In short: Cyber security training for charities teaches staff, volunteers and trustees to spot phishing, protect donations and supporter data, and report problems quickly. Start with the NCSC's free Small Charity Guide and Top Tips for Staff, then add a low-cost platform for simulations, automatic enrolment and the records trustees need for good governance.
Why charities are targeted
Charities face the same phishing and fraud as businesses, plus some risks of their own:
- Volunteers and part-time staff who use charity systems occasionally and may not know normal processes
- Shared accounts and inboxes (info@, donations@) that several people access, sometimes with one shared password
- Donation and payment fraud: fake grant payments, overpayment refund scams, and fraudulent bank-detail changes from 'suppliers' or 'partner organisations'
- Impersonation of the chief executive or a trustee asking for an urgent payment or gift cards
- Sensitive data about supporters, beneficiaries and sometimes vulnerable people
- Personal devices used by volunteers and trustees
The Charity Commission's guidance says trustees must take reasonable steps to protect their charity from cyber crime, and that they remain responsible even when they delegate cyber security to staff or a supplier.
Free NCSC resources for charities
The NCSC publishes free material written with small organisations in mind:
| Resource | What it covers | Best for |
|---|---|---|
| NCSC Small Charity Guide | Five low-cost steps: backing up data, protecting against malware, keeping smartphones and tablets safe, using passwords well and defending against phishing | Trustees and whoever looks after IT |
| NCSC Top Tips for Staff | Free e-learning, under 30 minutes, no login: phishing, strong passwords, securing devices and reporting incidents; also downloadable for your own learning system | Every member of staff and every regular volunteer |
| NCSC Board Toolkit and Cyber Governance Training | Questions and resources for boards and trustees | Trustee boards |
These are an excellent baseline. Larger or higher-risk charities should also look at Cyber Essentials and the NCSC's 10 Steps to Cyber Security. Our page on free security awareness training explains what the free resources do and do not provide, and NCSC guidance on staff training summarises the wider advice.
Including volunteers without overloading them
Volunteers give their time freely, so training needs to be short, relevant and easy to complete on a phone.
- Give volunteers with system access a short essentials path: phishing, passwords and MFA, reporting and data handling
- Replace shared logins with individual accounts where you can, so access can be removed when someone leaves
- Set clear rules on personal devices and on where supporter data may be stored
- Make reporting easy and blame-free: a volunteer who flags a suspicious email is helping
- Remove access and training enrolment together when a volunteer stops
See security for remote and hybrid workers for home-device advice, and insider threat awareness training for joiners, movers and leavers.
Protecting donations and payments
Payment fraud is one of the most damaging risks for a charity, because the money lost was given for a cause. Train finance staff, treasurers and anyone who approves payments to:
- Verify any change of bank details by calling the supplier or partner on a number already held, never one in the email
- Require a second person to approve new payees and large or unusual payments
- Treat urgency and secrecy from 'the chief executive' or 'a trustee' as warning signs
- Be wary of unexpected grant offers, overpaid donations and refund requests
Our business email compromise training covers these scenarios in depth. If fraud does happen, contact your bank at once and report it to Report Fraud, the service that replaced Action Fraud in England, Wales and Northern Ireland (in Scotland, report to Police Scotland). The Charity Commission also says a cyber attack may need to be reported to it as a serious incident.
Low-cost options when you outgrow the free material
When you want simulations, automatic enrolment, reminders and a record of who has completed what, a paid platform adds those for a per-user fee. Several platforms we supply suit small organisations:
- usecure, with automated training and phishing and Microsoft 365 or Google Workspace user sync
- HacWare, with very short automated lessons
- Breach Secure Now, with weekly micro-training and policy sign-off
- Attack Simulation Training, if your Microsoft 365 licences already include Defender for Office 365 Plan 2
Ask us for a quote: we will size the programme to the people who actually use your systems, and our small business approach works well for small charities.
How we help charities
We start from the free NCSC material, add the minimum platform you need, set up simulations and policy sign-off, and give trustees a short quarterly report. Our managed security awareness training service keeps it running without taking up staff time.
Contact us to plan training for your staff, volunteers and trustees.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is there free cyber security training for charities?
Yes. The NCSC's Small Charity Guide and its Top Tips for Staff e-learning are free, and Top Tips for Staff takes under 30 minutes with no login. A paid platform adds simulations, automatic enrolment and completion records.
Do charity volunteers need cyber security training?
Any volunteer with access to charity systems, email or supporter data should complete at least the core topics: phishing, passwords and MFA, reporting and data handling. Keep it short and mobile-friendly.
What are the biggest cyber risks for charities?
Phishing, payment and donation fraud, impersonation of the chief executive or trustees, shared accounts and the loss of supporter or beneficiary data. Training plus simple payment-verification rules addresses most of them.
Are trustees responsible for cyber security?
Yes. The Charity Commission's guidance says trustees must take reasonable steps to protect their charity from cyber crime and remain responsible even if they delegate it. Trustees do not need to be technical, but they should ask the right questions and see regular reports.