IT and Cybersecurity Policy

As a registered charity, [Charity name] is committed to the secure, responsible, and effective use of information technology and digital systems.
This IT and Cybersecurity Policy sets out the principles, standards, and controls designed to protect the Charity’s information assets, systems, and data from cyber threats, unauthorised access, and misuse.

The Trustees recognise that robust IT and cybersecurity arrangements are essential to safeguarding personal data, maintaining operational continuity, and protecting the Charity’s reputation.

Purpose of the Policy

1.1 The purpose of this Policy is to:

Protect the confidentiality, integrity, and availability of information.
Reduce the risk of cyber threats and data breaches.
Ensure compliance with legal and regulatory requirements.
Promote safe and responsible use of IT systems.

1.2 This Policy provides a framework for managing IT and cybersecurity risks proportionately.

Scope of the Policy

2.1 This Policy applies to:

Trustees.
Employees and volunteers.
Contractors, consultants, and third parties with access to Charity systems.

2.2 It applies to all IT systems, including:

Computers, laptops, and mobile devices.
Networks, servers, and cloud services.
Email, websites, and digital platforms.

IT and Cybersecurity Principles

3.1 The Charity is guided by the following principles:

Confidentiality of information.
Integrity of systems and data.
Availability of services.
Accountability and compliance.

3.2 Cybersecurity measures will be proportionate to the Charity’s size, activities, and risk profile.

Legal and Regulatory Compliance

4.1 The Charity will comply with:

UK GDPR and the Data Protection Act 2018.
Charity Commission guidance on cybersecurity.
Other applicable legislation and regulatory requirements.

4.2 Cybersecurity responsibilities will be clearly assigned and monitored.

Access Control and User Responsibilities

5.1 Access to IT systems will be:

Granted on a need-to-know basis.
Controlled through individual user accounts.

5.2 Users must:

Keep passwords secure.
Not share login credentials.
Use strong authentication methods where required.

Acceptable Use of IT Systems

6.1 IT systems must be used:

Primarily for authorised Charity purposes.
In a lawful and responsible manner.

6.2 Prohibited activities include:

Unauthorised access to systems.
Downloading malicious or illegal content.
Using systems for personal gain or improper purposes.

Data Security and Protection

7.1 The Charity will:

Implement appropriate technical and organisational measures to protect data.
Limit access to sensitive and personal data.

7.2 Measures may include:

Encryption.
Secure backups.
Regular system updates and patching.

Email, Internet, and Communications Security

8.1 Users must:

Be vigilant against phishing and social engineering attacks.
Avoid opening suspicious emails or attachments.

8.2 Official Charity communications must:

Use authorised systems.
Follow security and confidentiality requirements.

Remote Working and Mobile Devices

9.1 Remote access to Charity systems must:

Be authorised.
Use secure connections and devices.

9.2 Mobile devices must:

Be protected with passwords or biometric security.
Be reported immediately if lost or stolen.

Third-Party and Cloud Services

10.1 Third-party IT providers must:

Meet appropriate security standards.
Comply with data protection requirements.

10.2 Due diligence will be undertaken before engaging IT suppliers or cloud services.

Incident Management and Reporting

11.1 All actual or suspected IT security incidents must be reported immediately.

11.2 The Charity will:

Investigate incidents promptly.
Take appropriate remedial action.
Report incidents to regulators where required.

Business Continuity and Backups

12.1 The Charity will:

Maintain appropriate data backups.
Plan for IT system recovery following disruption.

12.2 Backups will be:

Tested periodically.
Stored securely.

Training and Awareness

13.1 The Charity will:

Provide cybersecurity awareness training where appropriate.
Promote good cyber hygiene practices.

13.2 Users are responsible for maintaining awareness of cyber risks.

Governance and Responsibility

14.1 The Board of Trustees has overall responsibility for IT and cybersecurity oversight.

14.2 Day-to-day management may be delegated, but accountability remains with the Trustees.

Monitoring and Review

15.1 Compliance with this Policy will be monitored.

15.2 This Policy will be reviewed:

At least annually, or
Following significant changes in technology or risk.

Conclusion

By adhering to this IT and Cybersecurity Policy, [Charity name] ensures the secure and responsible use of technology, protects information assets, and strengthens resilience against cyber threats, supporting the Charity’s long-term sustainability and public trust.

Signed: ………………………………………
Chair of the Board of Trustees

Date: ………………………………………

Charity Policy templates

Accessibility Policy, Anti-Bribery Policy, Anti-Fraud and Corruption Policy, Anti-Harassment Policy, Board of Trustees Code of Conduct, Charitable Objectives Policy, Child Protection Policy, Code of Conduct for Employees and Volunteers, Community Development Policy, Community Engagement Policy, Complaints Handling Policy, Confidentiality Policy, Conflict of Interest Policy, Conflict Resolution Policy, Crisis Management Policy, Cultural Competence Policy, Data Protection and Privacy Policy, Digital Inclusion Policy, Emergency Preparedness Policy, Environmental and Sustainability Policy, Equality and Diversity Policy, Ethical Fundraising Policy, Exit Policy, Expenses Policy, Feedback and Evaluation Policy, Feedback Mechanism Policy, Financial Controls Policy, Foreign Receipts and Payments Policy, Fundraising Policy, Gift Acceptance and Donation Policy, Governance and Accountability Policy, Grant-Making Policy, Health and Safety Policy, Incident Reporting Policy, Information Sharing Policy, Intellectual Property Policy, Investment Policy, IT and Cybersecurity Policy, Learning and Development Policy, Media and Public Relations Policy, Membership Policy, Mentoring and Coaching Policy, Online Safety Policy, Partnership and Collaboration Policy, Peer Support Policy, Privacy Impact Assessment Policy, Procurement and Supplier Management Policy, Public Benefit Policy, Records Retention Policy, Remuneration and Compensation Policy, Reserves Policy, Risk Management Policy, Safeguarding Vulnerable Beneficiaries Policy, Service Delivery Policy, Social Media and Communications Policy, Social Responsibility Policy, Succession Planning Policy, Technology Use Policy, Transparency and Accountability Policy, Travel and Subsistence Policy, Volunteer Induction and Training Policy, Volunteer Management Policy, Volunteer Rights and Responsibilities Policy, Whistleblowing Policy

Disclaimer:

Naail & Co provides these policy templates solely as guidelines or standard templates to assist charities in developing their own policies in accordance with Charity Commission England & Wales compliance. These templates are not intended to serve as legal or professional advice, and Naail & Co cannot be held responsible or liable for any outcomes arising from their use. It is essential that each registered charity carefully tailors and customizes these policies to reflect its specific needs, structure, and legal obligations. We strongly recommend that charities seek independent legal or professional advice to ensure compliance with all relevant laws and regulations.

Click here for comprehensive charity information.

Our service to you

If you are a self employed, business owner/director of company looking to get your accountancy and taxation matters sorted, look no further. We are pro-active and easily accessible accountants and tax advisors, who will not only ensure that all your filing obligations are up to date with Companies House and HMRC, but also you do not pay a penny more in taxes than you have to. We work on a fixed fee basis and provide same day response to all your phone and email enquiries. We will also allocate a designated accounts manager who would have better understanding of your and business financial and taxation affairs. Book a free consultation call using the link below.