Cyber Essentials for charities

Do charities need Cyber Essentials?

Not by law. Charities need Cyber Essentials when a funder, commissioner or public sector contract asks for it, and the five controls suit the mixed, lightly managed estates most charities run.

Charities hold beneficiary records, donor data and often safeguarding information, run on a mix of donated laptops, personal phones and cloud services, with few staff whose job is IT. That is exactly the estate the Cyber Essentials controls were designed to protect.

The commercial reasons are the same as for companies. Charities delivering services under contract to central government, agencies, non-departmental public bodies or NHS bodies come under PPN 014 for procurements commenced from 24 February 2025, where the contract involves personal information or government data. The note also tells buyers not to over-burden suppliers or deter voluntary, community and social enterprises from bidding, and says other public bodies may wish to apply the same approach.

The Charity Commission's guidance Protect your charity from cyber crime lists the Cyber Essentials scheme, alongside the government's Cyber Governance Code of Practice, among the services and tools for medium and large charities. It is guidance, not a registration condition.

Question A1.2 asks what type of organisation you are, and "Registered Charity" is one of the options. The controls are marked the same way whatever you select. If a funder is the reason you are applying, A1.10.3 asks you to name the grant authority.

Is there funded certification for charities?

Not through a national programme at present. The NCSC's Funded Cyber Essentials Programme, delivered by IASME, gave free hands-on support to small organisations in sectors at high risk of attack. IASME's January 2023 announcement opened it to micro and small charities that process personal data, with 20 hours of support followed by Cyber Essentials Plus verification. The NCSC page now states that the programme is closed.

Checked against the NCSC Funded Cyber Essentials Programme page (last reviewed 27 March 2025) on 3 November 2026.

What is in scope for a charity?

More than most charities expect. Under v3.3, user-owned devices that access organisational data or services are in scope, and that includes devices owned by volunteers and trustees, not just employees. The only exemptions are devices used solely for native voice calls, native text messages or as an MFA authenticator.

Question A2.8 asks for the quantity and operating systems of tablets and mobile devices in scope. A charity with thirty volunteers reading rota emails on personal phones has thirty in-scope phones, each needing a supported operating system, device locking and the other controls.

Cloud services cannot be excluded. Microsoft 365 or Google Workspace, the CRM, the donation platform and the case management system are all in scope, and each needs MFA enforced for every user and administrator.

What does the included insurance give a charity?

Charities with a UK or Crown Dependency head office and turnover under £20 million that certify whole-organisation scope can opt in to the included cyber liability insurance at A3.2. The cover is £25,000 and comes with a 24/7 incident helpline. For a small charity without a standalone cyber policy, the helpline alone is worth having: it gives you someone to call at 2am when the finance officer clicks the wrong link.

Should a charity choose Cyber Essentials or Cyber Essentials Plus?

Cyber Essentials is enough for most charity funders and commissioners. Plus is worth considering where a commissioner specifies it, where the charity provides IT or data services to other organisations, or where trustees want independent evidence rather than a declaration. IASME requires the Plus audit within three months of the Cyber Essentials certification, on the same scope.

What should a charity prepare before starting?

The question set guidance says a Windows 10 device used after 14 October 2025 must be enrolled in Microsoft's Extended Security Update programme to stay compliant. See Windows 10 support status for what that involves, and the Microsoft 365 setup guide for enforcing MFA across a tenant.

How much does Cyber Essentials cost a charity?

The IASME scheme fee is £320 to £600 plus VAT by headcount; assessor support costs more. With Precursor, Cyber Essentials is from £1,500 + VAT with the IASME scheme fee included, and Cyber Essentials Plus is from £3,000 + VAT with Cyber Essentials included and a free re-test after remediation. A standalone gap analysis is from £500 + VAT and is often the right first step for a charity that does not know how many devices it has.