised security baseline as a condition of grant funding, similar to how it already works in the wider charity sector. Cyber Essentials addresses this IT and data security risk specifically; it does not cover the physical security of a collection, such as gallery access control or object theft, which remains a separate discipline.
Why it matters for museums & galleries
A June 2026 report from the Commons Public Accounts Committee warned that the UK's national museums and galleries remain exposed to cyber-attacks, pointing directly at the ransomware attack that took the British Library's digital services offline for months and criticising DCMS for facilitating discussions after such incidents without driving through any concrete, verified changes across the sector. Museums and galleries increasingly run collection management systems, ticketing and e-commerce platforms, and donor and membership databases online, often on ageing or under-resourced IT with little dedicated security support, which is exactly the combination attackers look for. Funders including Arts Council England, the National Lottery Heritage Fund and DCMS itself are also starting to expect a recognised security baseline as a condition of grant funding, similar to how it already works in the wider charity sector. Cyber Essentials addresses this IT and data security risk specifically; it does not cover the physical security of a collection, such as gallery access control or object theft, which remains a separate discipline.
This covers national and independent museums, galleries, heritage trusts and cultural venues of any size, whether run as a registered charity, a public body or a private trust, particularly those applying for grant funding or holding visitor, donor or membership personal data online.
Common threats faced
- Ransomware on collection & ticketing systems
- Donor & membership data breaches
- Legacy, under-resourced IT infrastructure
- Third-party e-commerce & booking platform exposure
Steps to get certified
A guided, hands-on path from scoping to certificate, no jargon, no guesswork.
Scoping
We agree the boundary of your assessment: a device, a network, or your whole organisation.
Self-Assessment
Complete a guided questionnaire against the five technical controls, with our support throughout.
Review
We check your submission and flag anything that needs addressing before it goes for formal assessment.
Certification
Your certificate is issued, backed by IASME/NCSC accreditation, valid for 12 months.
Services we recommend for museums & galleries
Museums & Galleries questions
No, and it's worth being clear about this distinction. Cyber Essentials is entirely about the security of your IT systems, such as staff devices, cloud accounts, collection management software and networks, not the physical security of your galleries or storerooms. Object theft and physical break-ins are addressed by separate measures like access control, CCTV and storage security, which sit outside what this certification covers.
Yes, this is a common starting point. The assessment is a self assessment questionnaire covering practical everyday controls, like keeping software updated and using strong passwords, rather than an enterprise security audit, so it's achievable without a dedicated IT team. Many small heritage organisations find it manageable within a normal working week once they know what's being asked.
It often does, or goes a long way towards it, since certification is a widely recognised way to demonstrate you've addressed basic technical security without a lengthy bespoke questionnaire every time. It's still worth checking the exact wording of your specific funding agreement, since some funders reference their own criteria, but a current certificate is generally strong evidence either way.
Attackers got in through a third-party account that didn't have multi-factor authentication enabled, then moved through the Library's network because of legacy systems and weak segmentation, eventually taking digital services offline for months. Smaller museums and galleries running similarly old systems with basic gaps like this are just as exposed, if not more so, which is exactly the kind of weakness Cyber Essentials is designed to catch and close.
Latest from the blog
Browse related sectors
Get certified in as little as 5 days
Tell us a little about your organisation and we'll send an itemised quote, no obligation, no sales call required to get pricing.