Quick answer: cyber security for a small charity starts with five basics: protect your email, put two-step verification on your important accounts, keep devices updated, back up your data and teach everyone to spot phishing. Name one trustee to own it. None of this needs an IT team, and the NCSC publishes free guidance for each step.
Most small charities run on a handful of staff, a group of volunteers and a few free or low-cost online accounts. That is exactly why cyber security for charities can feel like something for bigger organisations. It is not. This guide sets out where a small charity should start, using the government’s latest survey figures and the National Cyber Security Centre’s guidance, read on 27 October 2026.
How common are cyber attacks on charities?
Common enough that every charity should plan for one. The Cyber Security Breaches Survey 2025/2026, published on GOV.UK on 30 April 2026 and based on 1,085 UK registered charities, found:
- 28% of charities reported a cyber security breach or attack in the previous 12 months (43% of businesses).
- 14% of charities were victims of cyber crime, around 28,000 charities, and phishing made up 95% of that crime.
- 60% of charities said cyber security was a high priority for senior management, down from 68%. For low-income charities, under £100,000 a year, it fell from 64% to 53%.
- Only 17% of charities gave staff any cyber security training or awareness, down from 21%.
- Just 16% of charities had heard of Cyber Essentials, and 13% had controls in place in all five of its technical areas.
The pattern is clear. Attacks are mostly phishing, and the smallest charities are the ones whose attention to the problem is slipping.
What should cyber security for charities cover first?
Start with the five areas in the NCSC’s small organisations guide to cyber security. Each one can be done in an afternoon:
- Secure your email. Your charity’s email is the key to everything else, from donations to password resets. Use a strong, unique password and turn on two-step verification. Our free email security check also shows whether others can send email that pretends to come from your domain.
- Secure your important online accounts. Banking, donation platforms, social media, your website and your cloud storage all need two-step verification. Our guide to MFA for small teams walks through it.
- Protect your devices. Switch on automatic updates for laptops, phones and tablets, use a screen lock and stop using devices that no longer get security updates.
- Back up your data. Keep a copy of your important files, such as supporter records, Gift Aid claims and policies, somewhere separate, and check you can restore it.
- Spot attacks. Most charity cyber crime is phishing. Show everyone, including volunteers, what a fake invoice, a fake donor email and a fake login page look like, and agree that anyone can question a payment request.
Who should be responsible for cyber security in a small charity?
A named trustee, supported by one person who does the checks. Trustees are already responsible for protecting the charity’s assets, and data and accounts are assets. The 2025/2026 survey found only 30% of charities had a board member or trustee responsible for cyber security, a figure that has not moved for three years.
Keep it light. Add cyber security to the board agenda twice a year, keep a one-page list of your accounts and who can get into them, and record what you changed since the last meeting.
How do volunteers and shared logins fit in?
Volunteers are often the people answering the email and posting on social media, so they need the same basics as staff. Give each person their own login where the service allows it, rather than one shared password. When someone stops volunteering, remove their access the same week. If a shared login is unavoidable, change the password when anyone leaves and keep it in a password manager rather than a spreadsheet.
Does a small charity need Cyber Essentials?
Not by law, but it is a useful target. Cyber Essentials is the government-backed scheme that checks five technical controls, and some funders and public sector contracts ask for it. Even if you never apply, its controls make a sensible checklist. Our Cyber Essentials checklist explains the five controls in plain English, and our guide to the DSPT and Cyber Essentials for charities covers charities that work with the NHS.
What if something goes wrong?
Act quickly and write down what happened. If personal data about supporters, beneficiaries or staff may have been exposed, you may need to report it to the ICO within 72 hours; our guide to reporting a data breach to the ICO explains the test. If money has gone, call your bank first.
How we can help
Unavoidably Secure helps small charities, dental practices and care providers find the gaps that attackers use most: email that can be spoofed, exposed website data and accounts without two-step verification. We give you a plain-English list of what to fix first. We do not certify, accredit or guarantee compliance.
FAQs
Is cyber security a job for trustees or staff?
Both, but trustees are responsible for making sure it happens. Name one trustee to own it and report on it, and one staff member or volunteer to do the day-to-day checks. The government's 2025/2026 survey found only 30% of charities had a board member or trustee responsible for cyber security.
Do small charities really get targeted?
Yes. The Cyber Security Breaches Survey 2025/2026 found 28% of UK charities reported a breach or attack in the previous 12 months, and phishing made up 95% of the cyber crime charities experienced. Most attacks are not aimed at you personally; they are sent to thousands of inboxes at once.
Can volunteers use their own phones and laptops?
They can, if you set a few simple rules. Ask for a screen lock, up-to-date software and a separate login for charity accounts, and remove their access the day they stop volunteering. Keep sensitive records in your charity's own accounts, not in personal email or files.
What should we do first if we think we have been hacked?
Change the password on the affected account from a different device, turn on two-step verification and tell your trustee lead. If personal data may have been exposed, assess whether it needs reporting to the ICO within 72 hours. If money was lost, contact your bank straight away and report the crime.
This article is general information, not legal advice. Figures come from the Cyber Security Breaches Survey 2025/2026 (GOV.UK, 30 April 2026) and the steps follow the NCSC’s small organisations guide, both read on 27 October 2026. Browse the blog for related guides.
Find your charity’s weak spots first
Book a free external audit. We will review your website, email security and data basics, and give you a plain-English list of what to fix first.
Book a free auditNeed help with this?
If you need support putting any of this right, contact us today. Tell us briefly what you need and Andrew will reply within one working day.