--- title: "ISO 27001 for Charities and Non-Profits (UK)" description: "ISO 27001 for UK charities: when funders require it, Cyber Essentials first or not, proportionate scoping, realistic costs, and running it with a small team." canonical: https://www.isosecurity.co.uk/resources/iso-27001-for-charities updated: 2026-11-10 --- # ISO 27001 for charities and non-profits Charities hold some of the most sensitive data there is (beneficiaries, donors, health and safeguarding information), usually with the smallest teams to protect it. ISO 27001, scoped proportionately, gives trustees an audited answer for the funders and commissioners who now ask, and my implementation experience includes a UK charity at exactly this scale. ## When do charities meet ISO 27001? - **Commissioned services:** NHS, council and public-sector contracts that score or require certification, especially where beneficiary data is processed. - **Partner supply chains:** lead providers and corporate partners flowing security requirements down to delivery partners. - **Sensitive data at scale:** health, safeguarding, casework or donor databases that make a breach a mission-ending event. - **Questionnaire burden:** funder and partner diligence taking more staff time than the charity can spare: a certificate answers most of it in advance. ## What is different about ISO 27001 in this sector? **Scope is a trustee decision:** certifying the commissioned service or the data-bearing functions first (rather than every shop, warehouse and fundraising activity by default) keeps the project fundable and auditable. The scope must still be credible to the commissioner relying on it, and I work that judgement through with boards early. **Volunteers and trustees are inside the people controls.** Screening proportionate to access, confidentiality expectations, awareness for frontline staff and volunteers, and prompt removal of access when people move on (Annex A 6.1 to 6.6). In charities, leaver processes are where auditors find the gaps, because nobody saw it as a security task. **Evidence must come from systems you already have.** A proportionate ISMS for a charity runs on its existing casework, finance and Microsoft or Google tenancy reports. If a control needs a tool the charity cannot afford to keep, the control design needs rethinking. **The ongoing commitment is the real decision.** Certification runs in three-year cycles with annual surveillance, and trustees should approve the running commitment (the owner's time, surveillance fees, an annual internal audit) with the same care as the initial project. My guide to [maintaining certification](/resources/how-to-maintain-iso-27001-certification) sets out what that rhythm actually involves. ## What does a proportionate route look like for a charity? 1. Confirm what is actually required, by whom, and by when, and whether Cyber Essentials answers it for now. 2. Agree a fundable scope with trustees, and name the ISMS owner. 3. Gap analysis and a simple risk register built with the people who run the services. 4. Slim policies and the Statement of Applicability, evidenced from existing systems. 5. Three months of operating evidence; internal audit; management review with trustee involvement. 6. Stage 1 and Stage 2 with a UKAS-accredited body, booked early, because their diaries are the commonest cause of delay. For the wider picture, my [Cyber Essentials vs ISO 27001 comparison](/resources/iso-27001-vs-cyber-essentials) helps trustees sequence the two schemes, and the [small business guide](/resources/iso-27001-for-small-businesses) covers the proportionate approach that applies equally to small charities. For how this ran in practice, I have written up [my implementation of ISO 27001 for a UK charity](/case-studies/charity-iso-27001): kept proportionate, and built to be run by the team the charity actually has. ## Frequently asked questions about ISO 27001 for charities ### Are charities required to have ISO 27001? There is no general legal requirement for UK charities to certify, and it becomes a practical requirement when a commissioner, NHS or council contract, corporate partner or major funder asks for it in tender scoring, contract terms or supply-chain due diligence. Read the actual wording before assuming, because many funders ask for Cyber Essentials, some ask for ISO 27001, and some accept evidence of working towards it within a stated period. ### Should we do Cyber Essentials first? Usually, yes: Cyber Essentials is what commissioners and funders ask for most often, it is quicker and cheaper, and it fixes the technical basics that stop most attacks on small organisations. Its evidence (device lists, MFA, patching, access control) counts directly towards ISO 27001 controls later, and my comparison guide walks through how the two schemes fit together. ### How much does ISO 27001 cost a charity? A small charity scoping sensibly (one service or the head-office functions, under about 50 staff) typically sits in the smallest band in my UK cost guide: implementation support of £10,000 to £16,000 plus certification-body fees of roughly £3,000 to £10,000, excluding VAT, plus staff time, which is the resource charities feel most. Trustees should budget the ongoing years too (surveillance audits and internal time), because certification runs well beyond the certificate itself. ### We have no IT or security staff. Who runs the ISMS day to day? One named owner with a few protected hours a month can run a proportionate ISMS: usually an operations or office manager rather than a technical hire. The discipline is calendar-based (risk review, supplier checks, access reviews, incident log, annual internal audit and management review with trustees or the senior team), and where no internal capacity exists at all, a virtual CISO arrangement can carry the senior oversight while the named owner handles the routines. ## Contact A funder or commissioner asking for certification? Arrange a readiness discussion: [contact ISO Security](/contact) or email info@isosecurity.co.uk.