Cyber Essentials for charities and not-for-profits
Who asks charities and not-for-profits for the certificate, which level to choose, what to gather first, the scope problems the sector brings and the questions it commonly fails.
- Mandated by
- No formal mandate; customer and funder requirements
- Common fails
- A6.1A7.17AUTO-FAILA5.9
- Typical scope
- Volunteers' own devices, Donated and second-hand equipment, Shared logins for shop tills and reception PCs, Cloud services nobody listed
- Cyber Essentials
- From £1,500, 1 to 2 weeks, IASME fee included
- Cyber Essentials Plus
- From £3,000, 2 to 5 weeks
No regulator makes Cyber Essentials compulsory for charities. The Charity Commission's cyber crime guidance suggests it, funders can make it a grant condition, and PPN 014 applies when a charity delivers relevant central government or NHS contracts. Scope covers every device and cloud service that reaches charity data, including volunteers' and trustees' own devices.
Do charities need Cyber Essentials?
Not formally. No statutory body mandates Cyber Essentials for charities. It becomes a requirement when a funder writes it into a grant, or when a charity bids for central government or NHS work covered by PPN 014. The question set lets you record a grant authority as your reason for applying (A1.10.3).
Charity Commission for England and Wales
Source checkedIts guidance Protect your charity from cyber crime (27 November 2024) lists joining the NCSC Cyber Essentials scheme among the services and tools for medium and large charities. It is guidance, not a condition of registration (checked 3 November 2026).
Source: Charity Commission, Protect your charity from cyber crime
Cabinet Office (public contracts)
Source checkedPPN 014 tells central government departments, agencies, non-departmental public bodies and NHS bodies to require Cyber Essentials on contracts that handle citizens' personal information, among other characteristics, in procurements from 24 February 2025. It applies to charities bidding for that work like any other supplier (checked 3 November 2026).
NCSC Funded Cyber Essentials Programme
Source checkedOffered free support and Cyber Essentials Plus verification to eligible micro and small charities. The NCSC lists the programme as closed and names no replacement (checked 3 November 2026).
Whatever the source, the contract, grant or tender is what binds you. Read it for the level it names, the scope it expects and the date the certificate must be in place, and record the reason at A1.10 when you apply.
Do charities need Cyber Essentials or Cyber Essentials Plus?
Cyber Essentials meets the Charity Commission guidance and most grant conditions. Choose Plus when a funder or commissioner names it, or when PPN 014 work is judged higher risk: Annex B of the PPN says Plus should be used where the risk of cyber threats is higher.
Both levels use the same five controls and the same question set. Plus adds an independent audit of a sample of devices and cloud accounts, on the same scope as a valid Cyber Essentials certificate. Compare the two levels.
What should charities gather before starting?
Most of the self-assessment is describing your estate accurately. Have these to hand before you open the question set and the answers take hours, not weeks.
- Headcount for A1.3, which counts volunteers, agency workers and contractors with access to charity data, not only paid staff.
- A list of every volunteer and trustee who reads charity email or files on a personal device, with the make and operating system version of each (A2.6, A2.8).
- Every cloud service in use, including the donor CRM, fundraising and payment platforms, volunteer rota tools and the charity's social media accounts, which the question set counts as cloud services (A2.9).
- The Windows 10 devices still in use, and whether each is enrolled in Extended Security Updates; the A6.1 guidance says Windows 10 after 14 October 2025 is only compliant with ESU.
- Evidence that MFA is enforced for every user in the Microsoft 365 or Google Workspace tenant, including trustees and volunteers (A7.17).
What scope problems do charities bring?
Scope must cover every device and cloud service that reaches organisational data, or a sub-set segregated by a firewall or VLAN that you can justify. These are the boundaries this sector tends to get wrong.
Volunteers' own devices
Volunteers who read charity email or open case files on their own laptops or phones bring those devices into scope under BYOD. Each one needs a supported operating system, a screen lock, and anti-malware or an app-store control.
Donated and second-hand equipment
Donated laptops often arrive on Windows 10 without Extended Security Updates, or on macOS versions Apple no longer patches. Both fail A6.1 unless upgraded, enrolled in ESU or removed from scope.
Shared logins for shop tills and reception PCs
A shared 'shop' or 'reception' account fails the unique-credentials requirement. A till with no access to charity data or services is outside scope; one that opens email or the CRM is not.
