Cyber security checklist for charity trustees

Cyber security is a trustee responsibility. The Charity Commission’s guidance is clear that even when the work is delegated, “all the trustees remain responsible for making sure your charity is protected”. The government’s latest Cyber Security Breaches Survey found that 28% of charities identified a breach or attack in the last twelve months, rising to 57% of those with an income over £500,000. Yet only 30% have a trustee with responsibility for cyber security. This checklist is written for the board rather than the IT team: the questions to ask, and the answers that should worry you.

What the latest figures say

The Cyber Security Breaches Survey 2025/2026, published by the government in April 2026, surveyed 1,085 charities. The larger the charity, the more likely it was to have spotted a breach or attack:

Phishing affected a quarter of all charities. 14% were victims of cyber crime, 30% had a trustee with responsibility for cyber security, 19% had a formal incident response plan, and only 5% had a specific cyber insurance policy.

The trustee checklist

Governance

• Does one trustee take the lead on cyber security, and does the board discuss it at least once a year?
• Is cyber risk in our risk register, with a named owner and actions?
• Do we know which suppliers hold our data, such as our CRM, donation platforms, email and payroll, and what our contracts say about breaches? When a supplier is breached, your charity is usually still the data controller. Our guide to supplier security incidents explains what that means.

Accounts and access

• Is multi-factor authentication switched on for email, the CRM, banking, social media and the website?
• Do we remove access promptly when staff, volunteers or trustees leave?
• Do trustees use charity accounts, not personal email addresses, for charity business?

Devices, software and the website

• Are laptops, phones and tablets kept up to date, including volunteers’ and trustees’ own devices used for charity work?
• Are critical security updates applied within 14 days?
• Is the website running supported versions of WordPress, its plugins and PHP? Our free WordPress version checker is a quick first look, and PHP 8.2 stops getting security fixes on 31 December 2026.

Data and backups

• Do we back up important data, keep a copy separate from our everyday systems, and test that we can restore it?
• Do we know what personal data we hold, and do we delete what we no longer need?

Email and domains

• Does our domain publish SPF, DKIM and an enforcing DMARC policy? In our research, 87% of UK charity domains publish no enforcing DMARC policy, which makes them easier to impersonate. See the research.
• Do we control our domain names, and do we know when they expire? Our guide to lapsed charity domains explains what happens when they don’t get renewed.

People and planning

• Do staff and volunteers know how to spot phishing, and who to tell when something looks wrong?
• Do we have a simple written plan for the first 24 hours of an incident, with phone numbers that work if email is down?
• Do we have cyber insurance, and do we know what it excludes?

Is Cyber Essentials worth it?

Cyber Essentials is the government-backed certification for basic cyber hygiene. It changed on 27 April 2026, when version 3.3 of the requirements came in. Two changes matter most for charities: missing multi-factor authentication on any cloud service is now an automatic fail, and critical and high-risk updates must be applied within 14 days. Trustee and volunteer devices used for charity work are in scope.

Self-assessment costs from £320 plus VAT for organisations with up to nine staff. UK organisations with a turnover under £20 million that certify the whole organisation get £25,000 of cyber liability cover included, although it excludes money stolen through cyber fraud. The government’s funded Cyber Essentials programme has closed, but small organisations starting the process can book a free 30-minute consultation with an NCSC-assured Cyber Advisor.

Even if you don’t certify, the Cyber Essentials requirements are a good checklist for what “basic” looks like.

Free help

• The NCSC’s Cyber Action Toolkit is a free, step-by-step programme for small organisations. The NCSC’s older Small Charity Guide has been retired and now points to its general advice for small organisations.
• The NCSC’s Cyber Security Toolkit for Boards helps trustees ask the right questions, though it isn’t written specifically for charities.
• The NCSC’s free email security check tells you whether your domain is protected against spoofing.

If the worst happens

1. Contain it. Disconnect affected devices, change passwords and contact your IT support or supplier.
2. Report the crime. Report Fraud replaced Action Fraud in December 2025. For a live attack on a charity in England, Wales or Northern Ireland, call 0300 123 2040, 24 hours a day. In Scotland, call Police Scotland on 101.
3. Tell the ICO within 72 hours if personal data has been breached and the breach is likely to put people at risk. Record every breach, even the ones you decide not to report.
4. Consider a serious incident report to the Charity Commission. Its guidance covers fraud, theft, cyber crime and significant data breaches, and asks you to report promptly.
5. Tell the people affected when the breach puts them at high risk, clearly and quickly.

How we can help

We look after the website side of this for charities: verified updates, security monitoring, backups and someone to call when something looks wrong. See our WordPress care plans, or read how charity websites get hacked and what the cleanup costs.

Questions trustees ask