Funded cyber certification helps small charities to provide legal aid to vulnerable citizens

The NCSC’s Funded Cyber Essentials Programme offers free practical support to small organisations operating within ‘sectors most at risk of cyber attack’, helping them to put vital cyber security controls in place. The 2023 programme focussed on charities and legal aid sectors. This blog outlines how that year’s programme helped the Law Centres Network achieve Cyber Essentials Plus certification.

The Law Centres Network (LCN) is the national membership body of ‘Law Centres', a group of over 40 charitable organisations across the UK that provide free legal advice to some of the most disadvantaged people in our communities, who are least able to afford a lawyer. The LCN works to improve collaboration across the group, which includes strengthening its IT infrastructure and managing data security. So when Alex Charles, LCN’s IT Digital Officer, read about the Funded Cyber Essentials Programme, it caught her attention.

“Law Centres have a duty of care for their clients. Ideally, they want to make sure that their clients are receiving the best service and that all of their systems are running effectively, and the data is secure.

“However, charitable funds are stretched. If there’s a choice between spending the money making sure that clients are getting the advice they need, or spending the money on the Law Centre’s IT infrastructure, unfortunately the IT tends to come second.”

Cyber Essentials Plus is a government-backed certification scheme that helps organisations of all sizes guard against the most common cyber attacks, and includes a technical audit to verify that appropriate security controls are in place. The Funded Cyber Essentials Programme is targeted at smaller organisations, and covers the cost of completing ‘Cyber Essentials Plus’ certification, including any cyber security consultancy required to help achieve certification.

“One of the things I really like about the funded programme is that it recognises that it’s not a level playing field” says Alex, who at the time was managing a project to bring Law Centres onto a single Office 365 system (to help with hybrid working and collaboration). “For example, if you're a commercial business, you might have more flexibility than a charity for spending on cyber security controls. When NCSC funding became available for Cyber Essentials Plus, it was a brilliant opportunity to offer our members a certification process that met industry standards.

“A Law Centre had already been asked for Cyber Essentials certification when making a funding application and dealing with a debt service. It’s also been requested as part of a financial audit. I think certification gives that reassurance that an organisation is run in accordance with industry best practice.

“If a business or charity wants to win a government contract, Cyber Essentials is mandated as a prerequisite, and we are seeing this become more commonplace elsewhere. Perhaps it will soon be the norm that a cyber security certification is a requirement to work with local authorities.”

“During the certification process, we were able to update our policies to include all of the little bits that weren't quite right, or details we hadn't thought about. There is always something small to fix that you would have otherwise missed - the certification process helps bring those issues and any associated risks to the fore. We were put in touch with an NCSC-assured Cyber Advisor from Achilles Systems, who was very helpful throughout the process.”

Achilles Systems is one of 80+ companies employing Cyber Advisors to support SMEs with practical, cost effective cyber security assistance. With their help, the LCN achieved Cyber Essentials Plus certification last year, with costs covered by the funded programme.

The Funded Cyber Essentials Programme for 2024 is open to all small and micro organisations (1 to 49 employees) registered in the UK, who are:

• Companies working on the development of fundamental Artificial Intelligence (AI) technologies, Quantum technologies, Engineering Biology, or the design and development of semiconductors / semiconductor IP blocks.

Once again, the programme will provide successful applicants with Cyber Essentials Plus certification at no cost. For more information on qualification and to submit your application, please visit the Funded Cyber Essentials page.

Jane Waterfall
IASME (Cyber Essentials Delivery Partner)