A volunteer gets an email asking them to open a funding document. A treasurer is told that a supplier’s bank details have changed and is asked to amend them urgently. A former trustee still has access to confidential files months after leaving.
The email and payment request may be genuine, but both need checking. Access that is no longer needed should be removed. Otherwise, your charity could lose money or expose confidential information.
If you are a volunteer trustee or manager, you don’t need to understand every security setting but you do need to know who looks after them, whether the essentials are in place and where you might need to get some help.
Your responsibility as a trustee or manager
Scottish charity trustees must act in the charity’s interests, with care and diligence. Protecting its money, information and services falls under that duty.
You can hand the technical work to staff or an external provider. What you can’t hand over is the oversight. Ask for clear answers about what is protected, and follow up on anything that isn’t. A short discussion at a board meeting is often enough to agree what needs checking and who will do it.
Know where your sensitive information sits
Your charity may hold donor details, volunteer records and private information about beneficiaries. Some records, such as health information or safeguarding notes, need particular care.
Start by finding out where these records are kept and who can access them. A volunteer organising an event may need a booking list but not confidential case notes. Remove access when someone leaves or changes role and review information you no longer need to keep.
The same care applies away from the office. If people use personal laptops or phones, agree what they can access and where records should be stored. Charity information should stay in approved systems rather than personal email or messaging accounts.
Make email and payments safer
A hijacked email account lets someone read private messages or pose as a colleague. To reduce this risk, everyone should have their own login and a strong password they don’t use anywhere else. Enable multi-factor authentication (MFA), which asks you for additional proof of identity when signing in, such as a code from an authenticator app.
A fake request can look like it comes from a funder, a supplier or your chair. If someone asks to change bank details, ring them on a number you already hold, rather than one supplied in the email. Give staff and volunteers short, regular reminders about how to recognise suspicious requests and who to tell.
Check devices and backups with your IT support team
Computers and phones need regular security updates and protection against malicious software. Older or donated kit may still run perfectly well but no longer receive updates, so ask your IT support to flag anything that needs replacing.
Ask your IT support what is backed up, how often backups run and when they last tested restoring your files.
What to do if you suspect a cyber incident
Agree a simple incident response plan in advance, including who will lead the response and how staff and volunteers should contact them.
Warning signs include messages you didn’t send, sign-in alerts you don’t recognise, missing files or a ransom demand. If you notice any of these signs, take the following steps promptly:
- Contact the person who is nominated to lead your response and your IT support. Use the phone if email may be compromised. Keep these contact details somewhere accessible – maybe a sticker on your laptop or PC.
- Limit further harm. Stop using a suspected infected device and disconnect it from Wi-Fi and wired networks. Ask your provider to secure affected accounts.
- Keep a record. Note what happened and when. Preserve relevant messages and avoid deleting evidence before taking advice.
- Protect people and money. Contact your bank immediately if money may have been stolen. Consider any safeguarding concerns and check your insurance notification requirements.
If personal information is affected, assess whether the incident must be reported to the Information Commissioner’s Office (ICO). Notify it without undue delay and within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to risk people’s rights and freedoms. Where the likely risk is high, inform affected people without undue delay. Record the breach and your decisions.
Report suspected cybercrime to Police Scotland online or on 101 for non-emergencies. Seek advice about any further reporting obligations.
Get help with the gaps
If you are unsure whether these measures are in place, ask your IT or cyber security provider to review them with you. Agree what needs attention first, who will deal with it and what it will cost.
Secure360.io supports Scottish charities and third-sector organisations with managed cyber security and help preparing for Cyber Essentials certification. To find out how we could support your organisation, visit our cyber security for charities page.