Cyber Essentials and Microsoft 365 for charities
Trustee duties under Charity Commission guidance, serious incident reporting, and keeping your nonprofit licences.
The rules, and where they come from
Charity trustees are responsible for protecting their charity from cyber crime, even when someone else runs the IT. The Charity Commission says so in its guidance, and it expects charities to report serious incidents, including significant data breaches. The Commission does not require Cyber Essentials, but it suggests it for medium and large charities. This applies in England and Wales.
| What | Status | Source |
|---|---|---|
| Be aware of the risks, take reasonable steps to protect the charity, and respond properly to attacks | Trustee duty ("must manage your charity's resources responsibly") | Protect your charity from cyber crime, 27 November 2024 |
| "All the trustees remain responsible", even if cyber security is delegated | Trustee duty | Same guidance |
| Report serious incidents promptly, including cyber crime and "significant data breaches/losses" | Required by the Commission | How to report a serious incident, updated 16 January 2026 |
| Charities with income over £25,000 sign a declaration in the annual return that no serious incident went unreported | Required | Same guidance |
| Join the Cyber Essentials scheme | Suggested for medium and large charities | Protect your charity from cyber crime |
| Report a personal data breach to the ICO within 72 hours, where feasible, unless unlikely to risk people's rights | Required by law | UK GDPR Article 33 |
A charity can still meet a Cyber Essentials requirement through a public contract or a funder. In the year to June 2026, 185 certificates were sought because a grant required it (DSIT).
The government's 2025/2026 Cyber Security Breaches Survey found that 28% of charities identified a breach or attack in the last 12 months, with phishing the most common at 25% (DSIT, 30 April 2026). Larger charities are more likely to be victims: 34% of charities with income of £500,000 or more experienced cyber crime, against 10% of those under £100,000. Only 38% of charities used two-factor authentication, and 13% had the technical controls of Cyber Essentials in all five areas. Under the Cyber Essentials requirements, volunteers' and trustees' own devices are in scope if they access the charity's data or services (NCSC requirements v3.3).
Microsoft runs a nonprofit programme with granted and discounted licences, and sets the eligibility rules. It has retired its Microsoft 365 Business Premium grant: licences on it expire at their next renewal and do not renew (Microsoft), so check what your charity is on now. The plan matters for security: Defender for Business is included in Business Premium and is an add-on on other plans, and our Secure plan's laptop and phone management with Intune needs Business Premium.
How we deliver it
You can keep your licences where they are: we can manage or audit your Microsoft 365 without supplying them.
- Essentials, £12 per user a month: an email helpdesk for staff, starters and leavers, licence changes, password and MFA resets.
- Managed, £35: computers patched and monitored, Huntress Managed EDR watched 24/7, Defender for Business set up, MFA and email security settings kept, Microsoft 365 backup, and unlimited remote fixes during support hours. Defender for Business is included in Business Premium. On other plans it is a £2.30 per user licence add-on.
- Cyber Essentials for medium and large charities, or where a funder or contract asks: £795 a year for up to 9 people on Managed or Secure, or £995 without a plan. IASME's cyber liability insurance comes with the certificate for UK organisations with turnover under £20m that certify the whole organisation and opt in. It covers incident response up to a £25,000 limit, underwritten by AIG UK. It does not cover money stolen by electronic means or cyber fraud, so check your own cover too.
Managed and Secure have a minimum of £250 a month, and support plans have a minimum of 5 users. The example below uses our commercial prices; nonprofit licence pricing may be lower, so ask us.
Example at our prices
Example only, not a quote
A charity with 9 Microsoft 365 accounts (6 staff and 3 trustees) on Business Premium at the commercial price, on our Managed plan, certifying to Cyber Essentials.
- Licences: 9 × £24.60 = £221.40 a month
- Managed support: 9 × £35 = £315 a month, above the £250 monthly minimum
- Together: £221.40 + £315 = £536.40 a month, or £6,436.80 a year
- Cyber Essentials, support-client price for 1 to 9 people: £795 a year
- Year one: £6,436.80 + £795 = £7,231.80, excluding VAT
A smaller team of 6 pays the £250 monthly minimum for Managed, because 6 × £35 is £210.
Common questions
Do charities need Cyber Essentials?
Not by law. The Charity Commission suggests it for medium and large charities. A funder or a public contract may require it.
Who is responsible for cyber security in a charity?
The trustees. The Commission says you may delegate cyber security, but all the trustees remain responsible for making sure your charity is protected.
Can we keep our nonprofit Microsoft licences?
Yes. Your licences can stay with Microsoft's nonprofit programme and we manage the tenant. Microsoft retired the Business Premium grant, so check what your charity is on now. Nonprofit licence pricing may be lower than the commercial prices on this page; ask us.