When do charities meet ISO 27001?
- Commissioned services: NHS, council and public-sector contracts that score or require certification, especially where beneficiary data is processed.
- Partner supply chains: lead providers and corporate partners flowing security requirements down to delivery partners.
- Sensitive data at scale: health, safeguarding, casework or donor databases that make a breach a mission-ending event.
- Questionnaire burden: funder and partner diligence taking more staff time than the charity can spare: a certificate answers most of it in advance.
What is different about ISO 27001 in this sector?
Scope is a trustee decision: certifying the commissioned service or the data-bearing functions first (rather than every shop, warehouse and fundraising activity by default) keeps the project fundable and auditable. The scope must still be credible to the commissioner relying on it, and I work that judgement through with boards early.
Volunteers and trustees are inside the people controls. Screening proportionate to access, confidentiality expectations, awareness for frontline staff and volunteers, and prompt removal of access when people move on (Annex A 6.1 to 6.6). In charities, leaver processes are where auditors find the gaps, because nobody saw it as a security task.
Evidence must come from systems you already have. A proportionate ISMS for a charity runs on its existing casework, finance and Microsoft or Google tenancy reports. If a control needs a tool the charity cannot afford to keep, the control design needs rethinking.
The ongoing commitment is the real decision. Certification runs in three-year cycles with annual surveillance, and trustees should approve the running commitment (the owner's time, surveillance fees, an annual internal audit) with the same care as the initial project.
My guide to maintaining certification sets out what that rhythm actually involves.
What does a proportionate route look like for a charity?
- Confirm what is actually required, by whom, and by when, and whether Cyber Essentials answers it for now.
- Agree a fundable scope with trustees, and name the ISMS owner.
- Gap analysis and a simple risk register built with the people who run the services.
- Slim policies and the Statement of Applicability, evidenced from existing systems.
- Three months of operating evidence; internal audit; management review with trustee involvement.
- Stage 1 and Stage 2 with a UKAS-accredited body, booked early, because their diaries are the commonest cause of delay.
For the wider picture, my Cyber Essentials vs ISO 27001 comparison helps trustees sequence the two schemes, and the small business guide covers the proportionate approach that applies equally to small charities.
For how this ran in practice, I have written up my implementation of ISO 27001 for a UK charity : kept proportionate, and built to be run by the team the charity actually has.