Cyber Essentials Plus is for charities too!
Sara Ward, the CEO of Black Country Women's Aid, discusses her organisation's experience of gaining Cyber Essentials Plus certification.
The charity Black Country Women’s Aid provides advice, support, counselling and accommodation to victims of domestic abuse, stalking, rape and sexual violence, forced marriage, exploitation and women who offend. With humble beginnings around a kitchen table in Sandwell, the charity is now recognised nationally for its innovative models of practice.
Now occupying multiple sites and providing a range of services to victims, Black Country Women's Aid has a turnover of £6.5 million and employs 180 staff.
Security at the next level
The charity was receiving a high number of referrals from local authorities, police and health professionals, which requires information to be managed securely and with confidence. But contracts with the Ministry of Justice and Home Office required even greater security assurance through the Cyber Essentials Plus scheme, which has the additional requirement of a technical audit of IT systems to verify the answers to the self-assessment questionnaire.
“Although we were heading in the right direction, we needed some extra help to achieve these standards,” says CEO Sara Ward.
Sara Ward, CEO, Black Country Women's Aid
“Cyber security certainly isn’t our expertise,” she admits, “and the requirement for Cyber Essentials Plus took us to another level. The language of cyber security was new to us and so we felt we needed the help of experts to improve, and achieve certification.”
The charity worked with an independent cyber security consultant, Chris Blunt of Blunt Security, whose starting point was to identify gaps, “and we had many,” admits Sara. “Chris asked tough questions, and we didn't always know the answer. But we worked through the challenges to find the solution.”
"He picked up a couple of specific points. One was about the bespoke software systems we had running on legacy operating systems, which we upgraded. We also put in place remediation for some of the remote access points, through the external firewall."
A nudge in the right direction
Sara believes this process has made her organisation confident, stronger, more collaborative and more transparent. And, while gaining Cyber Essentials was a contractual requirement, she feels the charity is better as a result of the “gentle nudge.”
“It has made us far more accountable and strategic,” continues Sara. “We now have documented systems and procedures about some of the decision making and actions we take. We didn't know that the system can work for us, as well as for others. Although apprehensive at first, I've transformed from a reluctant technophobe to a willing and engaging participant and now enjoy analysing the reports that help better understand our work.”
When the work started, Sara admits that it felt like a painful process, and she often questioned what they were doing. “Did we have the resources? Would this be a tick-box exercise? Was it worth it? Were we just meeting the terms of a contract? Was this taking us away from what we do well — supporting victims of violence and abuse?” But reflecting now, these questions were unfounded. “How wrong could I be?”
“Information in the wrong hands brings significant risk and could even cost lives. Security isn't just about the location of the safe house, but also the information that we hold about our clients. We want to show not just our commissioners we can be trusted, but also the people who come into our service. Their information is a precious commodity and we've got the systems in place to protect it.”
Owning the challenge
So, having gained Cyber Essentials Plus certification, would she recommend it to other charities? “Yes. They, too, will have personal information about the people they support.The hackers are always several steps ahead of us, leaving us vulnerable and at risk. We genuinely want to help others achieve certification and we’ve offered to be buddies for other charities to help them identify funds for this to happen.”
“I’m really proud of our charity and all it has achieved,” concludes Sara. “We started out with something that was complex and quite scary, and now realise that it's not about fear, it's about structure, accountability and understanding.
“I'm proud to be the CEO of a charity where the trustees were invested in this area, and brought the experts on board and supported the achievement. But it doesn’t stop there. There's a commitment from staff at every level to know more, and a real eagerness for more training and development. We now own the responsibility, and because we do that with people's lives every day, we should do the same with their data. It's been a challenging time but we're richer for it.”
A valuable exercise
And what advice would Sara offer other charities looking to follow the path of Black Country Women's Aid?
“Don’t be afraid of what you don’t know. When running a charity, it often feels like you have to know and do everything, and be a jack of all trades. But I'm honest about what I can’t do. Money is precious in a charity and I understand that it’s a struggle, often with little wriggle room, but the professional cyber security advice we brought in has been worth every penny.”
Visit the website of our Cyber Essentials delivery partner IASME to read the full case study and to find out more about Cyber Essentials and Cyber Essentials Plus.
Sara Ward
CEO, Black Country Women's Aid
Share and print this article
Written by
