Which security steps come first, and do we need Cyber Essentials?

England and Wales: This page sets out the position in full. Scotland: the same — these are UK-wide programmes and schemes, and the data protection duty behind them is reserved. Northern Ireland: the same, for the same reasons.

Five topics, and the regulator says they are quick

The NCSC’s Small organisations guide to cyber security has five topics: email, important online accounts, devices, backups and spotting attacks. The guide says its actions “can be completed in as little as 5 minutes”.

This is not a project. It does not need a consultant. First assess your cyber security baseline, if you have not yet done so. This page closes the gaps that assessment finds.

These actions are free. They are also the evidence UK GDPR Article 32 asks for, across the UK. The charity must have security “appropriate to the risk”. These are the measures the national cyber agency names first. Do them before you spend anything. Cyber Essentials for charities is a separate, later decision for the manager and the trustees.

The three things to be able to prove

Three of the actions are worth doing so that you can show they are done, not just believe it.

1. Multi-factor authentication on every account that has it. That is the second login step — a code on a phone, an app prompt, a key. Start with email, then the bank, then anything that holds supporter or beneficiary records. Where an account offers it, switch it on.
2. A tested restore. A backup nobody has restored is a hope. Pick one file, delete a copy, and get it back from the backup. Write down the date you did it.
3. Automatic updates confirmed on. This means every laptop, phone and tablet that touches charity data. That includes volunteers’ own devices if they use them for charity work. Check the setting; do not assume it.

The other two NCSC topics — securing email and spotting attacks — are mostly habits. A short briefing for everyone who uses the charity’s email covers them. The NCSC guide has the material.

Each of the three can fail quietly if nobody owns the account. That is why you keep a written list of your tools and who manages each one. The step to choose and set up your core digital tools covers it.

Cyber Essentials: what it costs

Cyber Essentials is a certification scheme backed by the NCSC. Outside some public contracts it is voluntary. The price is set by the number of staff, plus VAT:

The higher level, Cyber Essentials Plus, has no fixed price. It is a technical audit, priced by quote on the size of your network and how complex it is. The basic self-assessment comes first. Budget for a quote, not a figure.

The free insurance changes the sum

Budgeting the certificate as pure cost is the common mistake.

IASME runs the scheme with the NCSC. It arranges free Cyber Liability Insurance for any UK organisation below a turnover cap that certifies its whole organisation. Two conditions, and both matter:

• Turnover. Only organisations with a turnover under £20,000,000 qualify. Check the current cap on IASME’s own page before you rely on it.
• Scope. Only a certificate that covers the whole organisation brings the insurance. Certifying one office or one system does not bring the insurance.

So the real question is not “is the fee worth it?” but “is the fee, less the insurance, worth it?” For many small charities that is a different answer. Weigh it with the rest of the charity’s cover when you buy the insurance you actually need.

When a contract makes it compulsory

Outside government contracts, the scheme is a choice. Inside some of them, it is not.

Procurement Policy Note 09/23 applies to central government departments, executive agencies, non-departmental public bodies and NHS bodies. It tells them to make sure their suppliers hold Cyber Essentials or Cyber Essentials Plus, or can show equivalent controls. The note covers contracts that handle personal data, run ICT systems at OFFICIAL classification or support day-to-day government business.

The requirement cascades down supply chains. The prime contractor can ask a charity that runs part of a public service under a subcontract for the certificate. At that point the certificate is a condition of the work. Read the contract and any flow-down schedule before you decide. If the requirement is there, the choice has been made for you.

Put the decision in writing

Finish with a short note for the trustees or the minutes:

• MFA switched on for every main account that offers it.
• The date of the last tested restore, and who did it.
• Automatic updates confirmed on every device that touches charity data.
• Whether you will certify, and why — including any contractual reason and the insurance.

Next in this hub: Are there rules about charities using AI? If nobody uses AI tools, choose and set up your core digital tools instead.

Common mistake: budgeting Cyber Essentials as pure cost

The certificate is seen as a compliance badge with no return. But IASME arranges free Cyber Liability Insurance for any UK organisation under its turnover cap that certifies its whole organisation. That changes the sum a lot — but only if the whole organisation is certified.

Common mistake: assuming Cyber Essentials is always optional

The scheme is presented as voluntary, and outside government contracts it is. Inside them, PPN 09/23 expects suppliers on defined contracts to hold Cyber Essentials or show equivalent controls. That expectation cascades down supply chains. A charity that runs a subcontracted public service may have no choice.

Worked example

Saltmarsh Trust runs part of a public service under a subcontract. The prime contractor writes asking for evidence of the Trust’s cyber controls.

The Trust does the free work first. MFA goes on for email, banking and the case records system. The operations manager restores a deleted folder from backup and records the date. Automatic updates are checked on every staff laptop.

Then the Trust reads the subcontract. The prime contractor has flowed the Cyber Essentials requirement down from its own government contract. Certifying is now a condition of the work, not a choice.

The Trust pays the price for its staff band in the Cyber Essentials price table. It certifies the whole organisation, not only the one team on the contract. That way it qualifies for the free insurance, as long as its turnover is under IASME’s cap.

The outcome: MFA on across all main accounts, a tested restore, and automatic updates confirmed on. A minuted decision on whether to certify records the contractual reason and the insurance benefit.