In short: Cyber Essentials for charities works exactly as it does for businesses, with one big practical difference: volunteers' and trustees' own devices that access charity data or services are in scope. Charities usually need to tidy up shared accounts, replace donated or unsupported equipment and turn on MFA before applying, and some funders and commissioners ask for the certificate.
Why charities certify
There is no general legal requirement for charities to hold Cyber Essentials, but there are good reasons to:
- Funders and commissioners ask for it. Public bodies buying services under PPN 014, local authorities and some grant-makers expect a current certificate, particularly where the charity handles personal data. Always read the funding agreement or tender for the level required.
- Trustees need assurance. Cyber risk is part of trustees' oversight. A certificate is independent evidence that the basics are in place, and the Cyber Governance Code of Practice gives larger charities' boards a framework for the wider questions.
- Data about vulnerable people. Service user records, safeguarding notes and donor details are valuable to criminals. The five controls are designed to protect against the most common untargeted internet attacks.
- Included insurance. Eligible UK-based organisations with turnover under 20 million pounds that certify their whole organisation receive cyber liability insurance arranged by IASME, including 24/7 incident response.
Volunteers, trustees and whose devices are in scope
This is where charities differ most from businesses. The NCSC requirements include a device ownership table, and in summary:
| Device owner | Accesses charity data or services? | In scope? |
|---|---|---|
| Charity-owned devices | Yes | Yes |
| Employee-owned devices (BYOD) | Yes | Yes |
| Volunteer-owned devices | Yes | Yes |
| Trustee-owned devices | Yes | Yes |
| Any personal phone used only for calls, texts or an authenticator app | No | No |
| Contractor or managed service provider devices | Their own equipment | No, but the accounts they use in your systems are |
The same table puts student-owned devices out of scope, and devices the charity owns but lends to volunteers or others in scope.
In practice a trustee who reads board papers on a personal tablet through the charity's cloud storage, or a volunteer who logs in to the case management system from a home laptop, brings that device into scope. It then needs a supported operating system, updates within 14 days, a screen lock, malware protection and a firewall.
You have three practical options: provide charity devices to the people who need regular access, bring personal devices under management (for example app protection policies in Microsoft Intune), or restrict access from unmanaged devices. See BYOD and home working for the detail.
Donated equipment, shared mailboxes and other charity pitfalls
These are the issues we see most often in charities:
- Donated or very old computers. If they run an operating system or software that no longer receives security updates, they fail. Unsupported software in scope is an automatic fail, and that includes Windows 10 devices not enrolled in Extended Security Updates. See Windows 10 and Cyber Essentials.
- Shared logins. A single "office" account or a shared password for the info@ mailbox breaks the requirement for unique credentials. Give each person their own account and grant access to shared mailboxes rather than sharing a password.
- Everyday use of admin accounts. Whoever looks after IT, often a volunteer, needs a separate admin account used only for admin tasks.
- Cloud services without MFA. Under the Danzell question set, a cloud service that offers MFA but does not have it turned on fails the whole assessment. That includes donor databases, fundraising platforms and email. See Cyber Essentials MFA.
- Leavers and inactive volunteers. Accounts must be removed when people leave or stop volunteering. A regular review of who still has access fixes this.
- Charity shops and branch sites. Tills, back-office PCs and shop routers that connect to the internet are part of the organisation unless they are genuinely segregated in a defined sub-set.
Our common failures guide covers these and more.
Scoping a charity sensibly
Certifying the whole charity is simplest, and it is required for the included insurance. Some charities instead certify a well-defined part, such as head office or a particular service, separated by a firewall or VLAN. If you go that way:
- The sub-set must include end-user devices; a scope of servers only is not acceptable.
- Cloud services used by that part of the charity cannot be excluded.
- Every in-scope legal entity must be listed. Charities with a trading subsidiary should check whether it shares systems and needs to be named.
- Exclusions must be justified, and buyers will see your scope description on the digital certificate.
See defining your Cyber Essentials scope for the full rules.
Free help and the funded programme
The NCSC's Funded Cyber Essentials Programme, delivered through IASME, gave eligible small charities (and later domestic abuse charities) around 20 hours of free expert support. The NCSC described the programme's third year as its final one, and we found no open round in October 2026; our funded Cyber Essentials page explains where it stands and what to check for.
Free help still available includes IASME's question set booklet and Cyber Essentials Readiness Tool, a free 30-minute session with an NCSC-assured Cyber Advisor for small and medium-sized organisations (see the NCSC Cyber Advisor scheme), and the NCSC's cyber security advice for small and medium-sized organisations, which also covers charities. Our Cyber Essentials checklist is free too.
How we help charities
Forever Systems helps charities get ready for Cyber Essentials and supports them through assessment alongside an IASME-licensed Certification Body; we do not issue certificates. We start with a gap analysis that maps who uses which devices and services, including volunteers and trustees, then help you fix what is needed in the most economical way: switching on features you already have, tidying accounts and replacing only what must go.
Training volunteers and staff to spot phishing is just as important, and our sister site covers security awareness training. Pricing depends on your size and set-up, so ask us for a quote. Contact us to talk it through.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Are volunteers' personal devices in scope for Cyber Essentials?
Yes, if they access the charity's data or services, for example email, cloud files or a case management system. A personal phone used only for calls, texts or an authenticator app is out of scope.
Do trustees' devices need to meet Cyber Essentials?
If a trustee uses a personal device to access charity data or services, such as board papers in cloud storage or charity email, that device is in scope and must meet the controls. Providing a managed device or restricting access avoids the issue.
Is there free Cyber Essentials for charities?
The NCSC's Funded Cyber Essentials Programme, which supported small charities, was described by the NCSC as being in its final year, and we found no open round in October 2026. Free tools remain, including IASME's question set booklet and Readiness Tool and a free 30-minute Cyber Advisor session for small and medium-sized organisations. The assessment fee itself is payable.
Can donated computers be used if we want Cyber Essentials?
Only if their operating system and software are still supported and receive security updates. Unsupported software in scope is an automatic fail, so check the end-of-support date before accepting donated equipment.
Do funders require Cyber Essentials?
Some do, especially public bodies commissioning services that involve personal data. Requirements vary, so check each funding agreement or tender for whether Cyber Essentials or Cyber Essentials Plus is needed and when.