What do funders, insurers and trustees now expect from a charity's cyber security?

Why the questions have changed

Five years ago most charity boards discussed cyber security once, after something went wrong. Now it comes up in three other places: the insurance renewal form, the council tender or grant due-diligence questionnaire, and the regulator's expectations of trustees. Each asks similar questions in different words, and a charity that can answer one well can usually answer all three.

The gap is still wide. The government's Cyber Security Breaches Survey 2025/2026 found that only 30% of UK charities have a trustee with explicit responsibility for cyber security, 38% require two-factor authentication, 19% have a formal incident response plan and 16% have even heard of Cyber Essentials. Only 9% review the cyber risks posed by their immediate suppliers.

This article is about showing that you're secure to the people who ask. The controls themselves are covered in our guide chapter, How should charities protect themselves from cyber attacks and data breaches?

What trustees are expected to do

In November 2025, OSCR's chair said: "It's the responsibility of every trustee in Scotland to act in their organisation's best interests and that must include ensuring that their organisation treats cyber security as a key part of their work, not as an optional extra." That doesn't make trustees IT experts. It does mean the board should be able to show it considered the risk, set a direction and checked progress.

For charities also registered in England and Wales, the Charity Commission's guidance Protect your charity from cyber crime (updated August 2026) is more specific. Trustees should be aware of the risks, take reasonable steps to protect the charity and respond properly to attacks, and all trustees stay accountable even when the work is delegated. It points boards to the NCSC's Board Toolkit and the government's Cyber Governance Code of Practice, published in April 2025 with free training for directors and trustees. Scottish boards can use the same free tools.

In practice, OSCR's expectation comes down to four things: a named trustee lead, cyber risk on the risk register, an incident plan the board has seen, and a regular report. Our article on the first 72 hours after a breach covers what that plan should contain.

What insurers ask before they'll cover you

Only 35% of charities have any cyber insurance, and most of that (31%) is a section of a wider policy rather than a standalone cyber policy, which only 5% hold (DSIT, 2026). Charities buying standalone cover for the first time are often surprised by the proposal form. Typical questions are:

• Is multi-factor authentication enforced on email, remote access and every admin account?
• Are backups kept offline or immutable, so an attacker with an admin password can't delete them, and when did you last test a restore?
• Is protection against viruses and ransomware (endpoint detection and response, or EDR) running on every device, and is anyone watching the alerts out of hours?
• Are critical security updates installed within 14 days, and is any unsupported software still in use?
• Do staff get phishing training, and are bank detail changes confirmed by phone?

Answer accurately. Under the Insurance Act 2015 you must give the insurer a fair presentation of the risk, and a "yes" to MFA that turns out to mean "most accounts" can give the insurer grounds to reduce or refuse a claim. Ask your IT provider to check the answers before you sign.

Cyber Essentials helps here. Organisations with it are 92% less likely to make a cyber insurance claim (NCSC figure, reported September 2026). IASME also includes £25,000 of cyber liability cover with certification, for UK organisations with turnover under £20 million that certify the whole organisation. It's a starting point, not a replacement for a proper policy.

The same pattern shows up in other sectors. Greenversity, a renewable energy client, met its cyber insurance requirement once Indigo rolled out Microsoft Intune device management.

What councils and funders are asking for

For UK central government contracts that involve personal data, Cyber Essentials is mandatory under Procurement Policy Note 09/23. Scotland takes a different, risk-based approach. The Scottish Government's Supplier Cyber Security Guidance Note (updated October 2025) tells public bodies to set proportionate cyber requirements for each contract and to judge the need for certification case by case. The Scottish Public Sector Cyber Resilience Framework v2.0 (December 2024) goes further: public bodies should build "appropriate cyber assurance as part of their procurement practices, contract management and grant making processes".

So a charity delivering a commissioned service for a council or health board should expect cyber questions at tender and at contract review, and Cyber Essentials is the simplest way to answer them. We haven't found any Scotland-wide rule requiring Cyber Essentials for all charity grants. Independent trusts and foundations vary, and more are adding cyber and data protection questions to their due diligence.

Is there funded help to get Cyber Essentials?

Less than there was. The NCSC's Funded Cyber Essentials Programme, which gave small organisations around 20 hours of free support from a Cyber Advisor, is closed. Free help that still exists includes the NCSC's Cyber Action Toolkit and Exercise in a Box, SCVO's cyber resilience programme, and the Cyber and Fraud Centre – Scotland incident helpline (0800 1670 623), which is free for charities with fewer than 20 employees. Check with SCVO and CyberScotland before you pay for anything, as funded schemes come and go.

A quarterly cyber report for the board

Trustees don't need a technical dashboard. They need about ten numbers, the same ones each quarter, so trends are obvious. This template works for most charities and matches what insurers and commissioners ask.

Add a short narrative: what changed, the top three risks and what's needed from the board, which is usually a decision or a budget line.

How Indigo does this. Indigo Unified Communications supports more than 30 Scottish charities from Glasgow. Our Charity package includes Microsoft 365 Business Premium licences and a dedicated security team watching your systems 24/7 (a security operations centre, RocketCyber), alongside Kaseya 365 endpoint protection, INKY email security, Datto SaaS Protection backup and Cyber Essentials support. Most of the table above comes straight out of those tools. We hold Cyber Essentials Plus and ISO 27001:2022 ourselves, so we fill in the same questionnaires. Cyber security services →

What to do next

1. Name a trustee lead for cyber security and put cyber risk on the risk register.
2. Pull out your insurance proposal form and check every answer against reality with your IT provider.
3. List the contracts and grants that include cyber or data protection conditions.
4. Start the quarterly board report above, even if some cells say "don't know" at first.
5. Plan Cyber Essentials: read Cyber Essentials explained, then book a free Charity Technology Assessment.