Cloud services nobody listed
Donor CRMs, fundraising platforms, volunteer rotas and social media accounts are cloud services, cannot be excluded, and need MFA for every user where the service offers it.
Which questions do charities commonly fail?
Questions charities commonly fail include A6.1, A7.17AUTO-FAIL and A5.9. This is a typical pattern from assessor experience, not a statistic, but it is worth planning around.
| Question | Why it fails | Fix |
|---|---|---|
| A6.1Are all operating systems on your devices supported by a vendor that produces regular security updates and vulnerability fixes? If you have included firewall or router devices in your scope, the firmware of these devices is considered to be an operating system and needs to meet this requirement. | Charities often still have Windows 10 devices without ESU, or older Macs that Apple no longer updates, reading charity data. | Enrol Windows 10 devices in ESU, upgrade them, or take away their access to charity data and services so they leave scope. |
| A7.17AUTO-FAILHas MFA been applied to all users of your cloud services, excluding any listed in A7.15 that do not provide it? | MFA tends to be on for staff but not for volunteers and trustees who share the same Microsoft 365 or Google tenant. | Enforce MFA for every account in the tenant, including trustees, and block sign-in for accounts that do not need it. |
| A5.9When a device requires a user to have the device in hand, do you set a locking mechanism on your devices to access the software and services installed? | Field and outreach phones are often left without a screen lock because staff find the PIN inconvenient. | Require a PIN or password of at least 6 characters, or a biometric, through your device management tool or the phone's own settings, and record the setting per device. |
Frequently asked questions
Not nationally at present. The NCSC's Funded Cyber Essentials Programme, delivered by IASME, supported eligible micro and small charities, but the NCSC lists it as closed (checked 3 November 2026). The IASME scheme fee for 0 to 9 staff is the lowest band, £320 plus VAT. Check with your funders, since some grant budgets can cover certification.
Yes if a trustee reads board papers or email on a personal device that connects to the charity's cloud services. The v3.3 third-party devices table lists trustee-owned devices as in scope. The only exception is a device used solely for native calls, native texts or as an MFA authenticator.
For A1.3, yes: the guidance asks for everyone working for the organisation, including volunteers, agency workers and contractors who have access to organisational data. Their devices then count in A2.6 and A2.8 if they reach charity data or services.
It covers every device, network, user account and cloud service that accesses your organisation's data or services, including staff-owned phones and laptops under BYOD. You can certify part of the organisation if the excluded networks are segregated by a firewall or VLAN (A2.1, A2.2.2), but the certificate then reads 'Partial Organisation', which a buyer may question.
Twelve months from certification, and buyers under PPN 014 expect it renewed every year of the contract. Renewal is a fresh self-assessment against the question set current at the time, so a certificate first issued under an older version is reassessed against v3.3 and the Danzell question set when it renews.
Related pages
- Windows 10 and Extended Security UpdatesWhen a Windows 10 device still counts as supported
- Microsoft 365 and Entra ID setupMFA for every user, admin separation
- Google Workspace setup2-Step Verification enforcement for all users
- Android setupScreen lock and updates on volunteers' phones
- Cyber Essentials for charities: funders and grantsThe deep page on this mandate.
- Who needs Cyber Essentials?Government, MoD, NHS and other mandates.
- Scope: what is in and outBYOD, home working, cloud and sub-sets.
- How much does it cost?Fixed prices and IASME fee bands.
- Check your readinessFree check against the 2026 question set.
- Cyber Essentials for schools, academies and multi-academy trusts
- Cyber Essentials for law firms
- Cyber Essentials for accountancy and financial advisers
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials Danzell Question Set 2026Read on iasme.co.uk (opens in a new tab)
- GOV.UKCharity Commission, Protect your charity from cyber crimeRead on gov.uk (opens in a new tab)
- GOV.UKCabinet Office, Procurement Policy Note 014Read on gov.uk (opens in a new tab)
- NCSCNCSC, Funded Cyber Essentials ProgrammeRead on ncsc.gov.uk (opens in a new tab)
Get certified at a fixed price
Precursor is an IASME Certification Body: Cyber Essentials from £1,500 and Cyber Essentials Plus from £3,000, with the IASME fee included, a free re-test if gaps are found and a written fixed price after a 20-minute scoping call.
- IASME Certification Body
- CREST accredited
- UK offices in Leeds, Newcastle, London and Edinburgh