Course description

You give your time to a small charity, and you've realised that its email, bank, donor list and volunteers' phones need looking after. This course shows trustees, staff and volunteers how to protect a small charity's information, accounts, devices and money, in plain words and without technical knowledge.

It's written for the charity setting: shared logins, volunteers using their own phones, donor and beneficiary data, trustees who are responsible but not technical, and people who come and go. You begin with what trustees are responsible for and your charity's starting point, then map what you have, sort out passwords and two-step verification, handle shared accounts and handovers, look after devices, set up backups, learn to spot scams, protect payments and data, and prepare for the day something goes wrong.

There are 10 sections and 50 written lessons. Each lesson has a worked example, common slips, questions people often ask and a short exercise to try, and each section ends with a short quiz. You follow Berivan, a volunteer trustee at a small befriending charity in Penrith, as she becomes its cyber lead, builds its plans and deals with real-life scams and an email takeover. In the final lessons you write a cyber action plan for a made-up community food larder in Wrexham, with a worked model answer. Every section has a practice pack, including a starting point check, an asset and data map template, an account owners register spreadsheet, a password and two-step checklist, a leavers and joiners checklist, a device checklist, a backup plan template, a phishing spotter card with made-up examples, a payment checks card, a supplier checklist, an incident response card, a simple cyber policy template, a yearly check and a glossary.

What you'll learn

• Cyber security in a small charity: why small charities are caught up in scams, what attacks look like, what trustees are responsible for and your charity's starting point.
• Knowing what you have: an asset map, a data map for donors, beneficiaries and volunteers, finding forgotten accounts, an account owners register and deciding what matters most.
• Passwords and two-step verification: how passwords get stolen, three random words, a password manager for the charity, two-step verification and passkeys, recovery details and backup codes.
• People, shared accounts and handovers: shared logins, least access, setting up new volunteers, handing over when people leave and when trustees change.
• Phones, laptops and Wi-Fi: updates, screen locks and safe settings, volunteers' own devices, lost phones and old devices, and Wi-Fi at events and in shared buildings.
• Backups: why backups matter, what to back up and how often, online and offline copies, practice restores and a one-page backup plan.
• Phishing and scams: spotting scam emails, texts and calls, fake chairs, suppliers and donors, changed bank details and reporting suspicious messages.
• Money, data and online accounts: a payment checks rule, keeping donor and beneficiary data safe, email, social media and website accounts, fundraising accounts and suppliers.
• When something goes wrong: spotting an incident, the first hour, an incident response card, who to tell, personal data breaches and recovering afterwards.
• Your cyber action plan and final project: a simple cyber policy, training volunteers kindly, a yearly check and a cyber action plan for a made-up community larder, with a model answer.

Who it's for

Trustees, staff and volunteers in small UK charities and community groups, especially anyone who has been asked to look after cyber security. No technical knowledge is needed, and the course doesn't recommend particular products, so it works with whatever devices and services your charity uses.

What this course is, and isn't

This is a practical course, not legal or professional advice. Official points come from UK pages from the NCSC, GOV.UK, the Charity Commission, the Charity Commission for Northern Ireland, the Information Commission (still known as the ICO) and legislation.gov.uk, read on 4 November 2026. Guidance can change, so check the official pages, and take advice for anything serious or unusual. Berivan, Thornyhurst Befriending, Thimblewell Community Larder and every other person and organisation in the course are made up.

What will I learn?

• Explain what trustees are responsible for in cyber security, and choose and support a cyber lead
• Map your charity's devices, accounts, data and paper records, and keep an account owners register
• Set up passphrases, a password manager, two-step verification and recovery details for the accounts that matter
• Handle shared logins, give people only the access they need, and set up and hand over volunteers and trustees safely
• Keep phones, laptops and volunteers' own devices updated and locked, and use Wi-Fi safely at events
• Write a backup plan with online and offline copies and run practice restores
• Spot phishing emails, scam texts and calls, fake requests and changed bank details, and report them
• Protect payments with a two-person checks rule, and keep donor, beneficiary and fundraising accounts secure
• Respond to an incident with a one-page card, and know who to tell, including when to report a personal data breach
• Write a simple cyber policy, train volunteers kindly, run a yearly check and build a cyber action plan

Frequently asked questions