Answer these 20 yes/no questions to see how ready your charity's technology is. They cover strategy and budget, licensing, cyber security, data protection, phones and volunteer access. If you answer "no" to three or more, there are likely to be quick savings and security wins. If you answer "no" to any cyber security or phone line question, start there, because those carry the biggest risk and the 2027 deadline.
Strategy and budget
- Do we have a written technology plan with costs that trustees have approved?
- Is our technology reviewed at least once a year?
- Do we know every IT and telecoms contract we pay for, and when each one ends?
Licensing
- Have we registered with Microsoft's nonprofit programme and checked our licences since the July 2025 changes?
- Is each person on the right licence, with leavers' licences removed?
Cyber security
- Is multi-factor authentication turned on for every staff, volunteer and trustee account?
- Are all charity-owned devices centrally managed and encrypted?
- Is Microsoft 365 backed up separately, and have we tested a restore?
- Do staff and volunteers get cyber awareness training at least once a year?
- Do we hold Cyber Essentials, or have a plan to get it?
- Do we have a written incident response plan that trustees have seen?
- Does a named trustee have responsibility for cyber security?
Data protection
- Do we know where beneficiary, safeguarding and donor data is stored, and who can access it?
- Do we know how to decide whether a breach must be reported to the ICO within 72 hours?
- Have we checked the security of suppliers that hold our data, such as our CRM?
Phones and helplines
- Have we listed every phone line, alarm, telecare, lift and door entry line affected by the 31 January 2027 switch-off?
- Can staff and volunteers answer calls from anywhere without using personal numbers?
Staff, volunteers and AI
- Does everyone have their own login, with no shared accounts?
- Is access removed on the day someone leaves?
- Do we have a written AI use policy that says what data must never go into AI tools?
What your score means
- 17–20 "yes": you're in good shape. Keep reviewing yearly.
- 12–16 "yes": solid foundations with gaps. Start with any cyber security or phone line "no".
- Under 12 "yes": there's real risk and probably real savings. A structured review will show where to start.
What next?
Indigo Unified Communications, based in Glasgow, runs a free Charity Technology Assessment covering all 20 areas. We review your licences, contracts, security, data protection and phone lines, then give you a prioritised, costed plan you can take to trustees. We support more than 30 charities and hold Cyber Essentials Plus and ISO 27001:2022. Book a free Charity Technology Assessment →
Sources: DSIT, Cyber Security Breaches Survey 2025/2026, 30 April 2026 · ICO, 72 hours: how to respond to a personal data breach · Openreach, Switching off PSTN across the UK.
Back to: The Complete Guide to Technology for Charities and Third Sector Organisations in Scotland
Chapter 8 of 8 · All chapters
Get a free technology assessment
One of our consultants will review your IT, security, connectivity and phones, then give you practical recommendations. No obligation.