IASME Governance certification for charities and non-profits is a self-assessment standard that proves a charity manages information risk, data protection and governance responsibly, with the aim of reassuring funders, beneficiaries and regulators that trustee oversight extends to cyber security. Charities carry donor payment data, beneficiary records and often safeguarding information, but most run lean IT teams and volunteer staff turnover that make ongoing evidence collection harder than in a commercial business.
Why IASME Governance matters for charities
Funders increasingly ask for proof of data governance before releasing grant money, and cyber-essentials-plus-for-charities-and-non-profits certification alone doesn't cover governance topics like risk ownership or supplier oversight. IASME Governance closes that gap because it assesses organisational context, legal obligations and business continuity alongside technical security.
Charity trustees carry legal responsibility for data protection under UK GDPR, and a failed data breach investigation looks very different when a charity can show a completed governance self-assessment versus nothing at all. IASME Governance certification gives charities and non-profits a documented answer to "how do you manage risk" that a funder, regulator or insurer can actually check.
Small non-profits with fewer than 10 staff often assume governance frameworks are built for large corporates. The self-assessment format exists precisely so a charity with a part-time finance officer and a handful of trustees can complete it without hiring a consultancy.
Map your data and assets first
Start by listing what information the charity actually holds before touching the assessment questionnaire.
- Donor payment and Gift Aid records
- Beneficiary or client case files, including any safeguarding data
- Volunteer and staff HR records
- Grant applications and funder correspondence
- Cloud storage, CRM and donation platform accounts
- Physical records still held on paper at branch offices
Assign governance ownership at trustee level
IASME Governance expects a named owner for information risk, and that person needs enough authority to make decisions, not just log incidents.
- Name a trustee or senior staff member as information risk owner
- Record the decision in board minutes
- Give that owner a mandate to pause risky activities (a data export to an unvetted supplier, for example)
- Set a review cadence — quarterly for most small charities
- Confirm this person also owns the vendor-risk-management-software-for-charities-and-non-profits relationship if the charity uses external processors
Run a risk assessment against the 10 IASME themes
The self-assessment questionnaire is built around ten themes: organisational context, information assets, legal and regulatory environment, understanding needs, leadership, risk management, physical security, staff awareness, operations security and business continuity.
- Score each theme against current practice, not aspirational policy
- Flag any theme scoring below "partially met" as a priority gap
- Log evidence sources for each answer (a policy document, a training log, a supplier contract)
- Repeat this exercise annually, not just at renewal time
Close physical and staff security gaps
Charities running drop-in centres, shops or shared office space face physical security questions a fully remote SaaS company never sees.
- Lock filing cabinets holding beneficiary paperwork
- Restrict who can access donor payment terminals
- Cover volunteer onboarding with a basic security briefing, not just a safeguarding briefing
- Remove access for departed volunteers within days, not months
- Log visitor access to any site holding physical records
Document policies and evidence before you submit
A self-assessment answer without supporting evidence gets flagged during review. Build the evidence pack alongside the answers, not after.
- Data protection and retention policy
- Incident response plan, even a one-page version
- Staff and volunteer training records
- Supplier and processor contracts referencing data handling
- Business continuity plan covering a systems outage or office loss
Manual evidence collection is where most small charities lose weeks — chasing a volunteer coordinator for a training log or hunting through email for a supplier contract. OneClickComply automates evidence collection against these questions so the information risk owner isn't rebuilding a spreadsheet from scratch every renewal cycle.
Submit for assessment and act on findings
Once the self-assessment is complete, it goes to the certifying body for review. Expect follow-up questions on any theme scored as partially met.
- Respond to reviewer queries within the stated window
- Update weak answers with the evidence gathered in the previous step
- Keep a change log of what was fixed and when
- Brief trustees on the outcome, pass or otherwise
Renew annually and keep evidence current
IASME Governance certification is not a one-time badge. Annual renewal means the evidence pack needs refreshing, not rebuilding.
- Calendar the renewal date at least two months out
- Re-run the staff and volunteer training log check
- Confirm supplier contracts are still current
- Re-score any theme where the charity's operations changed (new CRM, new office, new funder requirement)
Automate charity compliance evidence
Keep IASME and Cyber Essentials evidence current without spreadsheets.
Comparison: certification routes for charities in 2026
| Option | Best for | Key limitation |
|---|---|---|
| IASME Governance self-assessment (DIY) | Charities with a trustee who can dedicate real time to the questionnaire | Evidence gathering is manual and easy to let slip between renewals |
| Cyber Essentials only | Charities only facing a basic technical control requirement from a funder | Doesn't cover governance, risk ownership or business continuity themes |
| Cyber Essentials Plus + IASME Governance combined | Charities applying for grants that specify both technical and governance proof | Requires more evidence and coordination across two assessments |
| Consultant-led certification | Charities with budget but no internal capacity | Ongoing evidence maintenance still falls back on staff after the consultant leaves |
| Compliance automation platform (OneClickComply) | Charities that want evidence collection handled continuously, not just at renewal | Still requires a named trustee or staff owner to review and approve outputs |
Verdict: a charity applying for grant funding in 2026 should pair Cyber Essentials with IASME Governance rather than choosing one — most funder security questionnaires ask for both.
Common mistakes charities make with IASME Governance
- Treating it as an IT-only exercise — governance themes need trustee sign-off, not just a system administrator's input
- Skipping volunteer training records — assessors treat volunteers the same as staff for the staff awareness theme
- Leaving data retention undefined — "we keep everything just in case" fails the legal and regulatory theme
- Forgetting supplier contracts — a donation platform or CRM processor without a data handling clause is a gap
- Letting renewal lapse — a charity that certified once in 2024 and never renewed has nothing current to show a funder in 2026
Frequently asked questions
One last thing
The theme most charities under-score isn't technical security — it's business continuity, because a drop-in centre or food bank rarely has a written plan for what happens if the office floods or the donation platform goes down for a week. Write that plan before the assessment, not during it.