Cyber attacks – what charities need to do

Charities should be aware of “WannaCry” and “Petya”. These are the cyber attacks that have brought organisations to a standstill recently. Many charities are not investing in adequate levels of cyber protection. The Charity Commission has warned that charities could be at risk and should be vigilant. Further Matthew Hancock the digital minister has said charities “must do better” to protect sensitive information they hold as it emerged that many smaller organisations rely on external IT providers to protect their data.
Data protection legislation requires that for every charity that controls personal data, for example information about staff or donors, “appropriate technical and organisational measures must be taken against unauthorised or unlawful processing of personal data”. A cyber-attack will usually result in unauthorised or unlawful processing of personal data. So charities need to take steps to resist cyber-attacks in order to comply with the law.
Technical measures include use of appropriate antivirus software, software updates and patches.
Organisational measures include raising awareness amongst staff and keeping working practices under review. Typical areas of vulnerability are:
 Mobile and remote working. A range of measures can be taken to minimise the risk involved in working remotely. For example, charities can keep the amount of data stored on a mobile device down to the minimum necessary to carry out the required business activity.
 Passwords. With individuals now expected to maintain numerous separate passwords, requiring users to regularly change their passwords is now considered to be potentially counterproductive. Password rules are necessary, but they should be simple and easy to follow.
 Email. Training to help staff to spot increasingly sophisticated phishing and spoofing, and avoid clicking on links or attachments, can reduce the risk of malware being introduced into systems.
Being the victim of a cyber-attack can be very unfortunate. But those organisations that have not taken appropriate technical and organisational measures to guard against these attacks will still be accountable for the loss. Staff must receive adequate training to deal with online attacks.

Similar Articles

Charity Commission new gu... The commission has published new guidance for charity trustees about fundraising from the public, CC20. The guidance sets out 6 key principles to help trustees comply with
The Data Protection Act ... This week, 2 charities have been found to be in breach of the Data Protection Act and have been issued with monetary penalties by the Information Commissioner.
Charity Fundraising Regul... The Fundraising Regulator has just set up its new website at www.fundraisingregulator.org.uk. It is due to start work this summer. It is the independent regulator of charitable
Can our charity assist wi... The Charity Commission’s guidance has been updated to give consideration of the extent to which the charity sector can undertake activities aiming to help with the effects
Richmond Group of Chariti... Research commissioned by the Richmond Group of Charities shows that charities can add value to the health and care system in a number of ways – which
Charity accounts – ... The main reasons why charity accounts submissions do not meet the basic benchmark  are: failure to evidence that accounts had been subject to independent scrutiny by an
Charities in Scotland are... The Scottish Government has launched a grants scheme to help Scottish  charities boost their cyber security. Managed by the Scottish Council for Voluntary Organisations (SCVO), the scheme
Help for Ukrainians -char... The war in Ukraine has  seen many atrocities and displacement of millions of Ukrainians from their homes. A number of UK charities have set up appeals. However
Trustees responsibility w... Charities regularly enter into contracts with third parties, and the charity trustees must take the time to ensure they are acting in the best interests of the
Welcome to our blog stay tuned for more information.

Leave a Reply

Your email address will not be published. Required fields are marked *