ISO 27001 and Cyber Essentials for charities: what funders and partners ask for

Charities are asked about information security for the same reason businesses are: they hold money and sensitive personal data, and the organisations that fund or commission them carry some of the risk. For most charities, Cyber Essentials is the usual first step and the one commissioners and funders ask for most often. ISO 27001 tends to come up later, for larger public-sector contracts, NHS work or partners with strict supply-chain checks. Neither is a legal requirement for charities in general, but either can become a condition of the work.

This guide explains who is likely to ask, what each scheme covers, which to do first, and how to keep it running with a small team. It's general information as of October 2026, not legal advice: always check what your contracts, grant terms and regulator actually say.

Why charities get asked

The questions rarely arrive as one rule. They come from several directions, often in the same year.

• Public-sector contracts. Since 2014, central government has required Cyber Essentials for contracts that involve handling personal information and providing certain ICT products and services (Procurement Policy Note 09/14). Many other public bodies ask for it too. If your charity delivers services under a government contract, expect the question.
• NHS and council commissioning. Charities that deliver commissioned health, care or support services handle exactly the data commissioners worry about. Tender questionnaires commonly ask about Cyber Essentials, your data protection arrangements and how you'd handle a breach. If you have access to NHS patient data or systems, you'll also need to complete the NHS Data Security and Protection Toolkit (DSPT); see DSPT vs ISO 27001.
• Funders and grant-makers. Larger funders increasingly ask grantees about governance, including how they protect the data of the people they support. Some ask directly for Cyber Essentials; others ask the questions it answers.
• Partners and lead providers. If you're a subcontractor in a consortium, the lead provider passes its own contract terms down to you, security requirements included.
• Beneficiary data and UK GDPR. Charities often hold special category data: health, ethnicity, religion, criminal records, or information about children and vulnerable adults. UK GDPR requires appropriate security for personal data, and a personal data breach that's likely to pose a risk to people's rights and freedoms must be reported to the ICO, where feasible within 72 hours.
• Insurers. Cyber insurance proposal forms ask about multi-factor authentication, patching, backups and admin rights: the same ground Cyber Essentials covers.

What the Charity Commission expects of trustees

The Charity Commission's guidance on cyber crime is clear that trustees must manage the charity's resources responsibly, and that all trustees remain responsible for making sure the charity is protected, even if one of them or a staff member leads on it. It suggests trustees decide what they expect on preventing cyber crime, including what people should do with a phishing email and what training trustees, staff and volunteers should complete.

The Commission's serious incident reporting guidance lists fraud, theft and cyber crime, and significant data breaches or losses, among the kinds of incident trustees should consider reporting. It's the trustees' responsibility to decide whether an incident is serious enough to report. Knowing who decides, and how, before something goes wrong is part of being ready.

The NCSC also publishes free cyber security advice for small and medium-sized organisations, including charities, with a guide and an action toolkit. It's a good place to start before you look at any certification.

Cyber Essentials: the usual first step

Cyber Essentials is backed by the National Cyber Security Centre. It checks five technical controls that protect against the most common attacks:

1. Firewalls on your office network and every device, including home workers' laptops.
2. Secure configuration: no default or shared passwords, unused software removed, devices that lock themselves.
3. User access control: everyone has their own account, admin rights are kept to the few who need them, and multi-factor authentication is on for cloud services, especially email.
4. Malware protection on every device in scope.
5. Security update management: supported software only, with critical and high-risk updates applied within 14 days.

There are two levels. Cyber Essentials is an online self-assessment, signed off by a director or equivalent (for a charity, usually a trustee or the chief executive) and marked by an assessor. Cyber Essentials Plus adds hands-on testing of a sample of your devices. Both renew every year, and the certificate comes from a certification body licensed by IASME, the NCSC's delivery partner. Basic Cyber Essentials is priced by organisation size and starts at a few hundred pounds (as of 2026); Plus is quoted by the certification body.

Where charities usually get stuck

• Volunteers and personal devices. If volunteers or staff read charity email on their own phones or laptops, those devices are in scope. Either bring them up to standard or change how people get to charity data.
• Shared accounts. A shared "office" or "volunteers" login fails the access control questions. Give people their own accounts, even if some only need occasional access.
• Donated and old equipment. A donated PC running an unsupported operating system has to be replaced or taken out of scope.
• Cloud services left out. Microsoft 365 or Google Workspace, your CRM or donor database, and any case management system all count. Turning on MFA everywhere is the single biggest win.
• Treating it as one-off. The certificate shows your position on the day of assessment. If patching, leavers and admin reviews stop, next year's renewal starts from scratch.

ISO 27001: for larger contracts and partners

Cyber Essentials covers technical basics. It doesn't ask about your suppliers, how you handle incidents, staff and volunteer training, or how you decide which risks to accept. ISO 27001 covers all of that as a management system: you set a scope, assess your risks, choose controls, keep records, and review and improve on a regular cycle. An accredited certification body audits it in two stages, then carries out surveillance audits.

Charities tend to meet ISO 27001 when:

• a large public-sector or NHS contract asks for it, or scores it in the tender;
• a corporate partner or lead provider requires it from everyone in its supply chain;
• the charity holds a lot of sensitive data, runs its own digital services, or processes data for other organisations;
• security questionnaires from funders and partners are taking more time than the team has.

It's a bigger commitment than Cyber Essentials. Someone has to own it, and the work carries on between audits: risk reviews, internal audits, management reviews, supplier checks. For a charity with a small IT team or one IT manager, the ongoing running is often harder than the first certificate.

Which to do first

For most charities the order is: Cyber Essentials first, because it's what you're most likely to be asked for and it fixes the controls that stop most attacks. Then ISO 27001 if a contract or partner needs it. The work overlaps: your device list, access controls, patching records and MFA set-up all count as evidence for the matching ISO 27001 controls. For more on how they fit together, read Cyber Essentials vs ISO 27001.

If you supply public bodies, our page for public-sector suppliers covers what buyers ask for in more detail.

A practical order to do it in

1. Ask what's actually required. Read your contracts, grant terms and tender documents, and note exactly what each asks for: Cyber Essentials, Plus, ISO 27001, the DSPT, or a questionnaire.
2. Brief the trustees. Agree who leads, what the board expects, and how often it hears back.
3. List your devices, cloud services and data. Laptops, phones, routers, every cloud system that holds beneficiary or donor data, and who owns each.
4. Answer the current Cyber Essentials questions in draft and note every "no" or "not sure".
5. Fix the gaps, keep the evidence, and submit through a certification body.
6. Put the year on rails. Recurring checks for patching, leavers, admin accounts and backups, so the controls stay true between renewals.
7. Decide on ISO 27001 when a contract, partner or funder needs it, building on what you've already done.

How ClearIMS helps

ClearIMS has a Cyber Essentials plan at £39 a month (no VAT charged), with unlimited users, so trustees, staff and volunteers who own a task can all be added. You work through the Cyber Essentials (and Plus) questions with owners, due dates and linked evidence, and it tracks what's missing or out of date. When ISO 27001 comes up, you upgrade to the full plan and the evidence and owners carry across to the matching ISO 27001 controls, so you don't start again. On the full plan, ClearIMS works like a virtual ISMS manager: it emails people about their outstanding and overdue actions, and AI drafts your first policies and documents, which your people review and approve. ClearIMS doesn't submit your assessment or approve anything for you.

We make the software. Your certification is yours, awarded by your certification body.

There's no free trial on the Cyber Essentials plan, so book a 20-minute call and we'll walk you through it. If you need ISO 27001 now, you can also apply for a founding place.