Cyber Essentials Plus for charities proves your organisation protects donor data and grant funding to the same standard as any commercial supplier — here's how to get certified without pulling a lean team off its real work.
Why this matters
More UK funders now write Cyber Essentials, and increasingly Cyber Essentials Plus, into grant terms before they release money. Government-linked work through G-Cloud or NHS partnerships often makes it a hard requirement, not a nice-to-have.
Donor payment data, beneficiary records and case files sit on the same laptops your fundraising team uses at home. A breach doesn't just cost you a fine risk — it costs the trust that keeps donors giving. Insurers are starting to ask for CE+ before they'll quote cyber cover at all in 2026.
The problem is capacity, not willingness. Charities run lean. Automating the certification turns a multi-week evidence-gathering slog into something a single trustee or ops lead can own.
Who this is for
This guide is for charities and non-profits with roughly 5 to 50 staff, no dedicated IT security hire, and at least one of: donor payment processing, NHS or local authority contract work, or a funder that's started asking for Cyber Essentials Plus in 2026 renewal terms. If you already run a full-time security function, most of this you'll already know.
What to look for in Cyber Essentials Plus for charities
Funder and grant alignment
Check the exact wording in your grant agreements — some ask for Cyber Essentials, others specifically require the Plus tier with its independent technical test. Getting this wrong means recertifying twice in one year.
Scope you can actually defend
CE+ assessors test a sample of your in-scope devices. If your scope statement claims coverage you can't actually demonstrate on the day, you fail the on-site test, not just a document review.
Volunteer and BYOD device coverage
Charities lean on volunteers and trustees using personal laptops and phones. Any device touching charity email or data needs to be in scope or explicitly excluded with a documented reason — assessors flag ambiguity here every time.
Renewal workload each year
Cyber Essentials Plus recertifies annually. Budget for the same evidence-gathering effort every 12 months, not just the first year — this is where DIY approaches quietly fall apart.
Evidence collection that doesn't eat staff time
The five control themes — firewalls, secure configuration, user access control, malware protection, and patch management — each need supporting evidence. Manual screenshotting and spreadsheet tracking is where most charity IT leads lose entire weeks.
Government and NHS contract readiness
If your charity bids for public sector work, CE+ is frequently the entry ticket alongside separate G-Cloud readiness requirements. Sort this before you bid, not after a contract's already on the table.
Top picks for getting Cyber Essentials Plus
The automated pick — OneClickComply. Automates evidence collection across all five control themes and tracks your 12-month renewal cycle so nothing lapses quietly. Built for teams without a dedicated security hire. Verdict: Buy.
The DIY pick — IASME's self-assessment portal. Lowest upfront cost, but someone on staff or on the board needs real IT security literacy to fill it out accurately and keep evidence current year over year. Fine for a charity with a trustee who's genuinely hands-on with IT. Verdict: Consider.
The outsourced pick — a local MSP retainer. Useful if your IT is already fully managed externally, but it adds a third-party dependency and rarely comes with its own security certification — you're trusting your CE+ pass to someone else's process. Verdict: Skip unless the MSP can show its own certification.
The public-sector pick — CE+ paired with contract-specific prep. If NHS trusts or local authorities are your funding route, pair certification with the specific supplier requirements those contracts carry. Verdict: Buy if public sector income matters to you.
What to avoid
- Enterprise pentest bundles. Priced and scoped for corporates with dedicated security budgets — most charities pay for coverage they don't need and still miss the CE+-specific requirements.
- One-off consultants with no repeatable process. They pass you once, then disappear before your 2027 renewal, leaving no evidence trail and no institutional memory.
- Ignoring volunteer devices. Trustees and volunteers using personal phones for charity email is the single most common scope gap assessors catch during the on-site test.
Verdict comparison
| Route | Upfront effort | Annual renewal effort | Best for | Verdict |
|---|---|---|---|---|
| OneClickComply (automated) | Low | Low | Lean teams, no dedicated IT hire | Buy |
| IASME self-assessment (DIY) | Medium | High | Charities with a hands-on IT trustee | Consider |
| MSP retainer | Low | Medium | Charities already fully outsourced | Skip unless MSP is certified |
| CE+ + public-sector prep | Medium | Medium | NHS/local authority contract work | Buy for public sector income |
Where to get it done
- Go through an IASME-accredited certification body — they issue the actual Cyber Essentials Plus certificate, not a third party.
- Confirm your scope statement before you pay for the on-site test; rescoping after a failed assessment costs you the assessment fee twice.
- Build your incident response plan alongside certification, not after — a tabletop exercise for incident response closes a gap assessors increasingly probe for in 2026.
Frequently asked questions
One last thing
Most charities treat Cyber Essentials Plus as a one-time hurdle. It isn't — it's a 12-month cycle, and the second year is where DIY approaches usually collapse because the person who filled out the first application has moved on. Build the evidence trail once, automate it, and the 2027 renewal takes days instead of weeks.