Cyber Essentials for Charities: Costs, Funding and Scope

Cyber Essentials for charities is not a legal requirement, but it is the certificate trustees are most likely to be asked about. The Charity Commission’s cyber crime guidance lists it as a step for medium and large charities, NHS and central government contracts that handle personal data require it (or equivalent controls), and it gives the board independent evidence that the basics are in place. Most charities now pay the standard fee, from £320 + VAT for up to 9 employees, because the government-funded programme has ended. The questions that catch charities out are scope (volunteers, trustees and personal devices) and card donations.

Do charities need Cyber Essentials?

Not as a legal requirement, but the expectation comes from several directions.

The Commission’s guidance, Protect your charity from cyber crime (first published November 2024), puts the responsibility on the board: you may delegate cyber security to someone else, such as an IT team, but all trustees remain responsible for making sure the charity is protected. It points small charities to the NCSC’s free Cyber Action Toolkit, lists joining Cyber Essentials among the steps for medium and large charities, and asks charities to report every cyber attack to Report Fraud, even one that caused no harm. You may also need to report an attack to the Commission as a serious incident.

Charities in Scotland and Northern Ireland have their own regulators (OSCR and the Charity Commission for Northern Ireland), but Cyber Essentials is the same across the UK. If you deliver services for an NHS body or a government department, the tender decides whether you need basic Cyber Essentials or Plus; see is Cyber Essentials mandatory?

Is there free Cyber Essentials for charities?

Not nationally, as far as we can find on 13 October 2026. The NCSC’s Funded Cyber Essentials Programme, delivered by IASME after its launch in December 2022, gave eligible micro and small charities free support towards certification. The NCSC’s Annual Review 2025 described it as in its third and final year, with that year focused on emerging technology sectors such as AI and semiconductors rather than charities.

What is still free:

• NCSC guidance: the Cyber Action Toolkit and the NCSC’s advice for small organisations, which now covers charities alongside businesses, clubs and schools, cover many of the same basics as Cyber Essentials.
• Regional Cyber Resilience Centres: police-backed, not-for-profit centres offering free guidance to small organisations and the third sector.
• Your own preparation: most of the work is changing settings, not buying products.

If a new funded round opens, IASME will announce it. Be wary of “free Cyber Essentials” offers that turn out to be bundles of paid IT services.

How much does Cyber Essentials cost for a charity?

The fee is set by number of employees, as for any organisation. IASME publishes the standard bands (£320, £440, £500 and £600 + VAT by size), and our Bronze package matches them; Silver and Gold buy a faster assessment and more resubmissions.

All prices exclude VAT and include a pre-assessment check and a support call of up to an hour; the full Cyber Essentials price list shows assessment times and resubmissions. If you rely on many volunteers, tell us your numbers when you enquire so we can confirm your band.

The bigger cost is often fixing what fails. Devices on unsupported software fail, and Windows 10 reached end of support on 14 October 2025, so older or donated laptops need upgrading, replacing or covering with Microsoft’s paid Extended Security Updates.

Eligible charities also receive £25,000 of cyber insurance with their certificate if they are domiciled in the UK or Crown Dependencies, have turnover under £20m, certify the whole organisation and opt in. See Cyber Essentials insurance.

Are volunteers and trustees in scope?

Yes, if they use your charity’s accounts or their devices reach your charity’s data. Under the NCSC’s current requirements (v3.3), user-owned devices that access organisational data or services, such as email, shared drives or your CRM, are in scope. Devices used only for native calls, texts or an MFA app are not.

You can certify the whole charity or part of it, but the included insurance needs the whole organisation, and the Danzell question set asks you to name every legal entity covered, so decide whether any trading subsidiary is in or out. Our Cyber Essentials scoping questionnaire walks you through it.

Does PCI DSS apply to card donations?

Yes. Any charity that accepts, processes, stores or transmits card data must comply with PCI DSS, now at version 4.0.1, and Cyber Essentials does not cover it. Most charities validate with a Self-Assessment Questionnaire (SAQ) that depends on how donations come in.

Your acquirer or payment provider confirms which SAQ applies. On paper donation forms, card numbers must be kept secure and destroyed when no longer needed, and the security code must never be kept after authorisation. Direct Debit and bank transfers fall outside PCI DSS. Our PCI DSS compliance guide goes further, and as a PCI SSC Qualified Security Assessor (QSA) company we can help you choose.

How does a charity get certified?

1. Agree your scope: whole charity or part, which legal entities, and which staff, volunteer and trustee devices.
2. Fix the common gaps: MFA on every cloud service, high-risk and critical updates within 14 days, one account per person and supported software everywhere. Missing cloud MFA or the 14-day rule fails the assessment on its own.
3. Answer the question set, with sign-off from a senior person such as the chair or chief executive.
4. We assess it and issue a certificate valid for 12 months: Bronze in 3 to 5 working days, Gold within one.
5. Consider Cyber Essentials Plus if a contract asks for it; the technical audit follows within three months.

Cyber security for charities beyond Cyber Essentials

Cyber Essentials certifies five technical controls, so it is only part of charity cyber security. It does not check backups, phishing awareness, payment approvals or how the board oversees the risk, and those are where many charity incidents start.

Trustee oversight. The Charity Commission is clear that trustees stay responsible even when IT is delegated. Put cyber risk on the risk register, ask for a short report at board meetings, and agree who decides what to do in an incident. The NCSC’s Cyber Security Toolkit for Boards is written for boards and works for trustee boards too.

Plan for a bad day. A one-page incident response plan should say who to call, how to reach your bank, and when to report to Report Fraud, the Charity Commission (as a serious incident) and the ICO. The NCSC’s free Exercise in a Box lets staff and trustees rehearse it.

Train people, not just devices. Staff and volunteers who can spot a phishing email protect the charity more than any single product; a phishing simulation shows who needs more help. Smaller charities can follow the same step-by-step plan we set out for cyber security for small businesses, and our guide to preventing ransomware covers backups and recovery in more depth.

Why certify with Sovereign Secure?

• We are the certification body, IASME-licensed, so the team that supports you also assesses and certifies you.
• Published prices from £320 + VAT; extra resubmissions beyond your package limit cost £100 + VAT.
• Help before you submit: a pre-assessment check and a support call, which is usually where volunteer scope questions get settled.
• Card donations covered too: we are a PCI SSC-approved QSA company.
• Established in 2012 (Companies House 08334453) and ISO 27001 certified.

Ready to start?

Start your Cyber Essentials certification with us, or use the form below and choose “First time Cyber Essentials (CE)”. Tell us roughly how many staff, volunteers and trustees use charity systems, and whether you have a trading subsidiary. You can also call +44 161 523 5276.