- Charities & Not-for-Profits Hub
Start by finding out which devices and accounts your charity uses, then compare your setup with the current Cyber Essentials requirements. The scheme covers five technical controls against common internet threats; preparing for it should produce practical improvements, rather than a form that only one person understands.[1]
Know what Cyber Essentials checks
The NCSC describes Cyber Essentials as a government-recommended minimum standard for organisations of all sizes.[1] Its five controls cover firewalls, secure configuration, security updates, user access and malware protection.[1] For a small charity, use those headings to organise a conversation about the computers, phones and online services people actually use.
Ask whoever looks after your IT to explain each area in ordinary language. Which settings stop unnecessary access? How do you know software is being updated? Who can create an account or change permissions? Request a demonstration where possible, rather than accepting a general assurance that everything is covered.
Separate what you can show from what you still need to check. A short record with an owner and a next action is more useful than answering yes because a setting sounds familiar. Keep passwords and recovery codes out of that record.
Map the way your team really works
Begin with an ordinary week. Include the shared reception computer, the laptop used at home and the phone someone uses to check charity email between visits. Ask about occasional volunteers as well as permanent staff. Do not limit the discussion to equipment sitting in the office.
Make a working inventory showing the device, its owner, the person responsible for updates and the charity services it accesses. Record online accounts separately, including email, shared files, your website and any system used to manage enquiries. This is preparation, not a claim that every item falls within the same assessment scope.
Take that picture to your chosen assessor and agree what the certification will cover, including personal devices and cloud services. Ask them to explain any exclusions. If an answer depends on your IT supplier, get that answer before completing the assessment rather than filling the gap with a guess.
Turn the requirements into manageable jobs
Use the current assessment questions and supporting requirements linked from the NCSC’s Cyber Essentials page, rather than an old checklist saved by a previous volunteer.[1] Work through them with the person who can actually check your systems. Where something is unclear, ask your assessor how the requirement applies to your setup.
Start with a small number of verified tasks. Ask your IT contact to show how updates are managed, review who has administrative access and check how a departed volunteer’s account is removed. Agree who will finish each job and when you will check it again. Avoid making changes to unfamiliar security settings without appropriate help.
For a shared computer, test the everyday handover too. Can the next person do their work without borrowing someone else’s account? Who helps if they cannot sign in? Walk through the process with the volunteers who use it, so the written arrangement matches what happens on a busy morning.
Choose the assessment route you need
Cyber Essentials includes an assessed self-assessment route. Cyber Essentials Plus checks the same controls but adds independent technical testing.[1] Ask the organisation requesting a certificate to name the level and scope it expects before commissioning work. Do not assume a vague request for cyber certification means Plus.
Request a written explanation of what an assessor’s quote includes and what preparation remains your responsibility. Ask how they handle questions, any work needed before assessment and arrangements for testing. Keep the certification decision separate from a supplier’s proposal to replace equipment: ask which specific requirement each proposed change addresses.
If nobody has asked for certification yet, you can still start preparing. The NCSC links to a free readiness tool and assessment questions.[1] Use them to understand the gaps before deciding what outside support you need.
Keep the wider cyber work going
Treat this as one part of keeping your charity’s technology dependable. The Charity Commission’s cyber guidance also covers backups, awareness training and planning how to respond to an attack.[2] Put those activities alongside the technical assessment rather than expecting the certificate to answer every question.
Ask someone to demonstrate that an important backed-up file can be recovered. Agree how staff and volunteers should report a suspicious message, and where they can find a contact if email is unavailable. Practise that handover without using real client information or creating a convincing fake emergency.
This week, nominate a coordinator, start the inventory and book a conversation about your assessment scope. Then give the team a short update on what will change and who can help. For MH360’s wider technology information, visit the charities technology page. Keep the next step specific enough that someone can actually complete it.
Sources
[1] https://www.ncsc.gov.uk/cyberessentials/overview
[2] https://www.gov.uk/guidance/protect-your-charity-from-cyber-crime
