Seven cyber questions every charity trustee should be able to answer

Most trustees we meet are perfectly comfortable challenging a set of accounts or a safeguarding report. Cyber security is different — the vocabulary is unfamiliar, the answers often arrive wrapped in acronyms, and nobody wants to be the person who asks what sounds like a basic question.

So the item gets nodded through. Not because anyone is being negligent, but because the board doesn't have a way in.

These seven questions are that way in. None of them require you to understand how a firewall works. All of them will tell you something real about how well your organisation is managing the risk.

Start here, because it converts an abstract risk into something the board already knows how to think about. Not "would we be hacked" but "which services stop, how quickly, and who is affected."

A charity delivering frontline services has a very different answer from a grant-making foundation. That difference should visibly shape everything else in the security plan.

Access tends to accumulate. People change roles, cover for colleagues, join a project team, and permissions are rarely removed afterwards. In most small organisations, more people can see beneficiary or donor data than anyone would consciously choose.

This is also one of the cheapest risks to reduce. It costs nothing but time.

This is the single most useful question on the list, because the gap between "we have backups" and "we can recover" is where organisations get badly hurt.

Backups fail quietly. They silently stop including a folder that was moved. They run successfully for two years and then turn out to be encrypted along with everything else, because they were connected to the same network. The only way to know a backup works is to restore from it and see.

Charities often carry obligations they haven't fully mapped. Health or social care data brings additional expectations. Working with children or vulnerable adults raises the stakes considerably. Contracts with local authorities and larger funders increasingly specify security requirements — and those requirements are getting firmer as supply chain scrutiny tightens across the public sector.

The board should know what has been promised in its name.

Incidents are decision-making problems before they are technical ones. Who can authorise taking systems offline during a working day? Who speaks to funders? Who decides whether to notify the ICO? Is there a phone number for the trustees if email is unavailable — and does anyone have it written down somewhere other than in email?

This is genuinely board territory. Most of these decisions are not IT's to make.

Your CRM provider, payroll bureau, fundraising platform and IT support company all hold or can reach your data. Their security is effectively part of yours, and you're unlikely to hear about a problem first.

You don't need to audit everyone. You need to know which handful actually matter, and have asked them something more searching than whether they take security seriously.

The honest answer at most organisations is yes, at least sometimes, and usually with good intentions — summarising notes, drafting a funding bid, tidying up a report.

The risk isn't the technology. It's that nobody has told people where the line is, so they're each drawing it themselves. A short, clear piece of guidance solves most of this, and a ban that everyone quietly ignores solves none of it.

What to do with the answers

You will almost certainly find gaps. Every organisation has them, including well-run ones with capable IT teams. Finding gaps is the point of asking.

What matters is what happens next, and the trap to avoid is turning seven questions into a twenty-item action plan that stalls by week three. Sort what you find into three groups instead:

• Now — things that would cause real harm and can be fixed in weeks, not quarters. Untested backups and stale access usually land here.
• Next — things that need planning or budget. Supplier reviews, incident plans, certification.
• Later — things that are genuinely worth doing but aren't urgent, and can wait without anyone pretending otherwise.

Three things finished beats fifteen things started. That's true of most charity work, and it's certainly true of security.

You don't need to become technical. You need to be able to tell the difference between an organisation that has thought about this properly and one that hasn't — and these seven questions will tell you that in about twenty minutes.