01 / 03
Supporter trust is everything
Donor, beneficiary and volunteer data is often sensitive. A breach can mean reporting to the ICO and your charity regulator, and lasting damage to supporter trust.
Protect supporter data and keep your services running
For national charities, housing and care charities, social enterprises and other non-profits of 50 to 5,000 people. Clear findings for CISOs, security teams, finance and the board, and independent specialists for Cyber Essentials, serious incident reporting, UK GDPR and PCI DSS.
Business Cyber Check introduces you to authorised insurers and brokers. We are not an insurer or broker and do not provide quotes or advice. Your enquiry may be shared with up to 3 of them.
What keeps charity and non-profit leaders up at night
02 / 03
Fraud targets charity funds
Fake invoices, mandate fraud and hijacked email accounts aim straight at your funds. Verification steps and strong email security help protect money meant for your cause.
03 / 03
Trustees stay responsible
Trustees can delegate day-to-day security, but the Charity Commission says they remain responsible for protecting the charity. They need clear, plain-English reporting.
How we help
01 / 03
Vetted security providers
Specialists who can close gaps, prepare you for assessments and run incident response.
02 / 03
Authorised insurers and brokers
Explore cyber cover with authorised specialists. We don't give quotes or advice ourselves.
03 / 03
Breach lawyers
Legal support on reporting duties, notices and regulators after an incident.
Standards and frameworks we can help you work towards
We don't certify, accredit or assess. We connect you with independent specialists who can help you work towards these.
01 / 06
Charity Commission serious incident reporting
Help knowing when a cyber attack or data breach should be reported to the Charity Commission for England and Wales as a serious incident.
02 / 06
Cyber Essentials and Cyber Essentials Plus
Help getting ready for assessment by a certification body, as the Charity Commission suggests.
03 / 06
Cyber Governance Code of Practice
Help trustees govern cyber risk using the government's code for boards, which the Commission points larger charities to.
04 / 06
UK GDPR and supporter data
Help with data mapping, DPIAs and breach-response planning, with legal specialists where needed.
05 / 06
PCI DSS for card donations
Help reducing card data scope and preparing for assessment, if you take card donations or payments.
06 / 06
Fraud and ransomware resilience
Help with payment checks, email security and backup and recovery plans, tested before you need them.
How it works
- 01
Book a 20-minute briefing
Tell us about your setup, deadlines and main concerns.
- 02
Get a clear picture
Understand what to prioritise for your security team, board, auditors and insurers.
- 03
Meet the right specialists
We introduce security providers, authorised insurers or brokers, or breach lawyers. You decide whether to go ahead.
Questions
Do charities have to report cyber attacks to the Charity Commission?
If it's serious, yes. In England and Wales, trustees may need to report a cyber attack or significant data breach to the Charity Commission as a serious incident, as well as reporting cyber crime to Report Fraud. Charities in Scotland and Northern Ireland should check their own regulator's rules, and personal data breaches may need reporting to the ICO.
Can you help our charity find cyber insurance?
Yes. We can introduce you to up to 3 authorised insurers or brokers who can explain cyber cover options for charities and non-profits. We are not an insurer or broker, and we don't quote or give advice. Your trustees decide whether to go ahead, and any quotes or recommendations come from the insurers or brokers.
Is the briefing free for charities?
Yes. The 20-minute briefing is free for charities and non-profits, with no obligation to go ahead with anyone we introduce. We are paid by the specialists, insurers or brokers we introduce, not by you, and we only share your details with those you agree to hear from.
Are trustees responsible for cyber security?
Yes. The Charity Commission says trustees can delegate day-to-day cyber security, for example to an IT team, but all trustees remain responsible for making sure the charity is protected. It points medium and large charities to NCSC board resources and the Cyber Governance Code of Practice. Specialists we introduce can brief trustees in plain English.
Do charities need Cyber Essentials?
It isn't a legal requirement, but the Charity Commission suggests charities join the Cyber Essentials scheme, and some public sector contracts require it. Cyber Essentials Plus adds independent technical testing of your systems. Specialists we introduce can help you get ready for assessment by a certification body and fix any gaps first.
Charity and non-profit
Talk it through in 20 minutes
A free, no-obligation briefing with clear next steps.