Charities and not for profit
IT for charities and not for profit
Charities hold donor data, often run on volunteers, and answer to funders and trustees. The budget is the constraint everyone talks about. Turnover of people is usually the bigger one.
Charities get offered two unhelpful things: a discount on something they do not need, and advice written for an organisation with an IT department.
The useful version is narrower. Check whether you are paying for software you could be getting donated. Give everybody their own login and close accounts when people leave. Protect the donor database and test the backup. Then, if a funder asks, have something to show them.
None of that is expensive. Most of it is a decision about who owns the job.
What we see
What this sector is up against
Volunteers come and go, and keep their access
Somebody helps out for six months, has an account and a password, and then stops coming. Nobody closes the account because nobody owns that job. It is the most common thing we find in the sector.
Donor data is more sensitive than it looks
A donor list is names, addresses, bank details and often an inference about somebody's beliefs or circumstances. Losing it is a UK GDPR matter and a trust matter, and trust is what fundraising runs on.
Funders ask what controls you have
Grant applications and tenders increasingly ask about data protection and cyber security. A straight answer is worth real money, and not having one can quietly cost you a bid.
Shared machines and a password on a sticky note
A communal computer in an office where six people use it is not a failing of anybody's. It is what happens when nobody has been given a better option.
What we do about it
In the order it usually matters
- 1
Check the licensing before anything else
Microsoft donates and discounts licences to eligible charities, and a lot of organisations are paying commercial rates without knowing. We check eligibility first, because it sometimes pays for everything else.
- 2
An account each, and a leavers routine
Every volunteer and member of staff with their own login, and a simple routine for closing accounts when somebody stops. This is the control that matters most in the sector and it costs nothing but attention.
- 3
Protect the donor database properly
Access limited to the people who need it, backups you have actually tested by restoring, and encryption on anything that leaves the building.
- 4
Something to show a funder
Written policies, Cyber Essentials where it is worth it, and evidence you can attach to an application rather than a promise you have to make.
Charities and not for profit: common questions
Can we get free or cheaper Microsoft licences?
Quite possibly. Microsoft operates donation and discount programmes for eligible charities, and the terms change from time to time, so it is worth checking properly rather than assuming. We will look at your eligibility and tell you what you qualify for before you spend anything.
We have volunteers coming and going constantly. How do we manage accounts?
With a routine rather than a system: one named person responsible, an account created when somebody starts and closed when they stop. We set up the structure and make it a two minute job, because anything longer will not get done.
Is Cyber Essentials worth it for a small charity?
It depends on who asks you for it. If you tender for local authority or NHS work, or apply to funders who ask about cyber security, it usually pays for itself on the first application. If nobody is asking, the underlying controls still matter and the certificate can wait.
Our budget is very tight. Where should we spend first?
Multi-factor authentication on email, individual accounts, and a backup you have tested. All three are either free or close to it, and together they stop most of what actually happens to organisations your size. We would rather tell you that than sell you something.
Start somewhere
Find out where you stand
- Free
Microsoft 365 health check
A read-only check of your security, licences and backups, with a plain-English report and a walk-through call.
Find out more - Fixed price
Cyber Essentials
We check your setup against the five controls, fix what fails and get you through certification.
Find out more - Free baseline test
Staff phishing test
See how your team does against a realistic phishing email, then keep them sharp with short monthly training.
Find out more - Free review
Switching IT support
We handle the whole handover, including the awkward conversation with your current provider.
Find out more
Want a straight answer about your IT?
Tell us what is not working. We will tell you what we would do about it, with no sales pitch and no obligation.