Photo by Emanuel Ekström on Unsplash
If your museum or gallery depends on grant funding from Arts Council England, the National Lottery Heritage Fund, or DCMS, something is shifting in how that funding is awarded. It affects your IT setup as much as your finance team, and it is worth understanding now rather than when your next application is sitting in front of you.
A Public Accounts Committee report published in June 2026 called on grant-making bodies to do something parts of the charity sector already experience: attach clear cyber security conditions to funding decisions. The principle is straightforward. Public money now comes with a growing expectation that the organisations receiving it can demonstrate basic digital hygiene. If your application cannot address this, it may affect your chances of success or trigger additional scrutiny when funding is reviewed.
Why Grant Funders Are Paying Attention to This Now
The cultural sector has not been insulated from cyber incidents. Attacks affecting publicly funded arts and heritage organisations have created real operational problems: visitor records exposed, donor data compromised, systems that cannot simply be taken offline for a few days while IT works through a recovery. When a gallery loses access to its ticketing system or membership database mid-season, the damage is immediate and visible to everyone.
Grant makers funding these organisations with public money are increasingly uncomfortable not knowing whether recipients have basic protections in place. The PAC report accelerated a direction that was already moving. The expectation of digital due diligence is no longer reserved for large corporate recipients of government contracts. It is arriving for smaller cultural organisations too, and the arts and heritage sector needs to be ready for it.
What Cyber Security Questions in a Funding Application Actually Look Like
No single mandatory format has been set across all funders yet, but the emerging pattern follows something already familiar to anyone who has applied for certain government-adjacent contracts. You may be asked to confirm:
- Whether your organisation holds a recognised cyber security certification
- How you protect staff devices and systems from malware and unauthorised access
- How you manage software updates and address known vulnerabilities
- How you control who has access to sensitive systems and data
- What your approach is to staff awareness of phishing and social engineering
The UK government's own baseline standard for exactly these questions is Cyber Essentials. It is a certification scheme covering five specific technical controls, and it is the standard that grant bodies and government-linked funders increasingly recognise and reference. It is not the most demanding certification available, but for organisations that have never been through a formal assessment before, it is an achievable and credible starting point.
What Cyber Essentials Covers and What It Does Not
This distinction matters, and it is worth being precise about it in any funding application.
Cyber Essentials and Cyber Essentials Plus cover your IT and digital environment: the security of your internet connection, the configuration of your devices and software, how you control who can access what, how you protect against malware, and how consistently you apply software updates. These are the controls that stop the vast majority of common cyber attacks from succeeding.
They do not cover physical security within your building. Gallery access control, object protection, CCTV infrastructure, key management, and alarm systems sit outside the scope of these certifications entirely. A funder asking about cyber security is asking about your digital infrastructure. Do not imply in an application that a cyber certification addresses risks it was never designed to cover, and do not conflate the two when describing your security posture.
Practical Steps for Museums and Galleries Right Now
If a grant application or renewal falls within the next twelve months, here is where to concentrate your effort.
Find out where you actually stand before you apply for anything
Most museums going through this for the first time genuinely do not know whether they would pass a Cyber Essentials assessment today. A pre-assessment conversation gives you a realistic picture of what would need to change before a formal application. That picture is far more useful early than it is the week before a funding submission deadline.
Think of certification as a durable funding asset
Cyber Essentials certification, once held, can be referenced in every subsequent funding application. It is a concrete, verifiable answer to a question funders are increasingly asking. For an organisation that applies to multiple funders in any given year, that is a genuinely useful thing to hold. The Cyber Essentials Certification Package sets out what the process involves for organisations going through it for the first time.
Do not overlook the human side of your security posture
The most common route into a museum's systems is not a sophisticated technical exploit. It is a member of staff acting on a convincing phishing email. Security awareness training does not need to be lengthy to make a genuine difference, and evidence that your team knows how to spot and report suspicious messages complements a technical certification well when a funder wants reassurance beyond a checkbox.
Build time into your calendar, not your submission week
Cyber Essentials certification is not something that can be arranged in 48 hours. Well-prepared organisations move through the assessment relatively quickly, but if your systems need configuration changes first, those take time. Apply for certification well before your funding deadline. Treating it as something to sort after the application goes in is the kind of thing that creates problems at renewal stage.
A Practical Takeaway
Grant funders are beginning to ask questions that your IT setup needs to be able to answer. Getting ahead of that, rather than scrambling when the application form lands, is the straightforward move. If you want to understand how your current setup sits against what is expected, the Museums and Galleries page covers how CyberStark supports cultural sector organisations specifically, from initial assessment through to certification via an accredited certification body.