The Beacon Cyber Security Incident: Practical Questions For Charity Trustees

Recent reports of a cyber security incident affecting Beacon, a widely used customer relationship management platform in the charity sector, have prompted the Charity Commission to issue guidance to potentially affected charities.

Beacon is used by many charities to manage donor relationships, fundraising activities, event ticketing and case management. While the immediate focus will naturally be on data security, the incident also raises a broader question: are boards paying enough attention to cyber risk, or is it still seen as something for the IT team to address?

For trustees and senior leaders, the Beacon incident is a useful reminder that cyber security can no longer be left in the server room with the cables and blinking lights. It belongs firmly on the board agenda.

Why This Is Not Just an IT Issue

It is easy for boards to regard cyber security as something to be delegated to an IT team, external consultants or software providers. However, responsibility for overseeing these risks remains with the trustees, even where the relevant technology or expertise is provided externally.

Trustees are responsible for ensuring that their charity appropriately identifies, assesses and manages risk. Increasingly, that includes cyber risk, data protection risk and reliance on third-party suppliers. The fact that a service is provided by an external platform does not remove the need for a board to understand and oversee the risks associated with that arrangement.

Modern organisations often depend heavily on third-party technology providers for fundraising, communications, finance, administration and record-keeping. Their resilience therefore depends, in part, on the security and reliability of those critical suppliers. 

The relevant question for trustees is not whether they can manage the technology themselves, but whether they have satisfied themselves that appropriate systems, controls and oversight arrangements are in place.

What Trustees Can Do

Trustee oversight does not mean that every trustee needs technical expertise. It does, however, require trustees to ask appropriate questions. For example:

• Is cyber risk properly reflected in the charity’s risk register?
• What due diligence was undertaken before engaging critical suppliers?
• How are third-party providers monitored and reviewed?
• What contractual protections are in place if a supplier experiences a cyber incident?
• What incident response procedures does the charity have?
• How would the charity continue operating if a critical system became unavailable?
• Does the board receive regular and intelligible reporting on cyber and data protection risks?
• Is it clear who is responsible for making decisions and regulatory reports if an incident occurs?

These are questions of oversight rather than technical operation.

A cyber incident may also require trustees to consider whether reports should be made to the Charity Commission and the Information Commissioner’s Office, whether affected individuals need to be informed, and how communications with beneficiaries and supporters should be managed.

A serious incident report to the Charity Commission may be required where the incident has resulted in, or risks, significant harm, loss or damage to the charity, its beneficiaries, assets, services or reputation. Trustees should consider the relevant reporting requirements promptly and keep a clear record of the decisions made and the reasons for them.

The ability to respond confidently and coherently will often reflect the arrangements established before an incident occurred. Trustees should therefore understand what their charity depends upon and ensure that appropriate plans are in place before something goes wrong.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.