Charity trustees often view cyber security as a technical footnote, something to be handled by a volunteer or a junior staff member. This is a mistake. In the eyes of the Charity Commission and the Information Commissioner's Office (ICO), cyber security is a core governance responsibility. If a charity loses its donor database or its bank account is emptied because of a phishing attack, the board cannot simply point at the IT person. Trustees are legally responsible for the charity’s assets, reputation, and data protection compliance.
Most trustees do not need to know how to configure a firewall. They do, however, need to ensure that someone is doing it correctly and that the board is informed enough to challenge the status quo. This guide outlines exactly what those responsibilities look like in a UK context.
What cyber security governance actually means
For a trustee, cyber security is about the risks you manage, not the software you buy. Governance means ensuring the charity has a clear policy for handling data and a plan for when things go wrong. It also means fostering a culture where staff feel safe reporting mistakes. The Charity Commission’s CC3 guidance is clear: trustees must act with reasonable care and skill. In the modern world, that includes protecting the organisation from digital threats.
This responsibility is not optional. Under the UK GDPR, charities are data controllers. This means the board is responsible for ensuring that personal data, whether it belongs to donors, beneficiaries, or staff, is processed securely. A failure here can lead to more than just a fine from the ICO; it can lead to a total loss of public trust, which is the most valuable asset any charity holds.
Why the Charity Commission cares about your firewall
The Charity Commission views a cyber attack as a serious incident. If your charity falls victim to a significant data breach or financial fraud, you are often required to file a Serious Incident Report. The Commission will look at whether the trustees took reasonable steps to prevent the incident. If the board has never discussed cyber security, or if they ignored previous warnings about outdated systems, the Commission may conclude there has been a failure in governance.
Financial loss is the most immediate risk. We see charities targeted because attackers know they often have smaller IT budgets and less formal training. A common tactic is invoice fraud, where an attacker intercepts an email and changes the bank details on a legitimate invoice. Without proper IT support for charities, these changes go unnoticed until the money is gone. The responsibility to ensure financial controls are fit for purpose lies squarely with the board.
Five questions every trustee board should ask today
Trustees do not need to be technical experts to provide oversight. You can gauge the health of your charity's security by asking five specific questions of your management team or IT provider:
- Do we use Multi-Factor Authentication (MFA) on everything? MFA, which requires a second form of verification like a code on a phone, is the single most effective way to stop account takeovers. If the answer is 'no' or 'only for some people', the charity is at high risk.
- Where is our data backed up, and when did we last test it? Having a backup is only half the battle. If you cannot restore that data quickly, the backup is useless. You should know if your Microsoft 365 backup is separate from the main system.
- Who has 'Global Admin' or 'Super User' rights? These accounts have the keys to the kingdom. They should be limited to as few people as possible and should never be used for daily tasks like reading email.
- How do we manage staff who leave? Many charities forget to revoke access for former volunteers or employees. An active account belonging to someone who left a year ago is a massive security hole.
- Are our devices patched and up to date? This includes laptops, tablets, and phones. If a device is no longer receiving security updates from the manufacturer, it should not be used to access charity data.
Conducting a meaningful annual security review
A pattern we see on most tenants we take on is that 'Global Admin' rights have been handed out to multiple trustees or volunteers who only log in once a quarter, creating a significant and unnecessary security risk. An annual review is the best way to catch these issues before they become incidents.
This review should not be a 50-page technical document. It should be a concise summary that covers your current security posture and any incidents (including 'near misses') from the last year. It should also outline the plan for the next 12 months.
We recommend using the Cyber Essentials framework as a benchmark. Even if you do not choose to go through the formal certification, the five controls it mandates, firewalls, secure configuration, user access control, malware protection, and patch management, provide a solid foundation for any charity board to review. If your IT provider cannot tell you how you meet these five standards, you have a gap in your governance.
Governance failures we see in the third sector
We see several recurring mistakes that expose trustees to unnecessary risk. The first is the 'volunteer trap'. A charity relies on a technically minded volunteer to set up their systems. When that volunteer moves on, they take the passwords and the knowledge with them. The board is left with a system they do not own and cannot control. Trustees must ensure the charity owns its own domains and tenancies. They must also ensure it owns its software licences.
Another common failure is the lack of a 'Bring Your Own Device' (BYOD) policy. Many charity workers use personal laptops or phones. If those devices are not managed, perhaps via Intune device management, the charity has no way to ensure they are encrypted or to wipe charity data if the device is lost. Leaving this to chance is a failure of data protection responsibility.
Finally, there is the 'set and forget' mentality. Security is not a project with a completion date; it is an ongoing process. A system that was secure two years ago may be highly vulnerable today. Trustees must ensure that security is a standing item on the board agenda at least once a year.
FAQ: Charity Trustee Cyber Security
Is a charity trustee personally liable for a data breach? Generally, trustees are not personally liable if they can show they acted reasonably and in accordance with their duties. However, if a breach occurs because the board was grossly negligent, for example, by ignoring repeated warnings about a lack of basic security, the Charity Commission may investigate for mismanagement.
Does our charity need Cyber Essentials? While not always a legal requirement, many grant-making bodies and government contracts now require Cyber Essentials. Even without those requirements, it is the best way for a board to demonstrate they have met the 'reasonable steps' threshold for cyber security governance.
What should we do if we think we have been hacked? Follow your incident response plan immediately. This should include isolating affected systems, notifying your IT provider, and determining if you need to report the matter to the ICO (within 72 hours) and the Charity Commission. Do not wait for a full investigation before seeking professional advice.
How much should a charity spend on cyber security? There is no fixed percentage, but security should be baked into your IT budget, not added as an afterthought. For most charities, moving to a secure platform like Microsoft 365 Business Premium provides the best balance of cost and high-level security features.
The Trustee Security Checklist
Use this checklist to ensure your board is meeting its basic obligations:
- MFA is enabled and enforced for all staff and trustee accounts.
- The charity owns its domain name and has full admin access to its email platform.
- A basic 'Acceptable Use Policy' is signed by everyone using charity kit.
- There is a clear process for offboarding staff and removing their access.
- We have a written plan for what to do in the event of a data breach or ransomware attack.
- The board receives a brief security update at least once a year.
- All personal data is stored in approved, secure cloud locations, not on local hard drives.
How Black Sheep Support helps
We work with charities to take the guesswork out of IT governance. We don't just fix computers; we provide the reporting and oversight that trustees need to feel confident they are meeting their legal responsibilities. Our managed services ensure your systems are patched and your data is backed up. They also protect your staff from the latest threats.
If you are a trustee concerned that your charity's security isn't where it needs to be
and we'll help you understand your current risks and how to close the gaps.
Not ready to talk yet? Run our free IT Health Check to assess your charity's risk and security posture. It takes 30 to 60 minutes with one of our engineers on a Teams call, or 15 to 20 minutes on your own, with no commitment. We also handle hardware, broadband, mobile and networking, providing a complete IT solution for the third sector.
Want this handled for you? See Compliance and Cyber Essentials.
Based in Brighton or Hove? We are too: see IT support in Brighton.
Free, no sales call needed
Two free checks. Know where you stand.
Domain email check
Can someone send email pretending to be you? Is your real email landing in junk? Type your domain and find out in under a minute.
IT Health Check
A short set of questions that scores your security and business risk, and tells you what to fix first. 15 to 20 minutes on your own.
