Why do charities need ISO 27001?
- Scale of the sector: there are more than 171,000 registered charities in England and Wales, with a combined annual income of around £106bn (Charity Commission register data, end of 2025).
- How it is run: by roughly 920,000 trustees and some 7 million volunteers: largely people for whom information security is one duty among many.
- Why certification arrives: rarely from the standard itself. It comes through commissioners, NHS and council contracts, corporate partners and funders who now ask, reasonably, how beneficiary and donor information is protected.
Where did the charity start?
The charity’s position will be familiar to many in the sector. The information it held (about the people it exists to help, and about the donors who fund that help) mattered enormously.
The team protecting it was small, busy, and had no dedicated security staff.
My starting point is to remove any mystique about what the standard requires, and then to be careful about scope. We scoped the system to the services and information the requirement actually concerned.
The trustees approved that scope, and the ongoing commitment behind it, before any other work began.
What did I do at the charity?
In brief, I led the implementation of the management system:
- Agreed the scope with the senior team and trustees, and named one person to own the system, with a few protected hours a month to run it.
- Built a simple risk assessment with the people who ran the services, in language they recognised, covering the information they actually held.
- Kept the policy set slim, and took evidence from the systems the charity already had. If a control needs a tool a charity cannot afford to keep, the control is designed wrong.
- Made sure staff and volunteer joiners and leavers were handled properly (access given deliberately, and removed promptly), because that is where auditors look first in organisations like this.
- Ran the internal audit and management review with trustee involvement an auditor could see, and prepared the charity for independent assessment through to certification.
What was the difficult part?
The difficult part in a charity is capacity. Every hour spent on a management system is an hour not spent on the work the charity exists to do, and any consultant who forgets that will build something that dies at the first surveillance audit.
So the discipline is restraint: fewer, better controls, owned by named people, on a calendar rhythm a small team can sustain (risk review, access review, supplier checks, an honest incident log).
What was the outcome at the charity?
The charity achieved independent ISO 27001 certification for the agreed scope. Certification was the decision of the independent certification body, as it always is; my role was to make sure the organisation met that assessment prepared, with a system it could retain afterwards on the resources it actually has.
I have built my business on mutual trust and understanding, and charities run on trust above all: the certificate simply lets a funder or commissioner verify that trust before they rely on it.
Is your situation similar?
If a funder, commissioner or partner is asking your charity for certification, I have set out the proportionate route (including when Cyber Essentials is the right first step) on my charities page. I am always happy to answer questions, so feel free to drop me an email, anytime.