What are trustees responsible for when it comes to IT and cyber security?

Charity trustees are not expected to be IT or cybersecurity experts. However, they are responsible for oversight and for ensuring that reasonable steps are taken to manage risk.

This includes responsibility for:

• Protecting personal and sensitive data
• Reducing cybersecurity risks
• Ensuring systems are reliable and supported
• Maintaining public trust and confidence

UK guidance from bodies such as the Charity Commission and the National Cyber Security Centre makes it clear that cyber security is part of good governance, not a purely technical issue.

---

What “reasonable steps” usually look like

For most charities, reasonable steps include:

• Knowing what IT systems are in use
• Ensuring data is stored and accessed securely
• Using strong passwords and multi-factor authentication
• Keeping systems and software up to date
• Having backups and basic incident plans
• Knowing who is responsible for IT decisions

Trustees should also ensure risks are discussed, documented, and reviewed, particularly where charities rely on volunteers or third parties.

---

Trustees, volunteers, and accountability

Many charities rely on volunteers to help with IT. This can be appropriate, but it does not remove trustee responsibility.

Trustees remain accountable for decisions, even where day-to-day tasks are delegated. Clear roles, access controls, and documentation help reduce risk for everyone involved.

---

Getting the right support

Good IT support helps trustees:

• Understand risks without technical jargon
• Make informed, defensible decisions
• Demonstrate good governance
• Avoid avoidable incidents and stress

Trustees should feel confident asking questions and seeking support where needed.