Charity IT tends to grow piecemeal: donated laptops, free licences, a volunteer who set up the website years ago, and a handful of online platforms nobody quite owns. Three changes since mid-2025 have landed harder on charities than almost anyone else, and they all show up at Cyber Essentials time.
If you support charities, you're the person best placed to fix them before the assessment. Here's what to check, written by assessors who see where charity applications go wrong.
1. The NCSC now tells small organisations to choose a certified MSP
The NCSC's November 2025 guidance, Choosing a managed service provider, tells SMEs to use providers with recognised certifications such as Cyber Essentials Plus, and to check them on the IASME certificate search. Charity finance leads are starting to ask. Your own certificate is now part of the conversation.
It also matters for your clients' scope. Your own MSP devices are normally outside a client's assessment, because they reach the client's systems rather than holding the client's data. The accounts you use inside the client's tenant are in scope, though, and they need MFA like every other account.
2. The Microsoft Business Premium grant has gone. Check what replaced it
Microsoft retired its free Microsoft 365 Business Premium and Office 365 E1 grants for nonprofits at each organisation's first renewal on or after 1 July 2025. Eligible nonprofits can still get up to 300 free Business Basic licences, and paid plans including Business Premium at a nonprofit discount.
Some charities moved to a paid plan; others dropped back to the free one, sometimes without anyone noticing what changed. If a client's licensing changed, check that every control is still met by whatever they now use: MFA for every user, malware protection on every in-scope device, secure configuration and timely updates. Cyber Essentials doesn't require any particular product, only that each requirement is met.
3. Windows 10 and donated kit
Windows 10 reached end of support on 14 October 2025. IASME's Knowledge Hub is clear that any Windows 10 device used after that date must be enrolled in Microsoft's Extended Security Updates programme to stay compliant. ESU is bought a year at a time and needs Windows 10 version 22H2.
Charities often run donated or long-lived hardware, so look beyond the laptops too: routers, NAS boxes, older phones and tablets, and anything else in scope that has stopped receiving security updates.
4. Danzell's MFA auto-fail meets charity platform sprawl
Since 27 April 2026, the Danzell question set fails any assessment where a cloud service offers MFA and it isn't switched on. Charities typically use more online platforms than a business of the same size, and many were set up by volunteers:
- Donor and supporter databases (CRM)
- Online donation, event and fundraising platforms
- Newsletter and email marketing tools
- Social media accounts, often with a shared login
- Website hosting, the domain registrar and DNS
- Payroll, accounting and grant-management systems
Build a cloud inventory with the client before the assessment starts, and confirm MFA service by service. Supporter platforms are a real target: the Charity Commission has issued guidance to charities affected by a cyber incident at a supporter-management provider.
5. Volunteers, trustees and shared accounts
Charities have more people coming and going than most businesses. The user access control requirements apply to all of them:
- Each person who uses charity systems, including trustees and volunteers, should have their own named account.
- Accounts for leavers, including volunteers who simply stop coming, need removing promptly.
- Admin accounts should be separate from everyday accounts and used only for admin tasks.
- Volunteers' and trustees' own phones or laptops that access charity email or files count as BYOD and are in scope (NCSC Table 2). The exception is a device used only for phone calls, text messages or an MFA app, such as a trustee's phone that just approves sign-ins.
Quick pre-assessment checklist for charity clients
- Firewalls: home and volunteer working; donated or ISP routers still on default admin passwords.
- Secure configuration: default passwords changed; shared or front-desk PCs lock automatically; unused accounts and software removed.
- User access control: named accounts for staff, trustees and volunteers; MFA on every cloud service; leavers removed; separate admin accounts.
- Malware protection: active on every in-scope device, including BYOD.
- Security update management: supported software only; Windows 10 on ESU or upgraded; critical and high-risk fixes within 14 days.
The 14-day limit is the maximum the scheme allows. We encourage seven days or less, and expect the window to keep shrinking as attackers use AI to move faster.
How to split the work with your certification body
You fix; we certify. As a certification body, we stay independent: we identify where a client doesn't meet the requirements and explain what a compliant setup needs to do. You choose and implement the solution with your client. That separation is what gives trustees and funders confidence in the certificate.
Our IT partner programme works either way round: you lead the assessment for your client, or we work directly with the charity while you handle the changes. Registered charities with turnover under £2 million can apply for our Charity Special Offer, which gives them the Supported Service free; they pay only the Marking Only fee.
One more free win for your clients: help them register for the NCSC's Early Warning service, so they hear about threats to their domain and IP addresses quickly.
Sources
- Choosing a managed service provider (MSP), NCSC, 24 November 2025
- Microsoft 365 Business Premium and Office 365 E1 grant discontinuation, Microsoft Partner Center announcements, May 2025
- Windows 10 end of support and Cyber Essentials, IASME Knowledge Hub
- Cyber Essentials: Requirements for IT Infrastructure v3.3, NCSC, April 2026: section D(i) BYOD and section D(vi) Table 2, page 12 (volunteer and trustee devices)
- The Cyber Essentials guide to working with contractors, IASME
- Cyber Essentials overview and requirements, NCSC (v3.3, Danzell, from 27 April 2026)
- Guidance for charities affected by the Beacon cyber security incident, Charity Commission
- Early Warning, NCSC
