Cyber Essentials for Charities: 2026 Guide

Cyber Essentials is the government-backed scheme that checks your charity has five basic technical controls in place. It isn't a legal requirement, though public sector contracts and some insurers ask for it.

Few charities hold it so far. In the government's Cyber Security Breaches Survey 2025/26, 3% of charities said they adhered to Cyber Essentials, and 13% had controls in place in all five areas.

The same survey found that 28% of charities had a breach or attack in the previous 12 months. Phishing was reported by 25% of charities.

Why charities get asked for it

Central government departments, their agencies and NHS bodies follow Procurement Policy Note 014, published in February 2025. Where a contract involves citizens' personal information, suppliers have to hold Cyber Essentials or Cyber Essentials Plus, or show equivalent controls, and renew it every year of the contract.

The note says other public sector bodies may apply the same approach. If you deliver commissioned services, check the contract terms for it.

Insurers are the other common reason. Charities interviewed for the 2025/26 survey said cyber insurers were starting to ask for Cyber Essentials Plus, and that holding a certificate lowered the cost of cover.

Certification comes with some cover of its own. The NCSC says any UK organisation with a turnover under £20m that certifies its whole organisation is entitled to free cyber liability insurance, arranged by IASME.

If a funder asks for Cyber Essentials in its grant terms, check whether it wants the basic certificate or Plus. Also check whether the certificate has to cover the whole charity or only the funded project.

Trustees stay responsible for cyber security even when they hand the work to staff or an IT provider. The Charity Commission's guidance says so, and it names Cyber Essentials as a way to certify your charity's protection.

The five controls in a charity

The controls apply to volunteers' devices and donated kit as much as to staff laptops. In practice, each one means the following.

Firewalls: change the default admin password on your office router, and turn on the built-in software firewall on laptops used at home or on public wifi.
Secure configuration: remove accounts and software nobody uses, and lock every phone and laptop with a PIN or password of at least six characters.
Security update management: run only supported software, and install high-risk and critical updates within 14 days of release.
User access control: give everyone their own account and close it when they leave, with multi-factor authentication (MFA) on every cloud service.
Malware protection: keep anti-malware software active and up to date on Windows and Mac devices, or allow only approved apps to run.

Since April 2026, not turning on MFA for a cloud service that offers it fails the assessment outright. That includes Microsoft 365 and Google Workspace.

What's in scope for a small charity

Your scope is either the whole organisation or a separately managed part of it, kept apart from the rest by a firewall or VLAN. End-user devices always have to be included, and cloud services can't be left out.

You agree the scope with your Certification Body before the assessment starts. If you leave anything out, you have to explain why.

Volunteers' and trustees' own devices

A personal phone or laptop is in scope if it accesses your charity's data or services, such as email or shared files. The requirements name volunteers and trustees, so their own devices count in the same way as an employee's.

A phone that's only used for calls and texts is out of scope, and so is one that only runs an MFA app. To keep your scope small, limit what volunteers can reach from their own devices, or lend a charity-owned device to the people who need email and files.

Home routers you didn't supply are out of scope. Instead, the software firewall on each device has to be switched on.

Shared accounts

Every user has to sign in with unique credentials, so one login shared by a team of volunteers doesn't pass. Give each person their own account, and close it when they leave.

Admin work needs a separate admin account that isn't used for email or browsing. Accounts your IT provider uses to manage your systems are in scope too.

Older and donated kit

Donated laptops are in scope once your charity owns them, so they need supported software like everything else. Unsupported software has to come off the device, or the device moves into a sub-set with no internet traffic in or out.

If you've still got Windows 10 devices, check how they're covered before you apply.

Is there free Cyber Essentials for charities?

Not through the NCSC at the moment. The NCSC's Funded Cyber Essentials Programme is now closed, and its 2025 annual review described the programme's third year as its last.

When the programme opened to charities in January 2023, it covered micro and small charities that process personal data, such as domestic abuse charities. Eligible organisations got around 20 hours of free support from a Cyber Advisor, and Cyber Essentials Plus at no cost.

The NCSC's free tools are still open to charities. The old Small Charity Guide address now redirects to the NCSC's advice for small organisations, which starts with the free Cyber Action Toolkit.

What to do first

List every device and cloud service that holds or reaches charity data, including volunteers' and trustees' own phones and laptops.
Decide which personal devices really need email and files, and limit the rest.
Turn on MFA for every cloud service you use, starting with email.
Close accounts for people who've left, and replace any shared logins with named accounts.
Retire or separate any device running unsupported software.
Agree your scope with a Certification Body before you start the assessment.

Our guide to preparing for the assessment goes through each control in more detail.

Where Osiris fits

Osiris IT is an IASME-accredited Cyber Essentials Certification Body, so we certify Cyber Essentials directly. Since November 2026 we also certify Cyber Essentials Plus: our assessor carries out the technical audit and we issue the certificate.

We support charities remotely across the UK and on site in Norfolk, Suffolk and Cambridgeshire.

Sources

Common questions

Is Cyber Essentials a legal requirement for charities?

No. It's a voluntary scheme, though government contracts that involve personal data, and some insurers, ask for it.

Can charities get Cyber Essentials for free?

Not through the NCSC at the moment. The Funded Cyber Essentials Programme, which covered micro and small charities from January 2023, is now closed.

Are volunteers' personal devices in scope for Cyber Essentials?

Yes, if they access your charity's email, files or other services. A phone used only for calls and texts, or only for an MFA app, is out of scope.

Do trustees' own devices count for Cyber Essentials?

Yes. Trustees' own devices are in scope on the same basis as volunteers', whenever they access charity data or services.

Does Cyber Essentials include insurance for charities?

Yes, if your charity is UK based, has a turnover under £20m and certifies its whole organisation. The cover is free cyber liability insurance arranged by IASME.

IT support for charities

Cyber Essentials for charities: scope and free support in 2026