Cyber Essentials for charities: same scheme, three charity-shaped wrinkles

Why charities get asked

The request almost always follows the money: grant agreements, council service contracts and NHS partnerships increasingly carry supplier-security conditions, and Cyber Essentials is the baseline they name. Charities also hold exactly the data attackers want — donor details, beneficiary records, sometimes safeguarding information — so the controls have real value beyond the funding condition. Read the funder’s wording literally: “Cyber Essentials” means the basic self-assessed level; Plus is named when meant — the comparison guide shows how to tell.

What’s identical to any small organisation

The five controls, the scope rules, the questionnaire, and the fee tiers, which follow the size of the organisation. Count that size carefully: the questionnaire’s headcount question (A1.3) asks you to include volunteers — along with agency workers, contractors and anyone else who has access to your organisation’s data — so a charity with a handful of staff and a large volunteer team may be bigger than it first thinks. Confirm which tier applies with your certification body. (Check current pricing on iasme.co.uk; we don’t state discounts we can’t verify.) The plain-English guide and step-by-step route apply unchanged. The declaration is approved by a board-level representative — for a charity, usually a trustee — exactly as an owner would for a company.

Wrinkle 1: volunteers’ devices

The BYOD rule doesn’t distinguish employees from volunteers: a personal device is in scope the moment it accesses the charity’s email, files or data, and exempt only when used solely for the phone’s built-in calls and texts, or two-factor codes. A volunteer checking the charity mailbox on their own phone puts that phone in scope — the single most common charity scope surprise. The honest options are the same as for staff: the device meets the BYOD requirements, or the volunteer works without charity data on their personal kit. The free BYOD policy is written to be fair about exactly this choice.

Wrinkle 2: the shared login that outlived everyone

Charities accumulate shared accounts — the admin@ mailbox three coordinators use, the social accounts whose password lives in a drawer, the fundraising platform login from two treasurers ago. Every one is a gap under A7.2, and worse, nobody can say who still has access. Convert mailboxes to shared/delegated mailboxes opened from individual accounts, give each person their own login everywhere, switch on MFA, and do a one-off leaver sweep for every ex-volunteer and ex-trustee who ever had access.

Wrinkle 3: donated and elderly kit

The donated laptop doing the accounts may be the charity’s biggest problem: an unsupported operating system anywhere in scope fails the assessment outright, and there is no setting that fixes it — upgrade, replace, or genuinely wall it off. Budget honestly for this before paying the assessment fee; it is the one cost that can’t be configured away, and grant lines for equipment sometimes cover it.

A charity-shaped order of work

1. List everything in scope — including volunteers’ in-scope devices and every cloud service, the fundraising and social platforms included (the register template).
2. Sort the shared logins and run the ex-people sweep.
3. MFA everywhere — the gap checker takes minutes.
4. Deal with any unsupported device; it decides the result on its own.
5. Settings pass, short policies, then buy the assessment at your size’s fee.