Cyber Security for UK Charities — Non-Profits, Trusts & Foundations
UK charities process some of the most sensitive data in any sector — safeguarding records, vulnerable-beneficiary details, donation histories, Gift Aid declarations — on limited IT budgets. The Charity Commission has explicitly named cyber as a top-5 risk to UK charities since 2022. We deliver NCSC Small Charity Guide-aligned controls at charity-friendlier prices.
30%+
of UK charities reported a cyber incident in the last 12 months (NCSC)
£1m+
average UK cyber fraud loss per major charity incident
24/7
Gridisys managed SOC for UK small charities — charity rate
Top 5
Charity Commission named cyber as a top-5 UK charity risk
Cybersecurity Consulting + 24/7 SOC Monitoring
Every Gridisys engagement is built on two pillars — strategic consulting to design the right controls, and managed SOC monitoring to keep them effective.
Cybersecurity Consulting
UK consulting engagements: risk assessment, security architecture, conditional access design, compliance (Cyber Essentials, UK GDPR, FCA PS21/3, NIS2), incident-response planning. Board-ready documentation, no jargon, no surprise invoices.
- Risk assessment + security architecture review
- Conditional access + Entra ID hardening design
- Cyber Essentials / UK GDPR / FCA / NIS2 compliance support
- Incident response planning + tabletop exercises
- Vendor + supply-chain security assessment
- Board / DPO reporting + evidence pack
Managed SOC Monitoring · 24/7
AI-augmented Security Operations Centre — continuous monitoring across Microsoft 365 / Entra ID, Defender, on-prem, and cloud. UK-based analysts, sub-hour triage on critical alerts. No long contract required.
- 24/7 SIEM monitoring — Microsoft 365, Entra ID, Defender, Azure, on-prem logs
- BEC + mailbox-compromise + OAuth grant abuse detection
- Suspicious sign-in + conditional access drift alerting
- Ransomware + lateral-movement detection from EDR + Defender
- Sub-hour triage on critical alerts, monthly ops report
- Optional + integrated with consulting engagements
Most engagements start with consulting (1-2 weeks), then SOC monitoring (ongoing ) keeps the controls effective.
Pricing tailored to your needs
Every engagement is scoped to your environment and requirements. Book a free consultation for a tailored quote — no obligation.
What we cover
Practical, board-ready consulting — no jargon, no surprise invoices.
Managed SOC for M365 (Business Premium)
Many UK charities run Microsoft 365 Business Premium — Microsoft includes security tooling but most charities don't have dedicated security staff. We operate the 24/7 monitoring layer on top of Business Premium: every sign-in, mailbox, OAuth grant, conditional access drift.
NCSC Small Charity Guide alignment
NCSC's Small Charity Guide offers 5 low-cost controls. We align your environment — MFA everywhere, conditional access, regular backups, anti-phishing training, incident response plan — and document alignment for safeguarding donor & beneficiary data.
Safeguarding record protection
Safeguarding lead records (children, vulnerable adults, allegations) are Article 9 special category and the highest-risk single dataset you hold. We design restricted-IPM safeguarding mailboxes, named-deputy access lists, encryption at rest, audit trail, retention schedule aligned to Charity Commission guidance.
Donor data protection + Gift Aid claims
Donor records — including name, address, gift history, Gift Aid declarations — require retention under HMRC Gift Aid rules (6 years), explicit lawful basis, encryption at rest, third-party processor management (JustGiving, Enthuse, CRM tools).
Fundraising platform and CRM monitoring
Most UK charities use Salesforce NPSP, Raiser's Edge, Donorfy, Beacon, Salesforce.org — these hold the bulk of donor data. We monitor API / OAuth grant abuse, after-hours data exports, superuser access patterns, and supplier compromise alerts.
Trustees + CEO briefing pack
Trustees have fiduciary duty re: cyber risk under Charity Commission guidance. We provide a quarterly exec briefing pack: current risk posture, incidents triaged, control gaps, board-level decisions needed. Tells trustees what they need to know.
How we work
Scoping (Week 1)
Confirm charity size (income band), safeguarding lead arrangement, fundraising platform vendor, Gift Aid status, current M365 / Entra or Google Workspace posture.
Deploy (Week 1-2)
Connect M365 / Google Workspace to Gridisys SOC. Configure conditional access: MFA everywhere, restrict sign-in to UK + verified devices. Configure CRM OAuth grant monitoring.
Evidence + training (Week 2-3)
Document Article 32 technical measures pack. Train safeguarding lead, fundraising team, finance team on the specific patterns. Set up ICO breach preparation template.
Operate (ongoing)
24/7 monitoring + quarterly trustee briefing + on-call incident triage. Annual Charity Commission statement of cyber risk.
Sectors we protect
Cybersecurity sized to charitable budgets
Free 30-minute consultation for charity CEOs, trustees and safeguarding leads. We assess your NCSC Small Charity Guide alignment + safeguarding-record risk. Charity rate.
RELATED UK CYBERSECURITY SERVICES